Introduction
Video cameras have been installed inside some taxi and hailed car compartments in Hong Kong for security and safety purposes. They would record the video images of the passengers. Some unscrupulous drivers might share or upload the recorded video clip online to social media or sell the clip to a media company without any prior consent from the passengers. Once the video goes viral, the passengers whose image and activities captured might face disturbance and distress, especially when they do not expect themselves to star in a widely circulated video and such tape recorded their private and intimate footage.
Regarding the potential serious intrusion into the passengers’ private lives as a result of the leakage of the unauthorised video recording, the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) has procedural safeguards and imposed various obligations on data users through the six data protection principles (“DPP”) as stipulated in Schedule 1 to PDPO. A breach of DPP amounts to a contravention of PDPO. Data users, including but not limited to taxi or hailed car drivers, may face civil and criminal proceedings as a result of the unauthorized disclosure of the recording.
How can the person being filmed seek redress?
Lodge a complaint
If the video clips recorded inside the taxi or other vehicles have been widely distributed, only the data subjects, namely the persons captured in the tapes can lodge a complaint to the Privacy Commissioner for Personal Data (the “Commissioner”) under section 37 of PDPO regarding any contravention of PDPO. It is not necessary to prove that damages have been sustained because of the contravention.
Once the Commissioner receives a complaint, he may investigate and thereafter publish case notes of his investigation. If the Commissioner finds that the data user has breached PDPO, enforcement notice will be served on the data user requesting him to rectify the contravention or refrain from acting in contravention of PDPO. According to section 50A of PDPO, non-compliance of the enforcement notice will attract a maximum sentence of 2 years imprisonment and a fine of HK$50,000. The Commissioner may also refer such non-compliance or any criminal offence under PDPO to the Police for prosecution. Nonetheless, the Commissioner has no power to award compensation or order an apology, according to Chan v Privacy Commissioner for Personal Data Administrative Appeals Board, AAB No 4/1997, 10 July 1997. The data user may within 14 days thereafter file an appeal against the enforcement notice to the Administrative Appeals Board.
Commence civil proceedings
Further or in the alternative to lodging a complaint, if a contravention of PDPO causes the data subjects loss or injured feelings, civil proceedings in the District Court could be commenced for compensation under section 66 of the PDPO.
Who might be complained/sued?
The data user might be complained or sued for breach of DPP of PDPO. Data user has been defined in section 2 of PDPO as “a person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use the data”, which includes taxi or other drivers who hold such video recordings of personal data, news organizations who have bought the video recordings, and anyone who circulates the clips.
On what grounds will one be complained/sued?
DPP 1 of PDPO
According to DPP 1 of PDPO, collection of personal data shall be lawful, fair and not excessive. It also requires data users to take all reasonably practicable steps to inform the data subject of the following when collecting the subject’s personal data:-
-
whether it is obligatory or voluntary for him to furnish the data sought and the consequences of failing to provide them, unless these matters are obvious;
-
the purposes for which the data are to be used; and
-
the classes of persons to which the data will be transferred.
As such, taxi or other drivers and other data users shall notify the passengers of the existence of the video camera inside the taxi or car compartment by, for example, affixing notices on the inner parts or the exterior of the taxi or car, so that the passengers can choose whether to get on the taxi or hailed car. Failure to do so shall be considered as a breach of DPP 1 of PDPO.
To render the collection of the personal data lawful and fair, taxi or other drivers, and other data users shall prove that they have a legitimate basis to collect such personal data, for example, to monitor drivers’ service and to minimize disputes between taxi or other drivers and passengers. Moreover, if the identity of the data subject can be easily identified in the video clips, it may not be regarded as a “fair” collection.
DPP 3 of PDPO
Under DPP 3 of PDPO, personal data shall only be used or disclosed:-
-
for the purpose for which it was originally collected (or failing that, the purposes are under the reasonable expectations of the data subject according to Ng Shek Wai v Medical Council of Hong Kong [2015] 2 HKLRD 121);
-
for a directly related purpose; or
-
for a purpose to which the data subject has consented.
Therefore, if the originally intended purpose of the installation of a camera system is for identification, safety, or self-defence in case of a complaint, the taxi or car drivers will have breached PDPO by disclosing the video clips to a third party for some other or no purpose.
Section 64 of PDPO
In addition, it is a criminal offence for a person who obtains personal data from a data user without the data user’s consent and discloses that personal data with the intent to obtaining a gain or cause loss to the data subject, or in circumstances where the disclosure causes psychological harm to the data subject, according to section 64 of PDPO. Such an offence carries a maximum punishment of HK$1 million fine and five-year imprisonment. The Commissioner shall bear the responsibility to prosecute any person who contravenes section 64 of PDPO.
Section 64 of PDPO
In addition, it is a criminal offence for a person who obtains personal data from a data user without the data user’s consent and discloses that personal data with the intent to obtaining a gain or cause loss to the data subject, or in circumstances where the disclosure causes psychological harm to the data subject, according to section 64 of PDPO. Such an offence carries a maximum punishment of HK$1 million fine and five-year imprisonment. The Commissioner shall bear the responsibility to prosecute any person who contravenes section 64 of PDPO.
Is general tort of privacy or defamation an alternative remedy?
To-date, there is no general tort of privacy in Hong Kong. According to Kaye v Robertson [1991] FSR 62, it is held that the right to privacy had been so long disregarded that it could only now be recognized by the legislature. Nevertheless, an action for misuse or wrongful disclosure of private information is available in the United Kingdom. In Campbell v MGN Ltd [2004] UKHL 22, the House of Lords ruled that the duty of confidentiality arises when a person obtains personal information and the nature of which gives rise to a reasonable expectation of privacy. It remains to be seen whether Hong Kong courts will follow this ruling and allow a claim for misuse of private information so as to provide better safeguards to citizens’ privacy rights.
Whilst the person being recorded in the video footage may suffer reputation damage as a result of the unauthorized dissemination of the video clip, it may not be feasible to sue the newspapers/media who circulate the recordings for defamation since they may raise a defence that they only made factual statements about the situation.
Takeaway
Taxi and other hailed/hired car drivers should be aware of the legal implications of using and circulating the video clips recorded in the taxi or hailed car for purposes not originally intended or unlawful. It is also prudent for them to post a sign of, for instance, “Recording in progress”, or “The taxi is equipped with camera security” in their vehicle. Should the video clips be published, the passengers being recorded may lodge a complaint and commence civil proceedings against the recorders and the publishers with a view to protecting their privacy.
