Hong Kong Court Warns an Application Based on Data Obtained Through ‘Backdoors’ is An Affront to the Court

In the recent judgement in Leung Hong Wah Andy v Shum Wang Chiu also known as Louis Shum and Another [2021] HKCU 1599, the decision handed down by His Honour Deputy Judge MK Liu has made it clear that a party who obtains documents on discovery gives an implied undertaking to the Court that he would make use of them only for the purpose of that action and no other purpose. Where release from the undertaking is sought after by a party, it is for the individual who obtained the documents to demonstrate rational and persuasive reasons why it should be released.


The background facts of this case concern an application to seek leave to amend the statement of claim (the “SoC”) of the Plaintiff regarding defamation. The Plaintiff was a former branch manager of the 2nd defendant, The Prudential Assurance Company Limited (“D2”). His wife, Ms. Avril Wong (the “Wife”), was also a former insurance agent of D2. Their agency agreements were terminated in April 2006. In 2008, the Wife made discrimination claims against the 1st defendant (“D1”) and D2 (collectively (the “Defendants”)) arising from her termination (“the DCEO Proceedings”). The DCEO Proceedings were settled before trial in April 2013. The Plaintiff was not a party to the DCEO Proceedings. In the DCEO Proceedings, 11 e-mails published in a work setting between March 2006 to July 2006 (“the 11 Emails”) were disclosed to the Wife by the Defendants.

The current proceedings were commenced by the Plaintiff in February 2012. In the SoC, the case pleaded against the Defendants was a defamation case entirely based upon the 11 Emails. The Plaintiff was only able to obtain the 11 Emails, which were not sent or copied to him, through the Wife or the Wife’s solicitors.

In October 2018, the Plaintiff sought an order to be released from the implied undertaking not to use the documents disclosed by the Defendants in the DCEO Proceedings. This was subsequently dismissed.

The Personal Data Requests (“the PDRs”)

Over the years, the Plaintiff made 3 PDRs pursuant to section 18(1) of the Personal Data (Privacy) Ordinance, Cap. 486 (“PDPO”) to D2:

  1. The First Personal Data Request (the “First Request”)
  1. In May 2007, the Plaintiff made the First Request to D2. In July 2007, the Plaintiff was provided, with copies of 11 E-mails, with names other than the Plaintiff redacted.
  1. The Second Personal Data Request (the “Second Request”)

In September 2012, the Plaintiff made a Second Request to D2. This request was made after the commencement of these proceedings, and after disclosure of the 11 Emails in the DCEO Proceedings. Among other things, the Plaintiff asked for 4 E-mails (with reference to specific dates and times) in this request.

  1. The Third Personal Data Request (the “Third Request”)
  1. 7 years later, in September 2019 (after the dismissal of the Release Summons and after lodging the appeal against that decision), the Plaintiff made a Third Request to D2.
  1. After the payment of fees, this request was complied with in November 2019, and 9 emails (the “9 Emails”) were provided to the Plaintiff, with the senders and recipients of the e-mails, and some content, redacted.


The decision is made pursuant to an appeal against the decision of the Master on 15th December 2020, whereby the Master dismissed the Plaintiffs application for leave to amend his SoC. The fundamental issue in the appeal was whether the Plaintiff should be allowed to rely upon the 9 Emails to plead a defamation case against the Defendants.


Principles of Discovery in Legal Proceedings

His Honour Deputy Judge MK Liu stated that a party who obtains documents on discovery gives an implied undertaking to the Court that he would make use of them only for the purpose of that action and no other purpose. Based on the current facts, there was a clear breach of the implied undertaking to use a document obtained on discovery in one action as the foundation for a claim is in a different and wholly unrelated proceeding. This extends to information derived from the document as well. The Court further emphasized that the implied undertaking is not only binding upon the party to whom the documents have been disclosed, but also extends to his solicitor and to anyone whose hands the document may fall to.

