Hong Kong Surveillance Law

In this short piece I suggest that though 9/11 did not immediately result in a dramatic expansion of the surveillance state in Hong Kong as was often seen in the west, twenty years later a similar process is now well underway. Though Hong Kong’s surveillance and privacy laws have long been relatively deferential to the needs of law enforcement, the dramatic legal changes occasioned by the introduction of a new ‘national security law’ in 2020 suggest that the population will be under increasing forms of surveillance in the coming years.

The Legal Aftermath of 9/11

Perceived to be at a relatively low risk of a terror attack itself, the initial legislative responses to 9/11 in Hong Kong were not directly concerned with public surveillance specifically, or even domestic security generally. As an international financial centre, it was clearly of importance for Hong Kong to implement Security Council Resolutions 1373 and 1390 in the immediate aftermath of 9/11. The first of these required States to prevent and suppress the financing of terrorist acts, while the second expanded pre-existing sanctions against Al-Qaida, the Taliban, and associated entities. Hong Kong had to wait for instructions from Beijing before proceeding, as both Resolutions clearly touched upon matters of state and foreign affairs – exclusively the domain of the Central People’s Government (CPG) under Art. 13 of the Basic Law, Hong Kong’s quasi-constitution. Even after approval from the CPG the process of drafting and implementing the UN (Anti-Terrorism Measures) Ordinance was uneven. Nonetheless, shortly after its introduction the Government quickly moved from this largely finance-focused legislation to the broader ‘national security’ area.

Art. 23 of the Basic Law obliges Hong Kong to introduce laws that prohibit various acts that threaten the state, such as treason, secession, subversion, and so on. In 2002, the Security Bureau published its plan to introduce such legislation, and in early 2003 the National Security (Legislative Provisions) Bill was introduced to the Legislative Council. In addition to creating a series of new criminal offences, broad powers were given to the police to execute warrantless searches to preserve evidence related to the new crimes. Fears were raised that many of the proposals might threaten civil liberties (a useful primer on the key concerns can be found here). After widespread street protests against the Bill, the Government eventually withdrew it and offered no timeline for re-introduction. This meant that the laws of Hong Kong, as related to surveillance and privacy, were not significantly restructured in the years that immediately followed 9/11.

Surveillance & Intercept Laws

In part, this was because even without the introduction of new laws under Art. 23 of the Basic Law, legislation already on the books in the early 2000s gave quite a free hand to the Government to conduct surveillance. The Telecommunications Ordinance was enacted by the colonial government in 1962 (the link shows the law as it stood in 2003), and allowed the Governor to order the interception of any message transmitted by a telecommunications system, if he believed it to be in the ‘public interest.’ The Secretary for Security declared that the ‘public interest’ in this context meant the “prevention or disruption of serious crime, or necessary in the interests of the security of Hong Kong.” This scheme was based on a provision of the UK Post Office Act that had been found by the European Court of Human to be inconsistent with the right to respect for one’s private life and correspondence in 1984. Local concerns were voiced about the broad authority the Telecommunications Ordinance gave to the Governor, particularly after the introduction of the Bill of Rights Ordinance in 1991. Though a 1996 Law Reform Commission report recommended a significant update to the law, no changes were made. With the transfer of sovereignty over Hong Kong on 1 July 1997, the Chief Executive replaced the Governor as the party with the power to order communications intercepts.

However, the coming into force of the Basic Law on that same date also resulted in the development of an expanded power of constitutional review. In 2006, the scheme created by the Telecommunications Ordinance was declared an unconstitutional restriction on the freedom of communication and privacy rights contained in the Basic Law. The Court concluded that the virtually untrammeled power given to the Chief Executive was incompatible with the principle that any restriction on those rights had to be proportional and done ‘in accordance with legal procedures.’ The Court gave the Government six months to come up with a framework; the result was the introduction of the Interception of Communications & Surveillance Ordinance (ICSO).

The ICSO

The ICSO created a system of authorization for both the interception of communications and the placing of individuals under covert surveillance that was out of the hands of the Chief Executive. Interception is defined in the law as inspecting the contents of a communication during transmission. There are two forms of covert surveillance contemplated – that engaged in circumstances under which the target would reasonably expect to be seen/heard, and that in which they would not. Interception and the latter form of surveillance both require judicial authorization, while the former can be authorized by an officer of sufficient rank. The ICSO also creates a system of external oversight in the form of mandatory annual reporting and the presence of a quasi-independent Commissioner on Interception of Communications & Surveillance. But while from the perspective of the privacy interests of Hong Kong residents this was clearly an improvement over the Telecommunications Ordinance, the ICSO is still relatively deferential to the needs of law enforcement.

Most obviously, the narrow definition of what counts as an ‘interception’ means that no authorization at all is required for the police to collect metadata about communications; metadata, of course, can reveal a tremendous amount of detail about a person. The requirement for authorization also only occurs ‘in the course of transmission’, meaning that once a digital message is delivered, attempts to access it fall outside the ambit of the law. In the era of ‘the cloud’, this has important consequences. The licence required to operate an ISP or mobile phone service in Hong Kong allows them to disclose information about their users for the prevention or detection of a crime. The former Secretary of Security evaded questions about whether this means the police do not need to follow the ICSO requirements in the context of emails or text messages.

