@eLaw.com.hk 葉謝鄧律師行

What is Copyright?

Copyright gives the authors of a wide range of material, such as literature, art, music, sound recordings, films and broadcasts.

The economic rights give the authors to control or use of their material in a number of ways, such as by making copies, issuing copies to the public, performing in public, broadcasting and use on-line. These rights are exclusive. Copyright work is usually the result of creative skill and/or significant labour and/or investment. If there is no protection, it would often be very easy for others to exploit work without paying the creator.

It also gives moral rights to be identified as the author of certain kinds of material, and to object to distortion or mutilation of it. Moral rights are some times called non-economic rights.

Basic Framework on Copyright

Internet allows fast and easy access to numerous online resources. Those resources are very often free to browse and print (but seldom for copying for sale). But it must be aware that despite its openness and ease of use, content posted on the Internet are protected by copyrights, subject to the satisfaction of certain requisite elements such as originality, being a copyright work under the relevant legislation (Copyright Ordinance 版權條例), being an expression (not an idea).

There are debates surrounding the use of the Internet as a place for upload and download of digitized pictures, musical works and game programs. The MP3.COM, Napster and Gnuttella are great examples on this area of debate.

Another interesting area is the use of linking on web-pages. There are several distinctive forms of linking: hyperlinking, deep-linking and framing. Hyperlinking is a form causing the least controversy. Deep-linking and framing can often lead to litigations.

Other aspects of laws are very information in view of the rising importance and value of intellectual capital. That includes confidential information, trade secrets, copyrights etc which all can find protection under the laws.

PCO’S Mission Statement

The PCO’S Mission Statement is to secure the protection of privacy of the individual with respect to personal data through promotion, monitoring and supervision of compliance with the Personal Data (Privacy) Ordinance.

The PCO's key goals are to ensure that:

· individuals are aware of their rights as data subjects under the Ordinance and how to exercise them;

· public and private sector organizations are aware of their obligations as data users under the Ordinance and how to meet them;

· individuals and public/private sector organizations are aware of the role of the PCO and how we can assist them;

· enquiries are responded to courteously and efficiently to the satisfaction of the enquirer;

· complaints are investigated and resolved efficiently in a manner that is fair to all parties concerned;

· all other jurisdictions with data protection laws are aware of the robustness of our law protecting the privacy of the individual with respect to personal data so as to obviate any interference in the free flow of personal data to Hong Kong.

A checklist for Internet users to protect user's online privacy

The American organization, the Electronic Frontier Foundation (www.eff.org) is a strong advocate of online privacy. It suggests the following twelve measures for Internet users to protect their privacy.

1 Do not reveal your personal information inadvertently

2 Turn on cookie notices in your Web browser, and/or use cookie management software or infomediaries.

3 Keep a "clean" e-mail address.

4 Don't reveal personal details to strangers or just-met "friends".

5 Realize you may be monitored at work, avoid sending highly personal e-mail to mailing lists, and keep sensitive files on your home computer.

6 Beware of sites that offer some sort of reward or prize in exchange for your contact or other information.

7 Do not reply to spammers, for any reason.

8 Be conscious of Web security.

9 Be conscious of home computer security.

10 Examine privacy policies and seals.

11 Remember that YOU decide what information about yourself to reveal, when, why, and to whom.

12 Use encryption!

Some practical tips on protecting data privacy online

First, we give a checklist that website operators can follow to ensure that they comply with the Ordinance's 6 principles. Then, we give individual Internet some general tips for protecting their own online privacy.
A privacy assessment checklist for website operators

This checklist of questions can be used by website operators to help them comply with the privacy protection requirements of the Ordinance:

1. How does my website use a visitor's personal information? Is it only for the reasons stated to the visitor?

2. Is the visitor notified about the purposes for collecting the information when it is collected?

3. Can a visitor opt in or opt out of a marketing database or emailing list?

4. Is the information collected and stored in our personal data's database accurate and up-to-date? This is particularly important for credit information data and medical data.

5. Can visitors get access to, change or remove any personal data that is collected and stored online?

6. Have I formulated a privacy policy for the website and if so, is it posted conspicuously on the website for visitors’ access?

7. Have I considered engaging a third party to carry out an independent audit of the privacy protection on my website?

Anti-spamming measures

Informal responses to spamming such as social pressure and industry self-regulation (through cooperation between the Privacy Commissioner, PCCW-HKT and the Hong Kong ISP Association) have been almost entirely ineffectual in battling spam. Technical responses have fared somewhat better, but often at a high cost. Efforts to filter or block spam, for example, frequently prevent legitimate messages from getting through. Other technical responses have done little to stem the tide of spam, and in some instances have led to expensive legal disputes.

