Hong Kong Privacy Commissioner for Personal Data Updated the Leaflet on Legal Assistance for Civil Claims under the Personal Data (Privacy) Ordinance

The Office of the Privacy Commissioner for Personal Data (“PCPD”) released an updated version of the Information Leaflet on Legal Assistance for Civil Claims under the Personal Data (Privacy) Ordinance (“PDPO”) (the “2025 Updated Leaflet”) on 17 April 2025. This leaflet was first published in January 2013 (the “2013 Leaflet”), and provides information on how an aggrieved individual may obtain assistance from PCPD to bring a civil claim for compensation under section 66 of the PDPO. It also explains the conditions and procedures relating to the provision of such assistance, thus offering clarity both to potential claimants and to organisations that process personal data. Compared with the 2013 Leaflet, the 2025 Updated Leaflet places greater emphasis on alternative dispute resolution, and provides further clarifications regarding the procedures for applying for legal assistance, the circumstances under which assistance may be discontinued, and the review process of the Commissioner’s decisions.

We summarise the key features of the scheme and discuss the implications and practical takeaways for organisations processing personal data in Hong Kong.

Background

Section 66 of PDPO provides that any individual who suffers “damage” – expressly including injury to feelings – because a data user has contravened a requirement under the PDPO, is entitled to claim compensation from that data user. Under section 66B of PDPO, the Privacy Commissioner may grant assistance to the aggrieved individual who intends to institute proceedings for such claims "if she thinks fit" – in particular, if the case raises a question of principle or it would be unreasonable to expect the applicant to deal with the case unaided. The assistance that the Commissioner can provide includes giving advice, or the engagement of solicitors or counsel for advice and representation.

Before applying for legal assistance, in most cases an aggrieved individual will first have to lodge a complaint with the Commissioner and obtain a decision by the Commissioner (or her delegates). The PCPD encourages parties to first try to resolve the dispute through conciliation. If the Commissioner finds that there is sufficient evidence to substantiate the complaint, she will facilitate the conciliation to assist the parties in reaching a mutually acceptable settlement. If the conciliation is not successful, the Commissioner may carry out a formal investigation of the case. After the complaint is concluded, the complainant may consider claiming compensation from the data user and may apply for legal assistance from the Commissioner.

Application Process and Considerations for Granting Legal Assistance

A complainant who intends to apply for legal assistance from the PCPD should file the prescribed “Application Form for Legal Assistance”, supplying full particulars of the claim, and providing details of damages that the complainant has suffered and compensation that he or she wishes to seek. The PCPD suggests that in most cases a complainant will be informed of the result of the application within 3 months of submission of all relevant information.

The PCPD must consider the following two factors when deciding whether to approve an application for legal assistance:

1. Whether the case raises a “question of principle” (e.g. legal uncertainty, grave privacy implications or the potential to establish a useful precedent for privacy law); and
2. Whether it would be unreasonable to expect the applicant to litigate unaided, bearing in mind complexity and the relative positions of the parties.

In addition, the 2025 Updated Leaflet further suggests that the Privacy Commissioner may weigh other relevant factors, including: merits of the claim, the prospect of obtaining an efficacious remedy, the applicant’s attitude and conduct during the complaint handling process, availability of other assistance (e.g. Legal Aid), potential to enhance public awareness, consistency with past decisions, any parallel and ongoing criminal or regulatory investigations, and the PCPD’s budgetary resources. The 2025 Updated Leaflet expressly states that applications for legal assistance may be refused or suspended where criminal investigations are ongoing, signalling the Commissioner’s intention to avoid prejudicing parallel enforcement action.

Scope of Legal Assistance

Where assistance is granted, the applicant must sign bespoke terms and conditions. The support on offer can encompass:

1. Legal advice on merits of the claim;
2. Preliminary or incidental steps for the legal proceedings (e.g. letters before action, preservation of evidence);
3. Steps to negotiate or give effect to a compromise (including mediation); and
4. Representation in court.

Assistance may be provided either by in-house legal staff or external counsel engaged by the PCPD on behalf of the applicant.

A significant development in the 2025 Updated Leaflet is the enhanced emphasis on alternative dispute resolution (ADR) mechanisms, particularly mediation, before resorting to litigation. The 2025 Updated Leaflet provides details on the mediation process, and highlights the benefits of mediation namely, efficiency, confidentiality, and flexibility.

Discontinuance and Review of Assistance

The Privacy Commissioner retains absolute discretion to withdraw assistance at any stage if, among other things, there is no reasonable prospect of success (such as due to lack of evidence), material changes in circumstances (e.g. the respondent cannot be located or goes into liquidation), the applicant knowingly provides false information or omits to disclose material information, fails to follow terms and conditions of the legal assistance, fails to comply with requests from the Commissioner or external lawyers, or fails to act in accordance with the professional advice or displays unreasonable or abusive behaviour.

An applicant may seek a review of the PCPD decision to refuse to grant or discontinue legal assistance if the applicant can demonstrate a “material change of circumstances”. The 2025 Updated Leaflet clarifies that the Privacy Commissioner’s post-review decision is final.

Legal Fees and Costs

Subject to the agreed terms and conditions, the PCPD will bear the assisted person’s legal fees and associated litigation expenses. However, if the court orders the assisted person to pay the defendant’s costs and that order is attributable to the plaintiff’s unreasonable conduct, in general the PCPD will not pay such costs. The 2025 Updated Leaflet clarifies that where the plaintiff succeeds in its claim and is able to recover costs, the Privacy Commissioner has a first charge over those costs so as to reimburse PCPD's legal costs and expenses (subject to the first charge in favour of the Director of Legal Aid (if legal aid has been granted)) but the first charge does not encroach upon any compensation obtained by the assisted person.

Takeaways

The Leaflet provides information on the PCPD’s approach to supporting privacy-related litigation, highlighting the commitment to ensuring access to justice for individuals whose data privacy rights have been breached. The scheme offers a practical and accessible means of redress for aggrieved individuals, particularly in cases that raise significant public-interest issues or where disparities in power or resources would otherwise discourage litigation.

Organisations processing personal data in Hong Kong should note the availability of legal assistance and funding for aggrieved data subjects which could potentially increase their exposure to litigation in the event of a breach. Robust compliance programmes, well-coordinated incident response and sincere engagement in conciliation therefore remain essential. Early engagement with the PCPD, a willingness to mediate and full observance of data protection obligations remain the best defence against any potential privacy litigation.

The authors would like to thank Roslie Liu, Intellectual Property Officer at Mayer Brown Hong Kong LLP, for her assistance with this article.