The most recent transparency report (2018) showed that between 2011 and 2017, Government departments made an average of about 4500 requests per year to telecommunication and internet companies for user information. 88% of those requests were made by the police, which stated they did not track how many of those were accompanied by a warrant. While not strictly contemplated by the law, until 2019 the police appear (1, 2) to have been able to not only access user information but also obtain the removal of certain content online by leveraging a combination of the aforementioned procedure and accusations that users were believed to have committed the offence of “accessing a computer with dishonest intent”. This was particularly apparent during the street protests of 2014, known as “Occupy Central”.

The ICSO also does not speak to ‘public’ forms of surveillance such as the use of CCTV cameras, or the broad gathering of information, generally in a non-targeted manner. Hong Kong’s data protection law – the Personal Data (Privacy) Ordinance (PDPO) – does deal with information flows, but not in a manner that might meaningfully restrict modern forms of ‘dataveillance’ by law enforcement. Enacted in 1995 (and amended since then only to deal with direct marketing), the PDPO is a relatively conventional data protection regime that implements a version of the ‘fair information principles’. The law defines ‘personal data’ as any data relating to a living individual from which that individual may be identified, and that exists in a form that makes processing reasonably practicable. The law applies to both the public and private sectors, requires that any collection or use be for a lawful purpose, forbids the collection or re-use of personal data for a new purpose without the consent of the data subject, attempts to ensure that data collected is accurate, creates a system for individuals to gain access to data held about them, and so on. However, there are broad exemptions in the law for matters related to crime and security, meaning there is nothing stopping the police from creating dossiers on individuals based upon information they acquire.

Those engaged in political protest have seemed increasingly conscious of the potential for surveillance under this framework. In 2014, protestors began to use an ‘off-grid’ mesh messaging app that did not rely on any service provider. In the anti-extradition bill protests of 2019, protestors used Apple’s AirDrop feature to share plans in a decentralized way, and left money on top of mass transit ticket machines so people did not have to use a traceable ‘Octopus’ card. Protestors also tried to destroy ‘smart lampposts’ they believed were tracking their movements. During the Covid pandemic, some residents refused to use the Government’s “LeaveHomeSafe” contact tracing app, believing its real purpose was to track residents for non-health reasons. It is notable that there has never been any evidence provided to support the fears regarding either the lampposts or the tracing app – the opposition symbolizes a breakdown in trust between a portion of the population and the Government. The events of 2019 also led to perhaps the most significant change to Hong Kong’s legal environment since ‘handover’ – the introduction of the National Security Law (NSL).

The NSL

Relying on its overall ‘supervisory jurisdiction’ and referring to ‘acts of secession, violence, and terrorism that jeopardized national sovereignty and territorial integrity’, in 2020 the National People’s Congress inserted the NSL into Annex III of the Basic Law (national laws only apply to Hong Kong if they are added to Annex III). The NSL is wide-ranging in its scope. Not only does it create the offences of treason, subversion, sedition, and collusion with foreign entities as referred to in Art. 23 of the Basic Law, it provides for a partially separate legal process for their investigation and prosecution. There are newly created dedicated national security departments in the Police Force and the Department of Justice, and NSL cases are heard by a selected panel of judges appointed by the Chief Executive. The most serious offences can even be removed from the Hong Kong legal system entirely and shifted to the Mainland, to be heard under Mainland law before Mainland judges. In terms of law enforcement powers related to surveillance and intercept, in some ways the NSL returns Hong Kong the pre-ICSO period – in the context of detecting, preventing, or prosecuting national security offences, the Chief Executive may directly order the intercept of communications or covert surveillance of any individual if they feel it is necessary and proportional. The Commissioner for Interception and Surveillance has no oversight over these authorizations, and the authorizations are not legally reviewable.

The introduction of the NSL does not completely displace the local government’s obligations under Art. 23 of the Basic Law, and more specific laws will be introduced on the subject. A new anti-doxxing law has already been adopted and a ‘fake news’ law may be next. Depending on their specific application, both may have significant consequences for speech and the flow of information. The budget for the police force has also been dramatically increased since 2020, and the need to fight “local violent extremists” and combat “domestic terrorist activities” has been part of the justification. Hong Kong is now in a period where the understanding of ‘national security’ seems increasingly co-terminus with ‘public order’; as a consequence, it is reasonable to also expect increased surveillance of the population in various forms.

There is likely to be little judicial opposition to this. The Court of Final Appeal has already accepted that the NSL itself is not subject to constitutional review for compatibility with the Basic Law, and I suspect the Court will be deferential to new legislative provisions if they are described as related to national security matters under Art. 23 of the Basic Law. While over the last twenty years both the people and the courts have shown some willingness to resist privacy intrusions, the rapid and significant changes consequent to the introduction of the NSL suggest this is less likely in the short-term future. While 9/11 may not have immediately triggered the expansion of the surveillance state in Hong Kong in the fashion that occurred elsewhere, the arc of the law is clearly now bending in that direction.