Hong Kong

Section 4 bars a data user from doing an act or engaging in a practice that contravenes a data protection principle unless the Ordinance requires or permits it. Principle 1 limits collection of personal data to a lawful purpose directly related to a function or activity of the data user, requires the collection to be necessary or directly related and not excessive, and requires lawful and fair means.

Principle 2 requires practicable steps to keep personal data accurate and not to keep it longer than necessary, and principle 3 bars using it for a new purpose without the data subject's prescribed consent. Principle 4 requires practicable steps to protect personal data against unauthorized or accidental access, processing, erasure, loss or use, and principle 5 requires practicable steps to make a data user's policies and practices, the kinds of data held and their main purposes available.

A contravention of a data protection principle is not of itself an offence under section 64A; it is enforced through the Commissioner's enforcement notices and the compensation claim in section 66. Part 8 exempts some personal data from some principles, for example personal data an individual holds only for personal, family or household affairs or for recreation (section 52). The Ordinance binds the Government.

Section 33 would bar a data user from transferring personal data to a place outside Hong Kong unless the place is specified by the Commissioner in a Gazette notice, the user believes on reasonable grounds that a substantially similar law is in force there, the data subject has consented in writing, or one of the other listed conditions applies. Section 33 is not yet in operation.

Section 18 lets an individual ask a data user whether it holds personal data of which they are the data subject and for a copy, and section 19 requires the data user to comply within 40 days after receiving the request.

Section 22 lets an individual who considers a supplied copy of their personal data inaccurate ask the data user to correct it, and section 23 requires a data user satisfied that the data is inaccurate to correct it within 40 days and to supply the corrected data to a third party it disclosed the data to in the previous 12 months. Principle 6 entitles a data subject to be given reasons for a refused access or correction request and to object to the refusal.

Section 26 requires a data user to take all practicable steps to erase personal data no longer required for the purpose for which it was used, unless erasure is prohibited by law or not erasing is in the public interest. Section 27 requires a data user to keep a log book recording its reasons for refusing requests and not to erase an entry for 4 years.

A data user that contravenes a requirement of the Ordinance without reasonable excuse, other than a data protection principle or a requirement with its own offence, commits an offence carrying a fine at level 3 (section 64A).

Section 35C requires a data user that intends to use personal data in direct marketing to tell the data subject so, to say that it may not do so without the data subject's consent, and to give the kinds of data and classes of marketing subjects and a free channel for consent. Section 35E bars the use without that consent, and section 35G lets a data subject require the data user at any time to stop, free of charge.

Sections 35J and 35K bar providing personal data to another person for use in direct marketing without the data subject's written consent, and section 35L lets a data subject require the data user to stop providing it.

A data user that provides personal data for gain without giving the information section 35J requires, without the data subject's written consent, or after being required to stop, faces a fine of $1,000,000 and imprisonment for 5 years (sections 35J(5), 35K(4) and 35L(6)), and the other offences in Part 6A carry a fine of $500,000 and imprisonment for 3 years. Each offence has a defence that the data user took all reasonable precautions and exercised all due diligence.

Section 35D disapplies section 35C for a use the data subject had been explicitly told of, and had not objected to, before Part 6A commenced, and for data received from a person who has confirmed in writing that sections 35J and 35K were complied with.

After an investigation, the Commissioner may serve an enforcement notice on a data user that is contravening or has contravened a requirement under the Ordinance, directing it to remedy and prevent recurrence of the contravention.

A data user that contravenes an enforcement notice commits an offence carrying a fine at level 5 and imprisonment for 2 years on a first conviction, and a fine at level 6 and imprisonment for 2 years on a later one; it is a defence that the data user exercised all due diligence to comply. A data user that, having complied with an enforcement notice, intentionally repeats the contravention it specified commits an offence carrying a fine at level 5 and imprisonment for 2 years (section 50A(3)).

Section 66 entitles an individual who suffers damage by reason of a contravention by a data user of a requirement under the Ordinance to compensation from that data user, and the damage may include injury to feelings; it is a defence that the data user took such care as was reasonably required to avoid the contravention.

Section 64(3A) makes it an offence to disclose personal data of a data subject without their relevant consent, with an intent to cause specified harm to the data subject or a family member or being reckless as to whether specified harm would be caused. Section 64(3C) makes the same disclosure a more serious offence where it causes specified harm, punishable on indictment by a fine of $1,000,000 and imprisonment for 5 years.

