To know or not to know? The right to access directors' personal data under the new Companies Ordinance in Hong Kong

The new Companies Ordinance in Hong Kong was enacted on 10 August 2012 and will come into operation in early 2014 (“new CO”). On 28 March 2013, the Government put on hold the commencement of the relevant provisions under the new CO restricting public access to company directors' personal information on the Companies Register. In response, the Privacy Commissioner for Personal Data has called for a new timetable for implementing the relevant provisions.  Michelle Chan and Tommy Tong provide details.

Background

Under the existing Companies Ordinance, company directors are required to submit their personal information when filing company documents (eg, annual returns) to the Companies Registry. Such documents contain the name, residential addresses and full identification number (of identity cards or passports) of the relevant persons, which are available for public inspection upon paying a search fee. 

The new CO introduces an arrangement that restricts disclosure of personal information of the company directors – only correspondence addresses and partial identification numbers will be made available to public access (the “new arrangement”). Specifically, the full personal information of directors will only be accessible upon a court order or by a permitted class of persons which may include the data subject, member of a company or public body (the “specified persons”).

Current status of the new regime

In order to fully implement the new arrangement, a subsidiary legislation, the Companies (Residential Addresses and Identification Numbers) Regulation (the “Regulation”), needs to be enacted accordingly (which sets out the specified persons who may have access to full personal information). Nonetheless, the Government announced on 28 March 2013 that the Regulation will not be introduced and the relevant provisions relating to the new arrangement will also be put on hold (NB. except for a new filing requirement for company secretaries' address, ie, company secretaries will only be required to file correspondence address upon the commencement of the new CO).

In other words, residential addresses and full identification number of company directors will now remain publicly accessible upon the commencement of the new CO in early 2014. 

The views of the Privacy Commissioner for Personal Data (the “Commissioner”)

In response to the decision, the Commissioner has urged the Government to set down a timetable for enacting the Regulation in order to implement the new arrangement. Amongst others, the Commissioner has noted that the existing access to the public register may be subject to misuse and wrongful access, and the current system should address privacy concerns and provide for better safeguards of directors' personal data.

What's next?

In view of the Government's decision, more time is needed to formulate proposals to address public concerns such as potential limitation to investigative activities by the press and to provide for greater consensus in issues such as expanding the scope of specified persons and providing additional safeguard against possible data abuse.

It is clear that the task of bringing the new CO into operation as scheduled (first quarter of 2014) takes priority. Whilst complex issues relating to the Regulation and the new arrangement will need to be tackled, these will be revisited by the Government after the new CO has commenced.