You cannot trust anyone — “One may smile, and smile, and be a villain.”

While not everyone has heard of this quote from William Shakespeare’s famous play Hamlet, you will have to agree that it fittingly describes the Hamlet-esque story that you find in your email inbox out of the blue: his father having passed away, a Nigerian prince’s throne was usurped by his uncle and he now needs your help to transfer his funds out of Nigeria, in return you would keep a portion of the funds. All you have to do is to give him your personal details (so the Prince knows who you are), your bank account number (for you to temporarily “safekeep” his funds), and of course, to pay a fee in advance.

Yes, this is apparently a scamming technique that has been widely deployed since the 1980s, and while every year there are still people who succumb to the temptation of windfall, more and more people are aware of the reality.

Fraudsters are therefore making use of a different modus operandi in recent years, one that is more specific instead of the “spray and pray” Nigerian prince model. Also carried out by way of email scam, fraudsters would first hack email accounts or compromise computers to obtain vital information, then tailor-make the fraud scheme to deceive the email recipients into paying them.

How do email scams operate?

In many cases that we came across, the victims are mostly trading companies with business counterparts all across the globe. The diagram below illustrates how the scheme operates.

1. There had been genuine sale of goods by the Supplier to the Victim.
2. The Supplier then sent payment invoice (sometimes together with the bill of lading, the purchase order etc.) to the Victim via email. 
3. The Fraudster, having hacked the Supplier’s email account, pretended to be the Supplier and send a forged payment invoice, bill of lading and purchase order by changing the bank account details and the document letterheads via email. The forged email would normally come from a fraudulent account which is strikingly similar to the Supplier’s genuine email account (e.g. changing from sales@abcengineering.com to sales@abcengineeering.com), misleading the Victim to believe that the email was from the Supplier itself. The façade is further reinforced by the Fraudster justifying the different payment details with excuses such as change in accounting policies. The Victim is of course reasonable and courteous enough not to venture too far and challenge the legitimacy of such policy.
4. The Victim, failing to notice the subtle difference in the forged email, remitted money to the Fraudster’s bank account.
5. The Victim would eventually realize the scam perpetrated by the Fraudster upon the Supplier’s reminder chasing for payment or its notice that money was never received. The scam might be discovered slightly earlier if the Victim sends a remittance advice to the Supplier, and then the Supplier informs the Victim that the recipient bank account is apparently not the Supplier’s bank account.
6. By that time, it is likely that the Fraudster has dissipated the funds from its bank account, most probably to other jurisdictions.

What to do next?

1. A complaint should be filed to the Hong Kong Police or the Joint Financial Intelligence Unit (JFIU) such that they might take action to freeze the Fraudster’s bank account in Hong Kong.
2. At the same time, the victim should file a parallel report to the relevant authority in its jurisdiction. Certain jurisdictions have online reporting systems dedicated to cybercrimes, such as the Internet Crime Complaint Center (IC3) under the U.S.A. Federal Bureau of Investigation and the U.K. “Action Fraud” National Fraud & Cyber Crime Reporting Centre.
3. A letter should also be issued to banks (including the sending and recipient banks), alerting them of the scam and demanding return of the defrauded fund and/or preservation of the fund in the relevant bank accounts.

The victim’s effort to recover the money is always a race against time. It is therefore always advisable to act as soon as possible, and ideally within 24 hours from the fund transfer, as thereafter the fraudster is very likely to have already dissipated the funds. If law enforcement authorities or banks have not decided to freeze the relevant accounts, the victim should seek assistance from lawyers to apply for a Mareva Injunction (i.e. asset-freezing order) on the civil route to prevent dissipation. 

If the money is successfully retained in the bank account pursuant to the injunction, civil proceedings should be commenced against the bank account holder to recover the money in equity. The fraudster is very unlikely to contest the proceedings (by this time he probably has absconded) so the victim can apply for a monetary default judgment against the fraudster unhindered. To actually recover the money, the victim then needs to apply for a garnishee order, which once granted will compel the bank to directly transfer the money from the fraudster’s bank account to the victim.

Recent case law suggests that other than the conventional way of obtaining a monetary default judgment, the victim might also seek a declaration in default to assert a proprietary claim over the funds in the fraudster’s bank account which, if succeeds, would lead to a vesting order. The bank will then be compelled to immediately transfer the money back to the victim without the need to wait for the garnishee order. 

If the money has already been dissipated by the time the injunction is obtained, the victim will have to take extra steps to “trace” the money. A discovery order for banker’s record needs to be obtained first, so that the victim can ascertain the flow of the money and track down where it was transferred to. Most of the time it would be a cross-jurisdiction transfer, which adds another obstacle to the victim’s recovery. The victim will have to engage lawyers in that jurisdiction to commence new proceedings against the new, foreign recipient of the money, and also conduct further discovery and tracing to ascertain the latest whereabouts of the money. As one may see, if the money cannot be frozen in time, the matter will be very complicated with time and costs spiraling out of control, and at the end of the day, the fraudster may still be one step ahead of the victim so that the victim cannot recover the stolen money. This is exactly why the victim is advised above to act as soon as possible.

Prevention is better than cure

It is always better to take preventative measures rather than looking out for remedies. You may check out some practical preemptive measures from the Police’s article “Tips for Smart Netizens” which is available at http://www.police.gov.hk/ppp_en/04_crime_matters/tcd/tips.html

What OLN can do for you

OLN has acted for the victims in many email scam incidents, and electronic fraud cases generally. On most occasions, OLN has successfully obtained the Mareva Injunction and recovered a substantial portion of the defrauded money (if not entirely). With extensive experience in civil litigation, we will be able to assist you in a swift and efficient manner. 