Section 64(1), which predates the 2021 amendment, separately makes it an offence to disclose personal data obtained from a data user without the data user's consent, with an intent to obtain gain or to cause loss to the data subject, punishable by a fine of $1,000,000 and imprisonment for 5 years.

A person charged has a defence where, among other grounds, the person reasonably believed the disclosure was necessary to prevent or detect crime, the disclosure was required or authorized by law, or the disclosure was made solely for a lawful news activity with reasonable grounds to believe its publication was in the public interest (section 64(4)).

Specified harm covers harassment, molestation, pestering, threat or intimidation, bodily or psychological harm, harm causing reasonable concern for safety or well-being, and damage to property.

Section 161(1) makes it an offence to obtain access to a computer with intent to commit an offence, with a dishonest intent to deceive, with a view to dishonest gain for oneself or another, or with a dishonest intent to cause loss to another, whether on the same occasion as the access or on a future occasion. Gain and loss extend to temporary or permanent gain or loss, whether in money or other property or not. The offence is punishable on conviction upon indictment by imprisonment for 5 years. Section 161 was added by Ordinance 23 of 1993.

Section 27A(1) makes it an offence for a person who, by telecommunications, knowingly causes a computer to perform any function to obtain unauthorized access to any program or data held in a computer. Access of any kind is unauthorized if the person is not entitled to control access of that kind to the program or data and has not been authorized by a person who is so entitled, does not believe they have been so authorized and does not believe they would have been authorized if they had applied.

The person's intent need not be directed at any particular program, data or computer. The offence is punishable on conviction by a fine at level 4. Section 27A has effect without prejudice to any law on powers of inspection, search or seizure, and the Telecommunications Ordinance does not bind the State unless it expressly provides otherwise (section 3).

Section 38(1) provides that fair dealing with a work for the purposes of research or private study does not infringe copyright, but copying by someone other than the researcher or student is not fair dealing if they know or have reason to believe it will result in copies of substantially the same material being provided to more than one person at substantially the same time and for substantially the same purpose.

Section 39 provides the same for fair dealing for criticism or review and for quotation to the extent required by the purpose, in each case of a work that has been released or communicated to the public, and for reporting or commenting on current events, in each case accompanied by a sufficient acknowledgement subject to section 39(6).

In deciding whether a dealing is fair, the court takes into account all the circumstances, including the purpose and nature of the dealing and whether it is of a commercial nature, the nature of the work, the amount and substantiality of the portion dealt with, and the effect on the potential market for or value of the work.

Under section 37(3), the primary consideration for every permitted act is that it does not conflict with a normal exploitation of the work and does not unreasonably prejudice the legitimate interests of the copyright owner. A compilation of data or other material that by reason of the selection or arrangement of its contents constitutes an intellectual creation is a literary work.

The Ordinance commenced on 27 June 1997; section 38(3) in its present form was substituted by Ordinance 15 of 2007, and section 39 in its present form by Ordinance 16 of 2022.

Principle 1 provides that personal data shall not be collected unless it is collected for a lawful purpose directly related to a function or activity of the data user, the collection is necessary for or directly related to that purpose, and the data is adequate but not excessive. Principle 1(2) requires collection by means that are lawful and fair in the circumstances. The notice duties in principle 1(3) apply where the person from whom personal data is or is to be collected is the data subject.

Principle 3 provides that personal data shall not, without the prescribed consent of the data subject, be used for a new purpose, meaning any purpose other than the purpose for which the data was to be used at the time of collection or a directly related purpose.

The Commissioner of Critical Infrastructure (Computer-system Security), or a designated authority for a regulated organization of its own, designates by written notice an organization that operates a critical infrastructure as a CI operator, and the duties below bind only a designated operator.

Schedule 1 specifies energy, information technology, banking and financial services, air transport, land transport, maritime transport, healthcare services, and telecommunications and broadcasting services as the sectors for the definition of critical infrastructure. A CI operator must maintain a unit (however described) for managing the computer-system security of its critical computer systems and ensuring that the Ordinance is complied with.

The operator may set up the unit itself or engage a service provider to do so. The operator must notify the regulating authority within 1 month after the date a specified event occurs, such as a material change to a critical computer system. The operator must submit a computer-system security management plan within 3 months of designation. The operator must conduct a computer-system security risk assessment within 12 months of designation and at least once every 12 months afterwards.