Litigation is also not an effective means for solving the problem. Although a number of countries (such as Australia) have enacted specific laws in an attempt to regulate spam, Hong Kong does not have any specific anti-spam legislation. (Some amendments to the Telecommunications Ordinance in 2000 tried to address the issue by introducing the concept of a 'class licence' into the licensing scheme of telecommunications services.) Therefore, Hong Kong's most detailed guidelines on spam prevention are found in a Code of Practice issued by the Hong Kong ISP Association (HKISPA) in 2000. The HKISPA asks its ISP members, to include terms in their Internet access agreement that require the subscriber to not engage in sending spam messages. It also imposes sanctions on those subscribers that act in breach of this condition. Such sanctions include suspension and/or closure of the subscriber's account. However, it must be noted that this Code of Practice is not a law.

The PCO has also issued a statement on anti-spam initiatives. The PCO is also working with ISPs in Hong Kong to tackle spamming. ISPs which conform to their industry Code of Practice will be authorised to use a special identification logo that promotes them as supporters of anti-spamming. The details of the HKISPA code of practice, and some useful tips for minimizing the nuisance of receiving spam can be found at the following link: www.ofta.gov.hk/junk-email/main.html

Be cautious when posting data on websites

Website operators are often tempted to post lots of information on their website because it does not cost them much and because they believe that an informative website may attract more visitors. However, Principle 3 of the Ordinance states that any information collected by a data user can only be used for the purposes defined at the time of collection and any other uses of collected data must have the ‘consent’ of the data subject who gave the information.

Imagine that a sports association is hosting a squash competition and asks all the competitors to register for the competition online. After the sports association has received all the competitors’ details, it wants to post the draw for the competition (i.e. tell all the competitors how many games will be played in different age groups or ability groups).

The data collected from each competitor is as follows:

1. Name
2. Age
3. Sex
4. Player level (including information about championships that players have won).
5. Name of indoor sports club or district players are representing.

To comply with Ordinance, the squash association needs to tell all competitors why it is collecting this personal data and it must not use this information for any other reasons, unless it gets the consent of all competitors. So on its website, the sports association tells competitors that its purpose collecting the information is to tell everyone information about the competition's categories. If the association simply uses the information to publicize the different categories of the competition it is complying with the Ordinance.

However, if the competition attracts some famous players and the sports association decides that it can promote the event by publishing biographies of these players, it may be in breach of the Ordinance if it does not get consent from these players to use their personal information to promote the event.

Encourage anonymous browsing of web sites

Surfing anonymously over the Internet is the safest way to protect your privacy and ensure no release of personal information or data. A person should be able to browse the Internet in the same way that someone can window shop in a shopping arcade without revealing his/her identity, even if he or she makes a purchase.

Therefore, a website should encourage anonymous browsing, or at least give visitors an informed choice about whether or not they need to disclose their identity.

Observe direct marketing guidelines

The Privacy Commissioner has published a guideline document, "Personal Data Privacy and the Internet - A Guide for Data Users" to assist organizations comply with some of the more common applicable requirements of the Ordinance when they are collecting, displaying or transmitting personal data over the Internet. The guide has a section on "Direct marketing activities on the Internet" which emphasizes that organizations need to:

1 state that they are collecting information for the purposed of direct marketing, at the time of collection;

2 provide an opt-out choice to the individual;

3 maintain an opt-out list; and

4 set a policy on unsolicited advertising e-mails (spamming).

Businesses in Hong Kong who want to make use of direct marketing for the sale or promotion of their goods or services must comply with S.34 of the Ordinance.

Opt-out provisions

S.34 of the Ordinance basically requires organizations to provide an opt-out clause when they are direct marketing to an individual for the first time. This clause lets the data subject opt out of any marketing that is sent to him/her. Also, if at any stage in the marketing, the data subject indicates that he no longer wishes to receive any further marketing materials from the merchant, the merchant must cease sending marketing materials.

The legal enforcement of opt out provisions is difficult if not impossible with respect to direct marketing materials sent by organizations based overseas that are targeting Hong Kong residents. It would therefore be desirable, for the reasons of cost-effectiveness of direct marketing campaigns, consumer satisfaction and privacy protection, for the industrial associations representing the direct marketing industry in Asian countries to harmonize their individual codes of practice to provide an opt-out message, and maintain and respect opt-out lists within the whole Asian region.