- issue notices in writing (“Investigation Notices”) requiring any person who the Commissioner reasonably suspects to have possession or control of materials relevant to the investigations or may otherwise be able to assist with the investigation to:
- answer questions in person or in writing, to make a statement or to give assistance that the Commissioner reasonably requires;
- provide any matter relevant to the investigation that is within the person’s possession or control;
- enter and search premises with a warrant;
- access and search electronic devices with or without a warrant (in certain circumstances);
- stop, search and arrest persons;
- serve cessation notices (“Cessation Notices”) upon any Hong Kong person or non-Hong Kong service providers who the Commissioner has reasonable grounds to believe are able to take a cessation action;
- apply to the Court of First Instance for injunctions in relation to conduct that constitutes an offence;
- prosecute certain offences in the Commissioner’s name.
Such powers are supported by offence provisions which make it an offence (punishable by fine and imprisonment) not to comply with Investigation Notices and Cessation Notices without reasonable excuse or to obstruct, hinder or resist the Commissioner or authorized persons in the exercise of their powers of investigation without lawful excuse.
Potential implications for ECS Providers
1. Obligation to assist in decryption and search for materials stored in electronic devices
Currently drafted, the power to search and access materials stored on electronic devices includes the power to request decryption and searching for such materials. Accordingly, it is possible that ECS providers such as electronic platforms and hosting service providers may be required to assist in decrypting and/or to searching for materials stored in such devices. It would be an offence to obstruct, hinder or resist the Commissioner or authorized persons in the exercise of their powers without lawful excuse.
2. Obligation to take action to cease or restrict doxxing[1]
Further, a new privacy enforcement regime of Cessation Notices having extra-territorial effect will also be introduced. Notably:
- Cessation Notices can be issued against any messages of a data subject as long as the data subject is a Hong Kong resident or is present in Hong Kong, irrespective of whether the message exists in Hong Kong or abroad; and
- Cessation Notices can be served upon any Hong Kong person or non-Hong Kong service providers if the Commissioner has reasonable ground to believe that the person or service provider can take a cessation action (whether or not in Hong Kong) in relation to the message. Note that a non-Hong Kong service provider is defined as a person (not being a Hong Kong person) that has provided or is providing any service (whether or not in Hong Kong) to any Hong Kong person.
Accordingly, Cessation Notices can be issued against ECS providers (regardless of whether they are based in Hong Kong or abroad), including electronic platforms, hosting service providers and internet services providers, to take action to remove, cease, restrict access of any relevant message and/or discontinue the hosting service for the whole or part of the relevant platform where the relevant message is published. It would be an offence to contravene Cessation Notices without reasonable excuse, having regard to the nature, difficulty or complexity of the Cessation Notices in question, the reasonable availability of the technology necessary for compliance, the risk of incurring substantial loss or substantially prejudicing third party rights or the risk of incurring civil liability.