The operator must arrange a computer-system security audit within 24 months of designation and at least once every 24 months afterwards. The operator must submit an emergency response plan to the Commissioner within 3 months of designation.

The operator must notify the regulating authority of a change of the organization that operates the critical infrastructure within 1 month after the change, and must take part in a computer-system security drill when the Commissioner requires it after reasonable written notice. Failing to notify an operator change, or to take part in a drill, is an offence with a fine of 3,000,000 dollars on summary conviction and 5,000,000 dollars on conviction on indictment.

Failure to submit a plan or a revised plan, like a failure under the office, unit, material-change, risk-assessment and audit duties, is an offence with a fine of 300,000 dollars on summary conviction and 500,000 dollars on conviction on indictment, plus a further daily fine while the offence continues.

A defendant is acquitted where the offence was due to a cause beyond its control and it took all reasonable precautions and exercised all due diligence, and the Commissioner may exempt an operator from an obligation in the public interest. The Ordinance has been in operation since 1 January 2026.

A CI operator that becomes aware that a computer-system security incident has occurred in respect of a critical computer system of a critical infrastructure it operates must notify the Commissioner of the incident. A computer-system security incident is an event that involves access, without lawful authority, to the critical computer system, or another act done without lawful authority on or through it, and has an actual adverse effect on its computer-system security.

The notification is due 12 hours after becoming aware of the incident if it disrupts or is likely to disrupt the core function of the critical infrastructure. In any other case the notification is due 48 hours after becoming aware of the incident. If the notification is not made in the specified form and way, the operator must subsequently submit a written record of the incident to the Commissioner within the specified time.

The specified time for the written record is 48 hours after the notification. The operator must further submit a written report of the incident to the Commissioner within the specified time. The specified time for the written report is 14 days after the operator becomes aware of the incident. Failure to comply is an offence with a fine of 3,000,000 dollars on summary conviction and 5,000,000 dollars on conviction on indictment.

Sections 15 to 17 make it an offence to supply, acquire or use address-harvesting software or a harvested-address list in connection with sending commercial electronic messages that have a Hong Kong link without the consent of the registered users of the addresses. Address-harvesting software is software specifically designed or marketed for searching the Internet or a public telecommunications network for electronic addresses and collecting them.

Section 18 bars sending such a message to an electronic address obtained using an automated means that generates possible addresses by permutation.

Section 19 bars using scripts or other automated means to register for 5 or more electronic mail addresses from which to send multiple commercial electronic messages without the recipients' consent, and section 20 bars relaying or retransmitting multiple such messages with intent to deceive or mislead recipients or a service provider as to their source.

A contravention is punishable on summary conviction by a fine at level 6, with imprisonment for 2 years under sections 18, 19 and 20, and a knowing contravention of sections 15 to 19, or a contravention of section 20 tried on indictment, is punishable by a fine of $1,000,000 and imprisonment for 5 years. Section 19 does not apply to a person administering an organization's information systems, or to a telecommunications service provider providing a public telecommunications service.

Against a summary charge under sections 15 to 18, a person may prove that they took all reasonable precautions and exercised all due diligence, and for supply under section 15 and sending under section 18, that they did not know and had no reason to suspect the unlawful use or the automated origin of the address.

Section 8 bars sending a commercial electronic message that has a Hong Kong link unless it includes clear and accurate information identifying and allowing contact with the individual or organization that authorized it. Section 9 requires each such message to include a clear and conspicuous unsubscribe facility that is free for the recipient and works for at least 30 days, and requires the person who receives an unsubscribe request to retain a record of it for at least 3 years.

Section 10 requires the sender to stop sending within 10 working days after an unsubscribe request, unless the recipient has since consented, and section 12 bars a commercial electronic mail message whose subject heading would be likely to mislead the recipient about a material fact. Sections 8, 9 and 10 do not apply to a message sent by mistake, or where the sender did not know and could not with reasonable diligence have ascertained that it had a Hong Kong link.

Section 58 makes it an offence for a person who receives an unsubscribe request to use information obtained through it for any purpose other than complying with sections 9 and 10, punishable on summary conviction by a fine at level 6 and, if done knowingly, on indictment by a fine of $1,000,000 and imprisonment for 5 years.

