First published: 28th February 2008
Allan Dyer
A hot topic in the news recently has been the circulation of erotic pictures, apparently of Hong Kong celebrities Edison Chen Koon Hei, Gillian Chung, Bobo Chan, and Cecilia Cheung. Arrests have been made and Assistant Commissioner (Crime) Vincent Wong Fook-chuen has said "We are quite confident to say that the source [of the photos] is confirmed. Someone had sent his computer for repair and the pictures [stored inside] were stolen without the consent of the owner." Apparently, the prosecution will focus on whether the data was stolen, and whether obscene articles were distributed.
Press comment has pointed out that distributing obscene material in Hong Kong is a serious crime, although possession of such material for personal use is not. Assistant Commissioner Wong was asked why the police have not acted against other obscene photos circulating on the internet, he gave the rather unconvincing response, "In my 20-plus years as a policeman, I have not come across such an issue". Is he unaware that there is obscene material on the internet? The police are now open to the accusation that this case has been investigated because it involves celebrities, while other cases, such as former lovers posting intimate photos as revenge, have previously been ignored.
The law on these matters is outdated, how can we draft new laws that protect the vulnerable without flying in the face of the realities of an interconnected world?
Obscenity cannot be defined precisely, and reference is usually made to "community standards". When we judge community standards in Hong Kong, shouldn't we also consider the material being accessed by Hong Kong people through the internet from other sources? I suspect that an investigation of web access logs would reveal that many people in Hong Kong are accessing material the Obscene Articles Tribunal would classify as obscene. Doesn't that mean that the Tribunal is failing to keep up with changing community standards? Why should it be considered a crime if consenting adults indulging in legal activities choose to have images of those activities recorded, and choose to have those images distributed to other consenting adults?
So the offence in this case is not one of obscenity, but of invasion of privacy. Fortunately, Hong Kong does have a Personal Data Privacy Ordinance. Data Protection Principle 3 seems directly applicable:
Principle 3 - Use of personal data This provides that unless the data subject gives consent otherwise personal data should be used for the purposes for which they were collected or a directly related purpose.
Distributing private photos without consent clearly violates this principle. You could also consider that the owner of the computer sent for repair had violated Principle 4:
Principle 4 - Security of personal data This requires appropriate security measures to be applied to personal data.
It seems entirely reasonable to hold someone who chooses to keep intimate photos responsible for their safety. Other principles can be usefully applied to different "sex photo" cases:
Principle 1 - Purpose and manner of collection This provides for the lawful and fair collection of personal data and sets out the information a data user must give to a data subject when collecting personal data from that subject.
No secret filming! What about photos kept by former lovers?
Principle 2 - Accuracy and duration of retention This provides that personal data should be accurate, up-to-date and kept no longer than necessary.
If the original purpose was enjoyment by lovers, then the purpose ended when the relationship ended, and the photos should be destroyed.
Unfortunately, there are currently two problems with applying the Personal Data Privacy Ordinance. Firstly, the Ordinance is largely toothless: the Privacy Commissioner can merely issue an Enforcement Notice, and only non-compliance will result in a penalty - but the damage is done when the data is first released. Secondly, the Ordinance includes a broad exemption for "personal data held for domestic or recreational purposes".
Updated: 13th February 2008
The controversy over this incident is continuing, with many commentators seeking a high moral stance. The Catholic Church's Diocesan social communications office director Dominic Yung Yuk-yu has advocates that schools should use the case to promote ethics based on religion, saying, "Every student has already seen those photographs. There is no reason not to talk about them." Every student? How does he know? Are there really no parents in Hong Kong who have installed a web filter and who check their children's internet use?
In a letter to the South China Morning Post, Peggy Leung Pui-ki write, "The police commissioner, Tang King-shing, has claimed that the police are patrolling the internet more frequently, which is very much appreciated." Well, to any Bobbies patrolling this area, "G'evening Officer, cold night." I guess we can soon expect the Courts to be flooded with thousands more cases of "publishing obscene material", because, although certain Police Commissioners may not have noticed, there are a lot of images of a similar nature on the internet.
Peter Gordon has written interesting commentary on the issue in The Standard.
Updated: 16th February 2008
Writing in the UK newspaper The Guardian, Cory Doctorow likens personal data to nuclear waste:
We should treat personal electronic data with the same care and respect as weapons-grade plutonium - it is dangerous, long-lasting and once it has leaked there's no getting it back.
He is writing about the negligent disclosure of 25 million personal records by HM Revenue and Customs, and other UK incidents, but the lesson can be applied equally to amateur photographers. Well-known security commentator, Bruce Schneier wrote something similar in 2006, but Doctorow has the better soundbite.
Updated: 19th February 2008
In the original article above, I said that other similar cases, "such as former lovers posting intimate photos as revenge" had been ignored. It turns out that there is at least one such case where existing laws, namely criminal intimidation, publishing an indecent article without required notice and publishing an obscene article; were used in the prosecution. The defendant was sentenced to 240 hours of community service last September, but the prosecutor is now seeking a jail sentence. The initial sentence does appear far too lenient considering the distress and harm to the woman. It is clear from the complaints received by the Broadcasting Authority against Gillian Chung Yan-tung's appearance at a charity concert that there are Puritans who will ostracise and discriminate against the victims in such cases, because the victims have failed to meet their oppressive moral standards. The "moral outrage" could end Gillian's career, and, on a smaller but no less relevant scale, affect the employment prospects and social life of the woman in this revenge case.
Updated: 20th February 2008
Today's (Feb 20, 2008) Leader in the South China Morning Post takes the view, "the most important matter is being missed: privacy". Nice to see someone else promoting the view that I've taken here.
Updated: 27th February 2008
The Privacy Commissioner for Personal Data, Roderick Woo Bun, is pushing for reform of the Personal Data (Privacy) Ordinance, using the nude photos case as an example. Peter Gordon, writing in The Standard, accuses the Commissioner of mission creep and ridicules the idea that the identifiability of the celebrities in these photos makes them "Personal Data", writing, "No one needed these particular photos to identify either the female subjects involved or their camera-happy beau". He also suggests that this interpretation would prevent images from sporting events being published and points out the conflict of the Commissioner's view with the normal understanding of copyright: the photographer owns the photo, not the subject. He claims, "you can't have different laws assigning ownership of the same item to different groups of people without a mess resulting".
Firstly, the identifiability of the subjects is not (always) the private data that should be protected, but it is the link which makes the difference between possibly statistical information (e.g. "some accounts at our bank contain over $10 million") and private information about a person (e.g. "Mr. X has an account with over $10 million"). With these photos, the identification of the participants changes the rather banal information, "adults have sex" into the rather personal, "Y had sex with Z". With identification, the private data can be linked to other data that is already known, "Mr. X never buys a round at the pub", "Y and Z are not married".
Secondly, copyright ownership is not the same as property ownership, and the law commonly features situations where different parties all have rights over the same "thing" - take a look at landowners and rights of way, as one example. The issue of publishing images of sporting events is easily covered as a matter of balance and expectations: as many bank robbers realise, you may be recognised if you are in a public place without a mask, the unmasked spectators at a sporting event do not have an expectation of privacy, and the photos are not published in the expectation of their being used to identify the spectators.
Mr. Gordon does raise the valid point about the data being collected on security camera tapes. We are quickly reaching a level of technology that makes George Orwell's vision in "1984" actually feasible. We need public debate about our privacy expectations before everyone is wearing a life recorder, and that includes what happens when private photos are made public, even if they merely affect, "the wholesome image of celebrities" that Mr. Gordon considers, "is not the sort of thing one imagines the Privacy Ordinance was enacted for."
