Privacy & Data Protection
11 cases · June 2023 to March 2026
Overview
Privacy & Data Protection appears in 11 reported Hong Kong judgments (2023–2026).
Cases about personal data, privacy rights and data-protection obligations.
Privacy and data-protection cases in Hong Kong concern the collection, use, disclosure and security of personal data, and the wider protection of privacy interests. The governing statute is the Personal Data (Privacy) Ordinance, which sets out the data-protection principles, regulates direct marketing, and creates offences such as the disclosure of personal data obtained without consent, sometimes described as doxxing. Disputes may involve complaints handled by the Privacy Commissioner for Personal Data, claims for compensation by affected individuals, applications for injunctions to restrain the misuse of data, and criminal prosecutions for breaches of the Ordinance.
These matters are resolved in several courts according to their nature. Civil claims and applications, including injunctions restraining the disclosure or misuse of personal data, are commonly brought in the Court of First Instance, while some claims and prosecutions are dealt with in the District Court. Appeals proceed to the Court of Appeal and, on questions of general importance, to the Court of Final Appeal.
The reported authorities show how these principles are applied. First-instance treatment of data-protection and privacy questions appears in [2025] HKCFI 4531 and [2025] HKCFI 1426, and the Court of Final Appeal has addressed a related question in [2023] HKCFA 12. These decisions illustrate how the Personal Data (Privacy) Ordinance and the broader protection of privacy are given effect by the courts.
Court Distribution
Across 3 courts.
Key Cases
How many Privacy & Data Protection cases are reported in Hong Kong courts?
11 reported Hong Kong judgments (2023–2026) involve Privacy & Data Protection.
What law protects personal data in Hong Kong?
The principal statute is the Personal Data (Privacy) Ordinance, which sets out the data-protection principles governing how personal data may be collected, used, disclosed and secured. It also regulates direct marketing and creates offences, including the disclosure of personal data obtained without the data user's consent.
Who enforces data-protection obligations in Hong Kong?
The Privacy Commissioner for Personal Data oversees compliance with the Personal Data (Privacy) Ordinance, handles complaints and may take enforcement action. Affected individuals may also pursue civil remedies, and breaches of certain provisions can be prosecuted as criminal offences before the courts.
Which courts hear privacy and data-protection cases?
Civil claims and applications, such as injunctions to restrain the misuse or disclosure of personal data, are commonly brought in the Court of First Instance, with some matters and prosecutions in the District Court. Appeals proceed to the Court of Appeal and, on questions of general importance, to the Court of Final Appeal.