Schedule 1 exempts from Part 2 a message sent within a reasonable time in response to information the recipient communicated, a message that facilitates or confirms a transaction the recipient agreed to, a notification about an existing subscription or account, and a message about an employment relationship.

Section 5 requires a specified licensee that supplies a service through a SIM card to ensure that the SIM card is not active unless it is currently registered with the licensee, except while it is active solely to facilitate registration.

Section 6 allows registration only if the person has provided all the specified information and the licensee has no reasonable cause to believe it incomplete, contradictory, false or misleading, and section 7 requires the licensee to ensure that no individual has more than 10, and no business registration holder more than 25, pre-paid SIM cards currently registered with that licensee.

Section 9 requires deregistration where the licensee has reasonable cause to believe the registered information is incomplete or false, after taking reasonable steps to let the person rectify it, and section 11 requires the licensee to keep a record of the SIM card and the registered information for the registration period and 1 year afterwards.

Sections 12 and 13 require the licensee to provide a SIM card record to a law enforcement officer under a magistrate's warrant, or without a warrant on the written authorization of a senior officer where a serious offence or a risk to life or of serious bodily harm is suspected and a warrant is impracticable.

Section 27 makes it an offence for any person to damage, remove or interfere in any way with a telecommunications installation with intent to prevent or obstruct the transmission or delivery of a message, or to intercept or discover the contents of a message. The offence is punishable on summary conviction by a fine at level 4 and imprisonment for 2 years. The Telecommunications Ordinance does not bind the State unless it expressly provides otherwise (section 3).

Section 24 makes it an offence for a telecommunications officer, or a person with official duties in connection with a telecommunications service, to wilfully destroy, secrete or alter a message received for transmission or delivery, to forge a message or utter one known to be forged or altered, to wilfully abstain from transmitting, or intercept, detain or delay, a message, or otherwise than in pursuance of duty or as directed by a court to copy a message or disclose it or its purport to anyone other than the addressee.

The offence is punishable on summary conviction by a fine at level 4 and imprisonment for 2 years. The section does not apply to acts done to comply with the Telecommunications Ordinance or the Unsolicited Electronic Messages Ordinance, to implement a licence or customer contract, or to comply with a lawful customer request. The Telecommunications Ordinance does not bind the State unless it expressly provides otherwise (section 3).

Section 11 bars sending a commercial electronic message with a Hong Kong link to an electronic address that is listed in a do-not-call register when the message is sent, unless the registered user has consented or the address has been listed for less than 10 working days. Section 11 does not apply to a message sent by mistake, or where the sender did not know and could not with reasonable diligence have ascertained that it had a Hong Kong link.

Section 13 bars a person who sends such a message from a telephone or facsimile number from concealing or withholding the calling line identification information of the sending number.

Schedule 1 exempts from the whole Ordinance voice, sound, image or video messages that involve person-to-person interactive communication between a caller and a recipient without any pre-recorded or synthesized element, and such communication with a pre-recorded or synthesized element activated in response to information the caller communicates, as well as television programme and sound broadcasting services.

Section 88B of the Copyright Ordinance provides that a service provider is not liable for damages or any other pecuniary remedy for infringement of copyright that occurs on its service platform merely because it provides, or operates facilities for, online services, if the conditions in section 88B(2) are complied with.

The conditions are that the service provider takes reasonable steps to limit or stop the infringement as soon as practicable after receiving a notice of alleged infringement or becoming aware of the infringement or of facts that would lead inevitably to the conclusion that it occurred, receives no financial benefit directly attributable to the infringement, accommodates and does not interfere with standard technical measures, and designates an agent to receive notices of alleged infringements.

A service provider is treated as having taken reasonable steps if it complies with all the provisions of the code of practice on the course of action that a provider may adopt in limiting or stopping an alleged infringement. Nothing in the Division requires a service provider to monitor its service or actively seek facts that indicate infringing activity, except to the extent consistent with a standard technical measure.

A service provider is a person who, by means of electronic equipment or a network, or both, provides, or operates facilities for, any online services. Online services include the hosting of information, the storing of information on a system or network that users can access, the linking of users to an online location by information location tools, and online social networking services.

Section 88B does not apply to proceedings for infringement of copyright commenced before it came into operation on 1 May 2023.