The Court cited the case of Riddick v Thames Board Mills [1977] 3 All ER 677, where the plaintiff commenced a new action against the defendant claiming damages for defamation based on a memorandum discovered in a previous action. Lord Denning MR stated that “the public interest in privacy and confidence demands that this compulsion should not be pressed further than the course of justice requires. The courts should, therefore, not allow the other party—or anyone else—to use the documents for any ulterior or alien purpose. Otherwise, the courts themselves would be doing injustice.”. For the 11 Emails to be used in the current proceedings after it was obtained in the previous proceedings would be contrary to this principle.

The Court also takes note that the Plaintiff was trying to make use of the information contained in the 11 Emails for the purpose of these proceedings through a ‘backdoor’, which would be regarded as a flagrant breach of the implied undertaking. His Honour Deputy Judge MK Liu agreed with the Defendants that the Application was an ‘insult to the Court’ and makes a ‘mockery’ of the serious obligations attaching to an implied undertaking. All the proposed amendments based upon the 9 Emails in the Application were refused.


As set out in Chan Shu Chun, the Court has reiterated that the purpose of the PDPO is to enable a data subject to examine the correctness of personal data, and not to locate information for other unrelated purposes such as litigation. The same can be interpreted from this case, where the Plaintiff attempted to use a document obtained from previous proceedings in the current one. The legislative intent of the PDPO had nothing to do with the operation of discovery in legal proceedings and it was not intended to produce any collateral effect on the settled law and already broad scope of discovery. Although the context of Chan Shu Chun and this case was inherently different, the same principles as to discovery in legal proceedings and the right to access data under PDPO should be adopted uniformly.


Parties are reminded that if they obtain documents or emails upon discovery, there is an implied undertaking to the Court that they would only use them for the purpose of that action and no other purpose. Reaffirming the principles set out in Chan Shu Chun and highlighted in our first article, it is prudent for parties to set out specific particulars for discovery and to use documents obtained only for and from the specific proceedings concerned, avoiding the adoption of an ‘opportunistic’ approach to discovery in legal proceedings. It must be reiterated that such approach would be gravely considered by the Court and would not be entertained.

To know more about discovery and personal data, you can also refer to our previous article "Specific Discovery and the Relevance of Personal Data".


Partner, Hugill & Ip

Carmen has been practicing law in Hong Kong for over 15 years, during which she has worked in both the private and public sectors, including the government and the Law Society.

Qualifying in Hong Kong in 2004 and England and Wales in 2007, she started her legal career working as a commercial litigator where she advised and acted in a wide range of disputes, including those relating to the financial services sector.

Carmen’s skills as a litigator led to a call from the Privacy Commissioner for Personal Data and, in 2010, she was appointed Legal Counsel with responsibility for providing legal advice on personal data protection issues arising from complaints or compliance checks. She also advised government organisations on data privacy issues, vetted proposed legislations, and handled appeal cases on the Privacy Commissioner’s behalf.

She expanded her legal expertise further in 2012 when she became Investigation Counsel for the Law Society of Hong Kong, leading probes into alleged professional misconduct cases for the Compliance Department. The role also included leading inspection and intervention exercises and assisting prosecutors in running disciplinary proceedings.

After five years as regulatory counsel, in 2017 Carmen returned to private practice as a Senior Associate – then Partner – in both Dispute Resolution and Data Privacy.

Carmen has recently advised and acted on various litigation and probate matters, including shareholders’ disputes, inheritance and dependants claims – including contentious probate actions, revocation of grants of representations and succession entitlement under interest.  She also regularly advises organisations on all aspects of data protection compliance, and provides opinions on legal malpractice and professional ethics issues.

Carmen is a CEDR accredited Mediator and a member of the International Association of Privacy Professionals (IAPP). She has recently been credited as Certified Information Privacy Professional / Asia (CIPP/A) and Certified Information Privacy Professional / Europe (CIPP/E). On 5 October 2020 she has been appointed as a Practising Solicitor Member of the Solicitors Disciplinary Tribunal Panel.

She has received the pro-bono award from The Hong Kong Law Society for her service to the community.

Carmen is fluent in English, Cantonese and Mandarin.