International Report - Issue 161
14 October 2019
- Thailand – Asia’s strong new data protection law
- CNIL’s guidance on cookies sets stricter consent requirements
- Australia debates tougher privacy regulation of digital platforms
- Jersey to stay in the European mainstream for data protection
- Navigating the right to data portability in the EU’s GDPR
- Making GDPR compliance a competitive advantage
NEWS IN BRIEF
- Cayman Islands DP law in force
- Italy: Consumer credit code adopted
- CJEU: Un-checking a box does not constitute valid consent
- Poland issues large GDPR fine
- CJEU rules on Google and Right to be Forgotten
- Companies violate Privacy Shield
- Gibraltar joins Convention 108
- Amended EU e-Privacy Regulation
- Google and YouTube ordered to pay $170 million
- US business leaders voice strong support for federal privacy law
- Privacy v. public order in Hong Kong
Publisher's Cover Note
The balance between privacy and public order everywhere
PL&B Reports and events mainly focus on privacy laws which impact business but the violent actions on the streets of Hong Kong lead me to reflect on the balance between protecting privacy and defending civil order.
This balance is brought to everyone’s attention by the Hong Kong government’s emergency regulations ordinance (regulation) banning the use of face masks which started on Sunday, 6 October (p.31). Hong Kong’s regulation bans all face coverings, including paint, at any public gathering, with penalties including a fine and a year in jail.
Privacy is not an absolute right, as there always exceptions in legislation including for the defence of national security, and the investigation and prosecution of criminal acts.
The regulation, created by British authorities to break up port strikes in 1922, had not been used for more than half a century, and never since the handover of Hong Kong to Chinese rule in 1997.
At the press conference to announce the new anti-mask law, Carrie Lam, Hong Kong’s Chief Executive, said that if violence was not halted the government would not rule out any measures permitted by law. “Freedoms are not without limits.”
The government of the People’s Republic of China in Beijing gave 10 reasons for supporting Lam’s ban on masks in Hong Kong claiming that it would bring an end to the violence and that the anonymity masks have given student protesters the notion that their violent acts are all part of a game.
By 10 October, 2,379 people had been arrested, declared Hong Kong’s Chief Secretary for Administration, Matthew Cheung. He announced that 750 – or nearly a third – since June were under 18, and 104 were under 16.
Hong Kong Privacy Commissioner’s response
Hong Kong’s Privacy Commissioner for Personal Data (PCPD) gave his balanced response to the mask ban on 4 October (p.31). Thinking solely of the privacy law issues, the question arises whether Hong Kong police and security forces are legally empowered, once they have video images of protestors, to subject them to facial recognition software with the help of any accessible databases, particularly the HK ID card? If so, do they identify and prosecute individual protestors without the need for individual warrants? In short, is matching of CCTV images and the Hong Kong smart identity card being used beyond their original purpose?
While the events in Hong Kong bring into focus privacy issues around facial recognition systems, the same balancing point applies to relatively peaceful Extinction Rebellion protests in the United Kingdom and in other countries and the policing of sports games and protection of the public against terrorism in every country. After terrorist attacks in Denmark, Norway and New Zealand, the authorities need to be vigilant even in countries regarded as outstanding areas of peaceful civil society.
On 30 October, PL&B’s Asia Conference, hosted by and in cooperation with Linklaters in London, will focus on China, Japan, South Korea and Singapore with briefer coverage of India, Thailand (p.1) and, yes, Hong Kong.
In the US, there is a turning point, as major corporations are now advocating a comprehensive federal consumer privacy law (p.31). On 14 November, PL&B’s United States Conference, hosted by and in cooperation with Latham & Watkins in London, has the title New Era for US Privacy Laws: California and More.
Balancing privacy with biometric techniques in a commercial context is the title of PL&B’s Roundtable on 29 January 2020 in London, hosted by and in cooperation with Macquarie Group. We are still developing this event so let me know this month at email@example.com if you are interested in sharing your experience with your peers.
Student essay competition winners
In this edition, we publish our two prize winning essays (p.24 and 28). We are delighted by the response with high quality essays submitted by students based in several countries including France, Greece, Hong Kong, Kenya the Netherlands, Turkey and the United Kingdom.
For next year’s PL&B 33rd Annual International Conference, we will again run this competition with the prize of a free place at PL&B’s Annual International Conference, 29 June to 1 July 2020 at St. John’s College, Cambridge. The next three candidates won a one-year free subscription to PL&B International Report. We thank all the candidates and those who encouraged them to enter. We will launch the next student essay competition in January.
DPAs’ Conference in Albania
Laura Linkomies, Editor, and I will soon be travelling to Albania to the 41st Annual Conference of Data Protection and Privacy Commissioners. Professor Graham Greenleaf, Asia-Pacific Editor, is on the organising committee for the open days of the conference. We will report on this event in your December edition.
Stewart Dresner, Publisher