A notice of alleged infringement under section 88C of the Copyright Ordinance must be in writing, be signed or otherwise authenticated by the copyright owner or the owner's authorized representative, and be provided to the service provider's designated agent by the means the provider specifies. A notice that does not comply with section 88C(2) or (3) is of no effect for the purposes of section 88B(2)(a)(i).

On receiving a notice, a service provider may send a copy to the subscriber, notify the subscriber that the subscriber may contact the complainant directly, remove the material or disable access to it, and notify the subscriber of the removal or disabling.

Within a reasonable time after receiving a copy of the notice, the subscriber may give a counter notice disputing or denying the infringement and requesting the provider to take reasonable steps to reinstate the material, or cease disabling access, within a reasonable time after receiving the counter notice.

A service provider that has in good faith removed material pursuant to a notice is not liable for the removal, but for material residing at a subscriber's direction it keeps that protection only if it takes reasonable steps to notify the subscriber and send a copy of the notice and, where a counter notice is given, promptly sends it to the complainant and takes reasonable steps to reinstate the material.

The reinstatement steps do not apply if proceedings seeking a court order about the infringing activity have been commenced in Hong Kong and the provider's designated agent has been notified in writing. A person who makes a statement in a notice of alleged infringement or counter notice knowing it to be false in a material respect, or recklessly makes a materially false statement, commits an offence liable on conviction to a fine at level 2 and imprisonment for 2 years.

A person who makes such a statement knowing it to be false, or not believing it to be true, in a material respect is also liable in damages to any person who suffers loss or damage as a result. In an action about a service provider's liability, the court must presume that the provider complied with a condition described in section 88B(2) or a condition in the code of practice if the provider adduces evidence tending to show that it did.

A magistrate may, on application made in the name of the Secretary for Justice during criminal proceedings in relation to a specified offence concerning an image, order a person, whether in Hong Kong or elsewhere, to take reasonable steps to remove, delete or destroy the image, or to cause its removal, deletion or destruction, within a period the magistrate specifies. A specified offence is an offence, or an alleged offence, under section 159AAD or 159AAE.

The application must identify the image, prove that it is an intimate image of an individual and a subject of the criminal proceedings, and prove that the person has the means to control, or is in possession of, an image and is able to take the actions the order requires. A magistrate must not make a disposal order unless satisfied that all matters required to be proved have been proved on a balance of probabilities.

Before making a disposal order the magistrate must issue a summons to the person to appear and make representations. A disposal order may be reviewed and affirmed, suspended, varied, cancelled or revoked by the magistrate on the magistrate's own motion, on application by the Secretary for Justice, or on application by the subject person or a concerned person.

A summons or disposal order is regarded as duly served in Hong Kong on a person if it is served by hand, left at the person's last known address or sent by registered post to that address. The Crimes (Amendment) Ordinance 2021 (35 of 2021) came into operation on 8 October 2021.

The Commissioner of Police may, with the approval of the Secretary for Security, specify an electronic message if there is reasonable ground for suspecting that a person has published it on an electronic platform and that the publication is likely to constitute an offence endangering national security or likely to cause the occurrence of such an offence.

A designated officer who reasonably believes that a message is one so specified may require the platform service provider for the platform to take a disabling action on the message before the deadline the officer specifies. A disabling action by a platform service provider is removing the message from the platform, or restricting or ceasing access by any person, via the platform, to the message.

Where it is not reasonably practicable to require the platform service provider to act, or it fails to comply, the designated officer may require the hosting service provider to take a disabling action. A police officer exercising the power in section 9 may require a service provider to provide the identification record or decryption assistance, as the case requires.

A service provider that fails to comply with a requirement issued under section 7 or 9(3) commits an offence and is liable on conviction on indictment to a fine of $100,000 and imprisonment for 6 months.

For a failure to comply with a requirement under section 7, it is a defence to show a specified excuse, which exists where the technology necessary for complying was not reasonably available or where there was a risk of incurring substantial loss to, or otherwise substantially prejudicing the right of, a third party.

A person who fails to comply with a requirement to remove a message the person published commits an offence liable on conviction on indictment to a fine of $100,000 and imprisonment for 1 year. A service provider that complies with a requirement issued under section 7 does not incur civil liability by reason only of that compliance. The power to require a platform service provider to act is exercisable whether or not the intermediary service is provided within or outside Hong Kong.

The Implementation Rules come into operation on 7 July 2020. The amendments made by Legal Notice 27 of 2026 commenced on 23 March 2026.

