Wacks, Raymond --- "Privacy and media intrusion: a new twist" [1999] PrivLawPRpr 50; (1999) 6(4) Privacy Law & Policy Reporter 48

Privacy and media intrusion: a new twist

Media intrusion
New torts proposed
Privacy Commissioner judicially reviewed
Conclusion

---

Privacy and media intrusion: a new twist

Raymond Wacks

The typhoon season in Hong Kong has witnessed a tempestuous debate, provoked by the publication of two consultation papers by the Law Reform Commission’s privacy sub-committee. One proposes, inter alia, the establishment of an independent Press Council for the Protection of Privacy.[1] It was greeted by a storm of condemnation in the media — which is not entirely surprising, since the press itself obviously has a direct interest in the matter. The other paper recommends more sweeping safeguards for privacy; notably, the creation of a statutory tort of invasion of privacy. It has passed almost unnoticed.[2]

Also escaping much publicity is the news that the Privacy Commissioner for Personal Data has survived the first judicial review of the exercise of his power.[3] The decision raises a number of fundamental questions about the character and scope of the Personal Data (Privacy) Ordinance.[4]

Media intrusion

Press freedom is a sensitive subject in Hong Kong. While neither the Chinese authorities nor the Hong Kong Government have exhibited an inclination to control the press, there are, despite the promises contained in the Basic Law[5] and the Bill of Rights Ordinance,[6] legitimate fears that should this freedom prove uncongenial, a chill could swiftly begin to blow from the north.

The Law Reform Commission’s consultation paper should be read against that background, but it hardly justifies the ill informed hysteria that, as I write, shows little sign of abating. The members of the sub-committee have been dubbed government stooges. We can, I think, handle this sort of offensive blather, but it does rather inhibit the exercise of rational debate that presumably the press wishes to foster. The Commission, it is true, is housed in the Department of Justice and its chairman is the Secretary of Justice. But there is absolutely no evidence of the Government, or anyone else, applying pressure to the sub-committee. Our errors are our own. Blaming the Government (and dismissing the proposed Press Council, whatever its shortcomings, as ‘a government controlled body’) is unhelpful.

The sub-committee was in little doubt that a problem existed. Certain Chinese language newspapers are notorious for their explicit, occasionally disturbing, photographs of injured, dying or even dead individuals. Intrusions into private grief are not uncommon. Concern for privacy is not immediately evident in the conduct of the three papers that have a 70 per cent share of the market, nor is there evidence of any serious attempt by the media to regulate itself. Indeed, these three papers are not members of the Newspaper Society that, in any event, plays a very limited role in maintaining, let alone enforcing, ethical standards.

The sub-committee concludes that, though the Privacy Commissioner had the power to issue a code of practice for the news media, the limitations of the Data Protection Principles necessitated more explicit measures. It therefore recommends the establishment of a statutory Press Council for the Protection of Privacy, comprising an equal number of press members and public members appointed by an independent Appointments Commission. Its jurisdiction is to be restricted to matters related to privacy, upon which it would be charged to lay down the standards for compliance by the press. It would have no power to interfere with the internal workings of news organisations.

Principal features of the proposed body include the following:

• newspaper proprietors, publishers and editors should be held responsible for breaches of the Privacy Code;
• half of the Council members (excluding the chairman) should be drawn from the public and the other half from the press;
• the chairman should be a retired judge or a senior lawyer;
• the Council may receive complaints, initiate its own investigations, attempt conciliation, and rule on alleged breaches of its Privacy Code;
• complainants should not be asked to waive their legal rights;
• the Council may reprimand and impose a fine on an errant newspaper, or require the newspaper to publish an apology or correction;
• the Council should not have the power to award compensation;
• newspapers that fail to publish an apology or correction would be liable for a fine;
• any fine imposed by the Council would be recoverable as a civil debt;
• appeal against decisions of the Council would lie to the Court of Appeal; and
• the Council would be immune from liability in the exercise of its powers.

