Him works in a hospital and has a boring life. He likes to download and upload pop music, movies and TV programmes to share with others on the Internet. Him never intended to share the hospital patient’s information with others, but he did it by accident.

1. Him used shareware to upload and download music and movies. What crime(s) has he committed?

   “Sharing” on the Internet is regarded by the Hong Kong court as an act of "distribution". Under Section 118(1)(e) of the Copyright Ordinance (Chapter 528), commercial distribution of copies of a copyrighted work without a licence (i.e. distribution of infringing copies) is an offence.

   Furthermore, even if the distribution is not for profit, it may still be an offence if the distribution is to an extent that it affects prejudicially the owner of the copyright. The provision in this regard is Section 118(1)(g) of the Copyright Ordinance (Chapter 528) which states: “A person commits an offence if he, without the licence of the copyright owner of a copyright work, distributes an infringing copy of the work (otherwise than for the purpose of or in the course of any trade or business which consists of dealing in infringing copies of copyright works) to such an extent as to affect prejudicially the copyright owner.”

   Sharing a copyrighted work on the Internet without a licence constitutes distribution of infringing copies to a potentially huge number of users. Even if Him makes no money out of such sharing, he is likely to have committed an offence contrary to Section 118(1)(g) of the Copyright Ordinance (Chapter 528). The maximum penalty for the offence is a fine at level 5 (currently $50,000) for each infringing copy and imprisonment for 4 years.

2. If I only downloaded intellectual property from the Internet and did not upload it for other people to download, have I still committed a crime?

   Under the existing law of Hong Kong, mere downloading without knowingly assisting the uploader is not an offence. However, it is still a civil wrong, as downloading without a licence is in effect making an infringing copy on the downloader's computer. As such, a downloader is liable to compensate the copyright owner if the copyright owner brings a civil action for copyright infringement.

3. Him did not make any money or gain any benefit by uploading the intellectual property. Has he committed a crime then?

   Even if Him does not make any money out of sharing the file (i.e. uploading), he has committed an offence under Section 118(1)(g) of the Copyright Ordinance (Chapter 528). See the answer to Question 1 above.

4. Is it an infringement of copyright to edit television programmes and put them onto the Internet?

   Despite the editing, the TV programme recorded is likely to remain an infringing copy. As such, uploading it onto the Internet is an offence under Section 118(1)(e) or 118(1)(g) of the Copyright Ordinance (Chapter 528), whether or not the uploading is for profit. See the answer to Question 1 above.

5. Do law enforcement bodies launch investigations and prosecute only when the copyright owner lodges a complaint?

   No. Any person (not necessarily a copyright owner) may report infringing activities to law enforcement bodies, who will then conduct an investigation. Whether there will be a prosecution in the particular case depends upon the strength of the evidence and whether a prosecution is in the public interest.

6. Has Him broken the law by leaking other people’s personal information onto the Internet? If he did not intend to leak the information, and it only happened by accident, has he still committed a crime?

   Under the existing laws of Hong Kong, it is not an offence if personal data is accidentally leaked to the Internet.

   However, any patient whose information was leaked could make a complaint to the Privacy Commissioner under Section 37 of the Personal Data (Privacy) Ordinance (Chapter 486). Upon receiving a complaint and having conducted an investigation, the Privacy Commissioner may serve an “enforcement notice” on the Hospital Authority. The Hospital Authority is Him’s employer. It is responsible for ensuring that adequate systems are in place to secure the privacy of patients’ information. In deciding whether or not to issue the enforcement notice, the Privacy Commissioner will consider whether or not all reasonably practicable steps had been taken by the Hospital Authority to ensure that the personal data was protected against unauthorized or accidental access, processing, erasure or other use, in compliance with Data Protection Principle 4 in Schedule 1 of the Personal Data (Privacy) Ordinance (Chapter 486). Questions may arise about whether employees should be allowed to take patients’ information home at all and, if so, whether there is adequate security for that information.

   The enforcement notice may require the Hospital Authority to review its operating procedures and to strengthen its control over the handling of personal data. Particularly, it may be required to specify clearly the circumstances under which processing of personal data outside of the office premises is allowed. It is only when the enforcement notice is not complied with that criminal liability would arise under Section 64(7) of the Personal Data (Privacy) Ordinance (Chapter 486).

7. If someone discloses my personal information on the Internet without my permission, what can I do?

   If you believe that your data privacy rights have been infringed, you may:

   1. inform your parents or teachers and seek their help;
   2. raise your concern with the party concerned (e.g. the host of the Internet forum in question);
   3. lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) in writing, or by visiting the PCPD in person. For more details, please click here.