Under section 66M(1) of the Personal Data (Privacy) Ordinance, the Privacy Commissioner for Personal Data may serve a written notice on a Hong Kong person who is able to take a cessation action, directing the person to take it, where the Commissioner has reasonable ground to believe that there is a subject message.

The Commissioner may also serve a cessation notice on a non-Hong Kong service provider that is able to take a cessation action in relation to a subject message that is an electronic message.

A subject disclosure is a disclosure of a data subject's personal data, without the data subject's relevant consent, with an intent to cause specified harm or being reckless as to whether specified harm would be caused, where the data subject is a Hong Kong resident or is present in Hong Kong when the disclosure is made.

A cessation action includes removing the message from the electronic platform on which it is published, ceasing or restricting access to it, and discontinuing the hosting service for the part of the platform on which it is published or for the whole platform. The cessation notice must state the Commissioner's belief and its ground, identify the message, specify the cessation action and specify the date on or before which it must be taken.

An appeal against a cessation notice may be made to the Administrative Appeals Board within 14 days after service, and the appeal does not affect the operation of the notice. A person who contravenes a cessation notice commits an offence, liable on a first conviction to a fine at level 5 and imprisonment for 2 years, with a further daily fine for a continuing offence, and on each subsequent conviction to a fine at level 6 and imprisonment for 2 years, with a higher daily fine.

It is a defence to show a reasonable excuse, including that compliance could not reasonably be expected having regard to the nature, difficulty or complexity of the cessation action, that the technology necessary for complying was not reasonably available or that there was a risk of incurring substantial loss to, or substantially prejudicing the right of, a third party. A person who complies with a cessation notice does not incur civil liability to another person only because of that compliance. The Personal Data (Privacy) (Amendment) Ordinance 2021 came into effect on 8 October 2021.

Section 159AAE of the Crimes Ordinance makes it an offence to publish an intimate image of an individual, intending the publication to cause humiliation, alarm or distress or knowing or being reckless as to whether it will or is likely to, where no consent is given and the person disregards whether the individual consents.

It is also an offence to make a threat to publish an intimate image of an individual, with the same intent, knowledge or recklessness, where no consent is given and the person disregards whether the individual consents.

An intimate image includes an image that has been altered to appear to show an intimate part of the individual, or the individual doing an intimate act, regardless of whether any intimate part shown is in fact that of the individual, but not an image so altered that no reasonable person would believe that it shows one.

A person publishes an image by distributing, circulating, making available, sending, selling, hiring, giving or lending it to another person or by showing it, and this includes making available any hyperlink, or location on an electronic platform, that gives access to the image.

Section 159AAD makes it an offence to publish an image that originates from the commission of voyeurism or of unlawful recording of intimate parts, knowing or being reckless as to that origin and disregarding whether the individual consents. A subject individual under the age of 16, or a mentally incapacitated person, cannot give a consent that prevents the conduct from being an offence.

An offence under section 159AAE(1) or (2) is punishable on conviction on indictment by imprisonment for 5 years. An offence under section 159AAD(1) carries the same maximum of imprisonment for 5 years on conviction on indictment. It is a defence to establish lawful authority or reasonable excuse.

Where the individual is under 16 or mentally incapacitated, it is also a defence for the person to prove that the person genuinely believed the individual had consented and did not know and had no reason to suspect the individual’s age or incapacity. The Crimes (Amendment) Ordinance 2021 (35 of 2021) came into operation on 8 October 2021.

Section 3(2) of the Prevention of Child Pornography Ordinance makes it an offence to publish any child pornography, punishable on conviction on indictment by a fine of $2,000,000 and imprisonment for 8 years, or on summary conviction by a fine of $1,000,000 and imprisonment for 3 years. A person publishes child pornography if, among other acts, the person distributes, circulates, sells, hires, gives or lends it to another person or shows it to another person.

To distribute includes making any message or data available through any means of electronic transmission. Section 3(1) makes it an offence to print, make, produce, reproduce, copy, import or export any child pornography. Section 3(4) makes it an offence to publish or cause to be published an advertisement that conveys or is likely to be understood as conveying the message that any person has published, publishes or intends to publish any child pornography.

Child pornography includes a photograph, film, computer-generated image or other visual depiction of a person who is or is depicted as being a child, whether or not it is a depiction of a real person and whether or not it has been modified. A child is a person under the age of 16.