New torts proposed

The sub-committee’s proposed new torts spring from the recognition that neither the Personal Data (Privacy) Ordinance[7] nor the common law[8]afford adequate protection against invasions of privacy by ‘intrusion’ or ‘disclosure’. Based on the concept of a ‘reasonable expectation of privacy’, the committee concludes that an individual has such an expectation in their private affairs and when they are in a state of solitude or seclusion. It therefore proposes that a person who invades another person’s privacy by intruding upon their solitude or seclusion, or by intruding into their private affairs or concerns, should be liable in tort. A second tort is recommended for invasion of privacy arising out of the public disclosure of private facts.

To prevent frivolous and vexatious claims, the notion of ‘offensiveness to a reasonable person’ is included as an element of the two torts, and public disclosure that could be justified in the public interest is to be protected. It is therefore proposed that it should be a defence to an action for public disclosure of private facts if:

• the matter publicised was a matter of legitimate concern to the public;
• the public disclosure would have been privileged under the law of defamation; or
• the matter publicised was in the public domain.

It is also a defence that the intrusion or publication was reasonably necessary for the protection of the person or property of an individual.

Privacy Commissioner judicially reviewed

Eastweek, a popular Chinese magazine, published a photograph of a young woman to illustrate an article on fashion. Her image, taken with a long range lens as she stood at a busy intersection, was used as an example of poor dress sense. Needless to say, she consented to neither the photograph nor its subsequent uncharitable publication. Her successful complaint to the Privacy Commissioner was based on a breach of the first data protection principle (DPP 1) in Sch 1 of the Ordinance requiring, inter alia, that personal data be collected by means that are ‘fair in the circumstances of the case’.

Keith JA (sitting as an additional judge of the Court of First Instance) rejected the magazine’s argument that, since it wanted to capture the complainant’s picture in a ‘natural pose’, its non-consensual long range shot was justified. And he gave short shrift to its claim that, since the Commissioner had accepted that it would have been impractical to obtain the complainant’s prior consent to a candid photograph, such a picture could be taken without her knowledge.

This, the learned judge opined, was an erroneous construction of the Commissioner’s decision, for he had not found the taking of the photograph to have been unfair solely on this ground:

What rendered the taking of the photograph unfair was the fact that it was taken without the complainant’s knowledge or consent at a time when (a) the photographer did not have reasonable grounds for thinking that he would be able to obtain her consent to its publication, and (b) the magazine did not have a policy of publishing someone’s photograph (obtained without the person’s knowledge or consent) in such a way that the person cannot be identified.[9]

Nor, the court held, was this a matter of the photographer’s subjective judgment. The Commissioner had ruled that the photographer had no reasonable grounds to believe that the complainant’s consent could be obtained to the publication of her photograph. Keith JA observed that the fairness of the means by which personal data are to be collected depends on the circumstances of the case: ‘It would be absurd if a wholly unreasonable belief that such means are fair could render fair means which would otherwise be regarded as unfair.’[10]

In upholding the Commissioner’s ruling, the court has, perhaps unwittingly, acknowledged that the reach of the Ordinance extends well beyond the realm of ‘data protection’, and includes the press. This is a view that I have myself advanced,[11]but it is far from uncontroversial.[12]

A viable alternative to both, I have argued,[13] lies in an expanded Personal Data (Privacy) Ordinance. Though it was not forged for this purpose, its legislative regime could, with only minor amendment, be extended to afford relief to victims of unwanted publicity.

Indeed, this is precisely what it achieved in Eastweek. The complainant was vindicated. Small fry, perhaps, but there was no suggestion by the magazine that its ‘journalistic activity’ fell beyond the orbit of the law.

