The “right to be forgotten” (“RTBF”) has been central to the global debate over the balance between individual privacy and freedom of information and of the media in recent years. Such right has been affirmed by the European Court of Justice in a milestone case in 2014, as well as later in the UK, although its application in other countries remains uncertain.

Deacons has successfully represented Google LLC in relation to a landmark Hong Kong decision where the Administrative Appeals Board (“AAB”) confirmed that there is no independent RTBF under Hong Kong law.In the 2020 decision of the AAB in X v Privacy Commissioner for Personal Data (Appeal No. 15/2019), the AAB also made an important ruling on the territorial boundary of the Hong Kong Personal Data (Privacy) Ordinance (“PDPO”) in addition to clarifying whether there is any RTBF under Hong Kong’s privacy law.

X was arrested in 2014. This was reported in various news articles which were later published online. A search of X’s Chinese name via Google’s search engine would reveal internet links to these news articles reporting his arrest.

X requested Google to delist the links to materials which revealed his name and his arrest, and later made a complaint to the Privacy Commissioner on the basis of the RTBF. In 2019 the Privacy Commissioner dismissed the complaint on the grounds that Google LLC, which operates the Google search engine, is a US entity and all of the operations of the search engine took place outside of Hong Kong. As such the PDPO has no jurisdiction over a foreign entity’s conduct on foreign soil. Alternatively, even if the PDPO has jurisdiction over Google, the Privacy Commissioner applied the factors set out in relevant European and United Kingdom cases, such as Google Spain and NT1 & NT2 concerning the RTBF, and held that the balance should lie in favour of freedom of expression and right to information, in retaining the internet links, instead of their removal.

X lodged an appeal against the Privacy Commissioner’s decision before the AAB.

In August 2020, the AAB dismissed the appeal and upheld the Privacy Commissioner’s decision. The AAB held that the territorial jurisdiction of the PDPO only extends to a data user who has operations controlled in, or from, Hong Kong.  In the absence of clear wording to the contrary in the PDPO, there is a presumption against a Hong Kong statute having extra-territorial effect, and the difficulty of enforcement against foreign entities without operations in Hong Kong are strong indications against the PDPO’s extra-territorial application. The AAB held that, in order to attract the jurisdiction of the PDPO, the sole and proper test is to consider whether the data user controls all or any part of the data cycle (i.e., collection, holding, processing, and use) in, or from, Hong Kong. In the present case, Google LLC is not situated, and no part of the data cycle relevant to the operation of Google's search engine takes place, in Hong Kong. As a result, the AAB held that Google LLC is not subject to the PDPO. This is the case even though the personal data collected are of data subjects in Hong Kong or the search results are displayed on the browser’s computer screen in Hong Kong. 

Although this finding was sufficient to dispose of the appeal, the Privacy Commissioner requested the AAB to provide guidance in relation to the issue of the RTBF for future applications. The AAB held that the PDPO is a self-contained piece of legislation and there is no standalone RTBF in Hong Kong. The European cases were distinguished as the wording of the laws were different from those of the PDPO. However, although the RTBF is not an independent right, it is not totally irrelevant since the PDPO does provide that data should be erased pursuant to Data Protection Principle 2 and section 26 of the PDPO on the grounds of (i) data inaccuracy, or (ii) where the data should not be kept longer than necessary, respectively. Therefore, the factors set out in cases such as Google Spain and NT1 & NT2, may be taken into account in appropriate cases when considering the said principles governing data erasure.  

The AAB decision is of great significance to foreign companies with no establishment and operation in Hong Kong, as it makes clear that these companies and their operations are not subject to the PDPO unless the data is controlled in, or from, Hong Kong. Although the findings on the RTBF were obiter, another practical impact of the AAB decision, is that it is now clear that internet service providers have no obligation to remove online content in Hong Kong purely based on the ground of RTBF, except where the data is inaccurate, or is kept longer than necessary for the purposes for which it was collected.  

The decision provides clarity on whether foreign entities which operate online, but with no presence in Hong Kong, are bound to comply with the PDPO. It also provides clarity for search engines and online content or service providers as to the basis upon which contents may need to be removed when requested by data subjects. Of course, such businesses and entities will still need to comply with the laws of the jurisdictions in which they operate which, in many cases, may be even more stringent than Hong Kong data privacy laws. As such, in practice, a foreign business may often still consider complying with Hong Kong laws, which would serve to build confidence and assurance among the Hong Kong public.