Section 3(3) makes it an offence to possess child pornography, punishable on conviction on indictment by a fine of $1,000,000 and imprisonment for 5 years, or on summary conviction by a fine of $500,000 and imprisonment for 2 years. Section 4(2) provides a defence that the defendant had not seen the child pornography and did not know, nor have any reasonable cause to suspect, it to be child pornography.

Section 4 also provides defences of artistic merit, of classification as a Class I or Class II article under the Control of Obscene and Indecent Articles Ordinance, of a genuine educational, scientific or medical purpose, of the public good, and of reasonable steps to ascertain the age of the person depicted with a belief on reasonable grounds that the person was not a child.

Against a possession charge it is also a defence that the defendant had not asked for any child pornography and endeavoured to destroy it within a reasonable time after it came into the defendant’s possession. The Ordinance commenced on 19 December 2003.

Section 7(1) of the Control of Exemption Clauses Ordinance provides that a person cannot by reference to any contract term or to a notice exclude or restrict liability for death or personal injury resulting from negligence. For other loss or damage, a person cannot so exclude or restrict liability for negligence except in so far as the term or notice satisfies the requirement of reasonableness.

Section 8 applies as between contracting parties where one of them deals as consumer or on the other's written standard terms of business, and the other cannot, except in so far as the term satisfies the requirement of reasonableness, exclude or restrict liability for its own breach of contract or claim to render a performance substantially different from that reasonably expected or no performance at all.

For goods of a type ordinarily supplied for private use or consumption, section 10 provides that liability for loss or damage that arises from the goods proving defective while in consumer use and results from the negligence of a person concerned in their manufacture or distribution cannot be excluded or restricted by a term or notice in a guarantee of the goods.

Section 11 provides that, against a person dealing as consumer, liability for breach of the seller's undertakings under section 15, 16 or 17 of the Sale of Goods Ordinance cannot be excluded or restricted by a contract term. Against a person dealing otherwise than as consumer, that liability can be excluded or restricted only in so far as the term satisfies the requirement of reasonableness. Sections 7 to 12 apply only to business liability.

Under Schedule 1, sections 7 and 8 do not apply to a contract so far as it relates to the creation or transfer of a right or interest in any patent, trade mark, copyright, registered design, technical or commercial information or other intellectual property, nor to contracts of insurance, interests in land, the formation or constitution of a company, or securities. Section 16 lifts the Ordinance’s limits for an exempted supply contract, a cross-border contract for the sale or supply of goods. The Ordinance came into operation on 1 December 1990.

Section 16(2) of the Sale of Goods Ordinance implies, where the seller sells goods in the course of a business, a condition that the goods supplied under the contract are of merchantable quality, except for defects specifically drawn to the buyer's attention before the contract is made, defects that the buyer's examination before the contract ought to reveal and, in a sale by sample, defects that a reasonable examination of the sample would have revealed.

Section 16(3) implies, where the seller sells goods in the course of a business, a condition that the goods are reasonably fit for any particular purpose the buyer makes known, whether or not it is a purpose for which such goods are commonly supplied, except where the buyer does not rely, or it is unreasonable for the buyer to rely, on the seller's skill or judgment. Goods includes all chattels personal other than things in action and money.

The measure of damages for breach of warranty is the estimated loss directly and naturally resulting, in the ordinary course of events, from the breach of warranty. Where a right, duty or liability is declared by the Ordinance, it may, unless otherwise provided, be enforced by action. An implied right, duty or liability may be negatived or varied by express agreement, by the course of dealing or by usage, subject to the Control of Exemption Clauses Ordinance.

The Ordinance came into operation on 1 August 1896, but section 16 in its present form was substituted by Ordinance No. 58 of 1977 and amended by Ordinance No. 85 of 1994, and the consolidated text records no day on which either came into operation.

Section 22(1) of the Control of Obscene and Indecent Articles Ordinance makes it an offence to publish any indecent article to a person who is a juvenile, whether or not the publisher knows that it is an indecent article or that the person is a juvenile. A juvenile is a person under the age of 18 years. A thing is indecent if by reason of indecency it is not suitable to be published to a juvenile.

A person publishes an article if, among other acts, the person distributes, circulates, sells, hires, gives or lends it to the public or a section of the public.