Three aspects of the judgment warrant comment. First, there is little doubt that the mischief addressed by three generations of data protection law[14]is the misuse of personal data rather than the activities of the press. Indeed, the European Directive on Data Protection explicitly exempts the press from its purview.[15] While the judgment of Keith JA acknowledges this fact,[16]the learned judge nevertheless appears untroubled by the application of the Ordinance to the conduct of journalists.[17]

Second, it is doubtful whether press freedom is served by the unduly narrow conception of ‘news gathering’ adopted by the Commissioner and accepted by the judge. Those engaged in a ‘news activity’ are exempted by s 61 from, inter alia, the requirement to provide data subjects with access to personal data held about them. The Commissioner was not persuaded that the snap of a woman in a ‘lifestyle’ article was ‘news gathering’ even if that phrase could be equated (as the publisher contended) with the definition in s 61(3) of ‘news activity’ to mean ‘any journalistic activity’ and includes ‘observations on ... current affairs’. The court considered this a tenable view, holding that the Commissioner ‘was entitled to conclude that it was no more than an article illustrating and commenting on the ability of various women who were photographed to choose clothes and accessories which co-ordinated with each other’. This is an unduly restrictive understanding of what journalists do.

Third, Keith JA was reluctant to accept that a photograph fell within the Ordinance’s definition of ‘data’ as ‘any representation of information ... in any document’.[18] His view was that ‘data’ related to information about someone, such as a bank balance, and he confessed that he was ‘extremely sceptical’[19]about whether the photograph of the complainant constituted data about her. A closer reading of the Ordinance, however, would have revealed that the term ‘document’ is defined in s 2 to include ‘a film, tape or other device in which visual images are embodied’. A photograph is plainly included. In our digital world, it could not be otherwise.

In the current debate generated by the Law Reform Commission’s two consultation papers, the notion that the Privacy Commissioner should be charged with striking the balance between privacy and press freedom has found little favour. But it is already happening — and it is no bad thing.

Conclusion

While the advent of the internet compels us to re-conceptualise both ‘privacy’ and ‘free speech’, and the tension between them, the central questions are unlikely to change in our digital age.[20] The problem of ‘balancing’ these competing rights has, however, become something of a cliché to be approached with caution,[21] and I am uneasy about the fault based, individual centred analysis of privacy that seems to me to have failed. An information oriented, control based account of privacy offers, I believe, a more promising route towards effective protection of this enigmatic right. The position of the Privacy Commissioner, fashioned in many jurisdictions to achieve a rather different, more modest, objective, may turn out to provide a workmanlike solution to this intractable puzzle.

Raymond Wacks is Professor of Law

and Legal Theory at the University of Hong Kong. He has been writing about privacy for 25 years. We welcome him to the Editorial Board of Privacy Law and Policy Reporter.

---

[1] The Law Reform Commission of Hong Kong, Consultation Paper on the Regulation of Media Intrusion August 1999, para 5.24. I should declare that I am a member of both the Law Reform Commission’s sub-committee on privacy (and since 1 September 1999 its chairman) and, from the same date, a member of the Law Reform Commission.

[2] The Law Reform Commission of Hong Kong, Consultation Paper on Civil Liability for Invasion of Privacy August 1999.

[3] Eastweek Publisher Ltd v Privacy Commissioner of Personal Data [1999] HCAL 98/98.

[4] See generally Berthold M and Wacks R, Data Privacy Law in Hong Kong FT Law & Tax, Hong Kong 1997.

[5] Article 17 of the ICCPR is ‘entrenched’ by art 39 of the Basic Law. The Basic Law itself, in art 28, protects freedom of the person (no arbitrary or unlawful search of the body); art 29 (no arbitrary or unlawful intrusion into a resident’s premises) and art 30 (freedom and privacy of communications) also have broadly couched ‘privacy’ clauses.

[6] Though the right of privacy contained in art 14 of the Ordinance is a right against government and public authorities only.

[7] There is no remedy where the complaint concerns an isolated contravention, or where there is merely a threat or an attempt to act in contravention of a data protection principle. Nor would a claim arise against an eavesdropper or peeping Tom who has not employed a recording device and so does not record the data obtained.

[8] Wacks R, Privacy and Press Freedom Blackstone, London, 1995, ch 3.

[9] At 10-11 (emphasis in original).

[10] At 12-13.

