Surveillance, privacy and the tough choice between the privacy rights and the right to know
By Nancy Mak, Grace Liyang
Joshua Wong Chi-fung was just a 15-year-old student when he led the student group Scholarism in the campaign against compulsory national education in Hong Kong’s schools in 2012. But he already suspected his phone calls were being intercepted. “I heard strong echoes in my phone, I thought it could be wiretapping” says Wong. “I could hear my own voice and there was a lot hissing noise.”
It was not just Wong’s phone. Scholarism was disbanded last year but while it was still operating, there were constant concerns about hacking and internet theft. One documented incident took place in 2015, when the group noticed documents had been downloaded from its Google account. Scholarism confirmed that an unknown account from Nanjing called “Eastern hunting hawk” had broken into the account and downloaded personal data relating to Scholarism’s members and volunteers over the years.
Wong suspects there may have been other thefts too. “That is why during the Umbrella Movement, all the members of Scholarism, ranging from the most well-known to the least-known, were all on a blacklist and couldn’t enter the Mainland. We think that the blacklist came from the stolen Scholarism membership list,” says Wong, who is now the secretary general of the political party Demosisto.
At the time of the hack, experts suggested it may have been state-sponsored given the political sensitivity of the group. But even within Hong Kong, Wong believes there are insufficient safeguards to protect citizens’ privacy, particularly from law enforcement agencies.
For instance, police can carry out a house search without a court warrant if they have reason to suspect a person to be arrested is inside the premises. People arrested for political actions may also have their personal communication devices seized. After Wong was arrested at Civic Square on September 26, 2014, his phone and computer were taken away and only returned after half a year.
“During this half year, no one knows what they did with my computer and phone. As to whether they could get into my devices, I think it’s not hard to hack into a computer.”
Wong’s examples show how citizens can have their privacy compromised and their communications intercepted. In a bid to protect the personal privacy of Hong Kong citizens, the government has enacted several ordinances, including the Personal Data (Privacy) Ordinance in 1995 and the Interception of Communications and Surveillance Ordinance (ICSO) in 2006.
The objective of the Privacy Ordinance is to protect the privacy rights of a person in relation to personal data. According to the ordinance, every Hong Kong citizen should follow six data protecting principles when handling personal data. For instance, the collection of data should be done in a lawful and fair way and the people involved should be notified about the purpose of the data collection; personal data should only be used for the data collection purpose; and data users must be open to the public about what types of personal data they hold and how the data is used.
In certain circumstances, such as for the protection of Hong Kong security and in the prevention and detection of crimes, exemptions are allowed. The Office of the Privacy Commissioner for Personal Data (PCPD) is an independent statutory body which oversees the enforcement of the Privacy Ordinance.