Section 22(2) gives a defence where the article is classified as a Class I article, where the person charged inspected an identity card or passport purporting to be the juvenile's and believed on reasonable grounds that the juvenile was not a juvenile, or where the article was published in compliance with conditions imposed by a Tribunal.

Section 28 also makes it a defence to a charge under Part IV, which includes section 22, that a Tribunal finds the publication was intended for the public good as being in the interests of science, literature, art or learning, or any other object of general concern. The penalty is a fine of $400,000 and imprisonment for 12 months on a first conviction, and a fine of $800,000 and imprisonment for 12 months on a second or subsequent conviction.

Section 22(1) of the Copyright Ordinance gives the owner of the copyright in a work the exclusive right to copy it, issue copies of it to the public, rent copies to the public, perform, show or play it in public, communicate it to the public, and make an adaptation of it. Copyright in a work is infringed by a person who without the licence of the copyright owner does, or authorizes another to do, any of the acts restricted by the copyright.

In determining whether a person has authorized another to do such an act, the court may take into account the extent of that person's power to control or prevent the infringement, the nature of the relationship between them, and whether that person has taken any reasonable steps to limit or stop the infringement. Copying a work means reproducing it in any material form, which includes storing the work in any medium by electronic means.

Copying includes the making of copies which are transient or are incidental to some other use of the work. References to the communication of a work to the public are references to the electronic communication of the work to the public, including the broadcasting of the work, the inclusion of the work in a cable programme service and the making available of the work to the public.

Making a work available to the public means making it available, by wire or wireless means, in such a way that members of the public in Hong Kong or elsewhere may access it from a place and at a time individually chosen by them. A person is regarded as having communicated a work to the public if the person has determined the content of the communication, and a person does not determine the content only because the person clicks on a link to gain access to a webpage.

A computer program is a literary work. A person who without the licence of the copyright owner makes for sale or hire an infringing copy of a copyright work commits an offence. Section 119(1) provides that a person who commits that offence is liable on conviction on indictment to a fine at level 5 in respect of each infringing copy and to imprisonment for 4 years.

Section 118(8B) makes it an offence to infringe copyright by communicating a work to the public in the course of a business of communicating works to the public for profit or reward, or otherwise to such an extent as to affect prejudicially the copyright owner. That offence is punishable on conviction on indictment by a fine at level 5 in respect of each copyright work and imprisonment for 4 years.

It is a defence for the person charged to prove that the person did not know and had no reason to believe that the communication infringed copyright. The Ordinance, with the right to copy a work, commenced on 27 June 1997. The communication right was added to section 22(1) by Ordinance 16 of 2022, which came into operation on 1 May 2023.

Section 60(1) of the Copyright Ordinance permits a lawful user of a copy of a computer program to make a back-up copy of the program without infringing the copyright in the program if it is necessary for the user to have the back-up copy for the purposes of the user's lawful use. A person is a lawful user of a computer program if the person has a contractual right to use the program, and section 60 has effect subject to any agreement to the contrary.

Section 61(1) permits a lawful user of a copy of a computer program to copy or adapt the program without infringing the copyright in the program if the copying or adapting is necessary for the user's lawful use. A lawful user may, in particular, if it is necessary for the lawful use of the program, copy the program or adapt it for the purpose of correcting errors in it.

Section 39(3) of the Copyright Ordinance provides that fair dealing with a work for the purpose of reporting or commenting on current events does not infringe any copyright in the work if, subject to section 39(6), the dealing is accompanied by a sufficient acknowledgement.

Section 39(2) provides that copyright in a work is not infringed by the use of a quotation from the work, whether for criticism, review or otherwise, if the work has been released or communicated to the public, the use is fair dealing, the extent of the quotation is no more than the specific purpose requires, and the use is accompanied by a sufficient acknowledgement.

In determining whether a dealing is fair, the court must take into account all the circumstances of the case and, in particular, the purpose and nature of the dealing including whether it is for a non-profit-making purpose or of a commercial nature, the nature of the work, the amount and substantiality of the portion dealt with, and the effect of the dealing on the potential market for, or value of, the work.

It is not necessary to accompany a dealing with a sufficient acknowledgement if it is not reasonably practicable to do so. Section 39A provides that fair dealing with a work for the purpose of parody, satire, caricature or pastiche does not infringe any copyright in the work. Section 39 was replaced by section 19 of Ordinance 16 of 2022.