[11] See Wacks R, ‘Towards a new legal and conceptual framework for the protection of internet privacy’ (1999) 3 Irish Intellectual Property Review 1-5; Wacks R, ‘Privacy reconceived: personal information and free speech’ paper presented to the 21st International Conference on Privacy and Personal Data Protection, Hong Kong, 13-15 September 1999.

[12] The Law Reform Commission of Hong Kong concludes that, though the Privacy Commissioner ought to issue a code of practice on the collection and use of personal data for journalistic purposes, DPP 3 was ‘not effective in protecting individuals from unwanted publicity’: the Law Reform Commission of Hong Kong, above note 1, para 5.24.

[13] See above note 11, and Wacks R, ‘Pursuing paparazzi: privacy and intrusive photography’ (1998) 1 HKLJ 1.

[14] For an account of these developments, see Mayer-Schonberger V, ‘Generational development of data protection in Europe’ in Agre P E and Rotenberg M (eds), Technology and Privacy: The New Landscape, 1997. See too Gellman R, ‘Conflict and overlap in privacy regulation: national, inter-national, and private’ in Kahin B and Nesson C (eds), Borders in Cyberspace: Information Policy and the Global Information Infrastructure, 1997.

[15] Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Official Journal of the European Communities 23 November 1995, No L 281, p 31. The Directive provides that in the case of ‘the processing of sound and image data carried out for purposes of journalism or the purposes of literary or artistic expression ... the principles of the Directive are to apply in a restricted manner according to the provisions laid down in Article 9’. Article 9 requires member states to provide for exemptions or derogations for the processing of personal data ‘carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression’.

[16] Thus, for example, the learned judge (at 13) wonders why the Commissioner decided not to investigate a possible breach of DPP 1(3) which requires a data subject to be informed on or before the collection of the data whether he is obliged to provide it. ‘It may be,’ Keith JA speculates, ‘that the Commissioner thought that the taking of someone’s photograph without that person’s knowledge could not amount to the “collection” of data “from” that person ... [and] ... that the taking of someone’s photograph without that person’s consent could not amount to the “supply” of data by that person.’ The language of the Ordinance plainly has other activities in mind; see Wacks R, ‘The new privacy: protecting personal information in a digital age’ paper presented to the Buchmann International Conference on Law, Technology and Information, Faculty of Law, University of Tel Aviv, 13-18 May 1999. In addition, while expressing doubt as to whether a photograph was ‘data’ he thought that ‘the complainant’s real complaint ... related to the invasion of her privacy ... rather than the unfair collection of “data” about her’ (at 17). But surely it is not unreasonable to characterise it as both.

[17] Indeed, in considering the question of the use of the photograph, Keith JA agreed that the Commissioner was entitled to take into account whether the magazine had a policy in respect of the of non-consensual publication of photographs. ‘This is especially so,’ he adds, ‘when the DPP relating to the use of data (DPP3) focuses not on the fairness of the use but on its purpose. The absence of any express prohibition on the unfair use of data strongly suggests that an intention to use it in an unfair manner is a matter which can be taken into account in determining whether its original collection was by unfair means’ (at 14). Leaving aside the potential conflation between ‘intrusion’ and ‘disclosure’, about which there may be certain problems, this dictum assumes the applicability of DPP3 to the press.

[18] Section 2 (emphasis added).

[19] At 17. Although he had ‘real doubts’, since neither party had argued the point he was willing to suppress them.

[20] See Wacks R, ‘Privacy in cyberspace: personal information, free speech, and the internet’ in Birks P (ed), Privacy and Loyalty Clarendon Press, Oxford, 1997, pp 93-112; Wacks R, ‘Towards a new legal and conceptual framework for the protection of internet privacy’ (1999) 3 Irish Intellectual Property Review 1-5.

[21] On the problems of ‘balancing’, see Raab C D, ‘From balancing to steering: new directions for data protection’ in Bennett C J and Grant R (eds), Visions of Privacy: Policy Choices for the Digital Age 1999.