Almost all European countries have privacy statutes -- known as data protection laws -- that are linked to each other in the sense that they all must meet the minimum standards set out in the data protection directive of the European Union. That does not mean all the statutes are equal in their protection or sophistication: Germany, France and the Netherlands are considered leaders; the United Kingdom's professional data-protection staff are also in the forefront of data-protection issues, but the British law has some idiosyncrasies that make it different from most other European models; southern European countries have only recently joined the privacy club, and the strength of their laws remains to be seen at this point.
The United States and Canada both have privacy acts, but they only cover the federal sector. Currently, the province of Quebec is the only place in North America that has regulated privacy in the private sector. Traditional commonwealth countries like Australia and New Zealand also have sophisticated privacy statutes; but in Asia, only Hong Kong, Japan and Taiwan currently have statutes.
As Hong Kong returns to China, the city is faced with deciding whether to emphasize its Chinese culture or continue to consider itself an international city where British and western influences, particularly the use of English, remain as important as its Chinese identity.
For the latter international approach to work, the city needs professionals who operate comfortably in both worlds. Hong Kong has found such a person in Stephen Lau, who was appointed Hong Kong's privacy commissioner for personal data in 1996 to oversee the privacy ordinance passed the year before. Lau was educated in Britain and the United States, but has spent his professional career in Hong Kong. He has been an executive for both EDS and Citicorp and worked 12 years as data processing manager for the Hong Kong Government Data Processing Agency. In a job that requires a good understanding of the collection, maintenance and use of personal information in both the public and private sectors, Lau's background has made him an ideal choice.
In conversation, Lau moves easily from colloquial English to Chinese and back again. His fluency with the languages provides a good analogy to his fluency of being able to shift gears professionally -- working on domestic Hong Kong privacy issues while also placing the city's privacy protections into the fabric of international privacy.
Soon after the handoff to China, Lau's office was in a South China Morning Post article that publicized concerns his office had over police plans to use an individual's Hong Kong identification number -- issued to establish that the person is a permanent resident of the city -- on identification badges worn by their personnel. Lau says the problem was not specifically with the police, since ID badges that include the Hong Kong residency ID are common in both the public and private sector.
His office believes the identification number is a particularly sensitive piece of personal information, particularly since such numbers have been stolen and used for various fraudulent purposes. This concern, coupled with the privacy ordinance's prohibition on the excessive disclosure of information, has led Lau to conclude that the use of the identification number on ID bases is not needed; rather, name and photo ID of an employee should be sufficient.
Lau's office is already providing public education concerning privacy rights, which include the essence of fair information practices: no disclosure without prior consent; right of access and correction; and no use of personal information for a purpose that is not compatible with the purpose for which it was collected. His office has published several pamphlets explaining how the law works, including two entitled Compliance With Data Access and Correction Requests and Outline Action Plan for Complying with the Data Protection Principles. There have even been public service advertisements on Hong Kong television conveying the need to comply with the privacy requirements for personal data under the law.
At about the same time the privacy law was passed, Hong Kong adopted an administrative freedom of information code, modeled after a similar code in Britain, and slowly applied it to the city's agencies. There have been about 2,000 requests received during the previous year. While the city's privacy statute has vital links to the international scene that provide substantial political support for its continued existence, the idea that a freedom of information code could survive without the force of law in a Chinese system has struck many as an anachronism. But according to Janice Lai, who oversees the code from her office in the Efficiency Unit, the code is here to stay and she sees no reason why the changeover should affect its daily operation.
But now the biggest unknown is how the privacy statute, and the city's freedom of information code, will fare under Chinese sovereignty. Hong Kong is now part of a brave new world where a flourishing international capitalism and attributes of a British-style democracy meet the traditions of communism. Hong Kong's vaunted "one country, two systems" is a cultural and political clash of values, and no one knows how the rough edges will be smoothed out. Hong Kong is now called a Special Administrative Region (SAR), a thriving capitalist democracy in a country where neither concept is supposed to exist.
While many westerners are skeptical that such an arrangement can be made to work, knowing what the international community knows about China's behavior, there is a contagious optimism in Hong Kong itself. Stock prices and housing continue to go up and the changeover seems to have had very little direct impact on the city. Hong Kong is already one of the mainland's biggest investors. The international community continues to see Hong Kong as an investment in itself and a viable gateway for investment on the mainland. The U.S. business community has consistently increased its rate of investment there: 37,000 Americans now live in Hong Kong compared to only 22,000 British. The U.S. Consulate has recently completed major construction at its downtown facility and is one of the busiest U.S. diplomatic posts in Asia.
While privacy and other political, economic and cultural traditions are foreign to the mainland, it is the over-arching international importance of Hong Kong that suggests these non-Chinese traditions will remain and continue to be successful. Asked what happens if China takes some action that violates the privacy act, Lau admits that such a possibility is still a great unknown. However, he points out that the privacy ordinance is the law in Hong Kong, and if a Chinese, U.S. or British organization were to violate the law, the rule of law will prevail and Lau will be responsible for ensuring compliance.
Because Hong Kong is such a teeming and important center of international trade, the possibility that personal information -- particularly financial transactional data -- could be subject to privacy violations is extremely high. The European Union's directive on data protection states that personal information should not be sent to another country unless the privacy protections are adequate, which has been interpreted as meaning either equivalent or comparable. If Hong Kong had ignored privacy concerns and failed to establish a data protection scheme -- allowing personal information flows in all directions without adequate privacy protections -- the city would have risked losing its vital flow of such information from countries subscribing to the union's directive. That could prove disastrous and Lau points out that the law allows data users to make transfers only to countries that have an adequate protection of personal information or a contractual arrangement between the parties to ensure adequate protection.
Hong Kong is not the only member of the international economy facing the same problems, and major economic powerhouses like the United States and Japan have not yet convinced the European Union that privacy protections in those countries are satisfactory. While Lau will continue to provide a vigilant eye on data flow in Hong Kong, he says he is hoping that some of the major conflicts inherent in the union's directive can be worked out between the United States and Europe first. In the meantime, he intends to keep an eye on the progress being made by the Union in compiling a list of countries with adequate privacy protections. Hong Kong is also working on such a compilation and Lau notes that synchronization of timing and content between the two efforts is advisable.
Hong Kong is perhaps one of the world's most vibrant cities. Certainly, its historical development and its move to rejoin the mainland make it one of the most interesting spots to watch politically and economically; but if able professionals like Lau and Lai are allowed to do their jobs, Hong Kong's future looks bright.
Harry Hammitt -- who was in Hong Kong during its return to Chinese control -- is editor/publisher of Access Reports, a newsletter published in Lynchburg, Va., covering open government laws and information policy issues.
October Table of Contents