Another fitting quote by William Shakespeare in Henry VI would be appropriate to conclude this article:

“Wise men ne’er sit and wail their loss, but cheerily seek how to redress their harms.” 

This article is for information purposes only. Its contents do not constitute legal advice and readers should not regard this article as a substitute for detailed advice in individual instances.

Shareholders disputes can take years to conclude whether via arbitration or the court system in HK but interim injunctions can offer quick relief even before the issuance of legal proceedings.

Injunctions can be used to maintain a board’s composition and prevent “illegal” resolutions from being passed:

• To remain in management of the company: When 2 camps of shareholders are in a disagreement over the management of the company, often, directors are removed from the board without the appropriate number of votes or proper notice, in violation of the articles of association/shareholders agreement. One way of maintaining the status quo before the alleged breach took place is to obtain a pre-action injunction requiring the company to reconstitute the board such that those wrongfully removed are re-appointed. The victim can subsequently issue the proper proceedings to support the injunction, e.g. fraud, unfair prejudice, breach of contract. In the right circumstances, with the interim injunction in place, parties will gain leverage in subsequent settlement negotiations.
• To prevent board/shareholders meetings from abuse: When directors do not observe terms imposed by contract or statute in holding board/shareholders meetings, an injunction can be obtained to restrain the convening of the meeting in question and the passing of specific resolutions.

Injunctions are also important tools in protecting the very assets that form the subject matter of the dispute. Often, interim injunctions effectively dispose of the dispute. 

• To identify the wrongdoer and important evidence against the wrongdoer from an innocent third party (Norwich Pharmacal): Quite often, assistance from the Court is required to compel an innocent third party, e.g. a bank in internet fraud cases, to disclose information or documents relating to the wrongdoer and the wrongdoing.
• To secure source of payment pending suit (Mareva): Restraining a defendant or would-be defendant from dissipating assets is a very important legal remedy in a variety of cases especially where the ownership rights of the assets in question are contested and their dissipation would effectively foreclose any chances of recovery/ enforcement, e.g. shares, cash in winding up cases.

One of the tricks lies in making the correct decision in conducting the application on an ex parte basis (i.e. where the other party is not aware of the application and is not present to argue their case) or on an inter partes basis (i.e. full notice to the other side is given).  Your legal advisor needs to strike a balance between several factors: maintaining secrecy, going for speed and running the risk of having the injunction discharged due to failure to provide full and frank disclosure.

Recent case development on anti-suit injunctions: In cross-border contractual disputes, a Hong Kong arbitration clause can form the basis of an injunction to restrain a plaintiff from continuing legal proceedings in a foreign jurisdiction (see Dickson Valora Group (Holdings) Co Ltd and another v Fan Ji Qian [2019] HKCFI 482).

If you wish to learn more about injunctions within the context of shareholders disputes or other types of litigation, please feel free to speak to our litigation partner, Eunice Chiu or stay tuned for our in-house CPD.

Eunice Chiu
+852 9169 4356 / 2186 1885
Partner, Dispute Resolution
Oldham, Li & Nie

Introduction

With the advent of computer technology and abundance of information on the internet readily accessible by the public at virtually no cost, it is increasingly straightforward and cost-effective for individuals and organizations to seek information about one another for various purposes, for example for due diligence by business entities on their acquisition targets in the commercial world. On the other hand, it is also increasingly common to see internet doxing (起底) activities intended for “public trial by the netizens” (網絡公審) happen on online social media platforms. (For the purposes of this article, internet doxing means searching for and publishing private or identifying information about a particular individual on the Internet).

Recently, the Privacy Commissioner for Personal Data Stephen Wong Kai-yi has revealed in a radio interview that his office received a staggering number of over 200 complaints about Police officers being the subject of internet doxing. The Commissioner criticized that certain pictures and social media posts initially shared on the internet by some police officers for purely recreational reasons have been maliciously extracted and reposted on internet forums and other social media platforms with the ulterior motive of identifying those police officers who the perpetrator regards, rightly or wrongly, as “rogue” or “dirty” cops so that they could be castigated and ridiculed by other netizens. In particular, the Commissioner seemed to be of the view that such internet doxing could potentially be illegal because of the following reasons:- (1) even though the data was retrieved from the public domain, the data was there for a restricted purpose; (2) reposting was not authorised by the author; and (3) the extraction and application of the data might have been for an ulterior motive such as criminal threat or defamation.

Insofar as these internet incidences are concerned, this article aims to examine the surrounding legal issues arising from the specific question — have we unintentionally breached the law by conducting internet doxing?

Is mere investigation of personal data lawful?

Mere investigation, i.e. searching for and collating information without publishing it on the internet is lawful so long as it is obtained legally from the internet for domestic purpose, i.e. the information collected is kept by the user itself and not subsequently shared on the internet. This domestic purpose is specifically allowed by section 52 of the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”). It is commonplace for individuals and organizations including law firms to undertake investigative and due diligence process. For example in a commercial deal, a prudent party would usually conduct internet due diligence on their counterparties. Many individuals also collect information on the internet for example about a celebrity for recreational purpose. Such activities themselves for own reading or information shall be lawful provided always that such information is obtained in a lawful manner.

Is collating, consolidating and reporting of personal data found from public domain lawful?

What if you make a further step from mere retrieval and investigation to collate, consolidate and reporting? While the issue has never been tried at Court, there has been an investigation report published by the Office of the Privacy Commissioner for Personal Data in 2013 concerning a mobile app provider “Do No Evil” (起你底).  Do No Evil (起你底) compiled a database of various personal information of individuals collected from the public records of various government institutions where the users of the app (mainly employers) could access such information as litigation and bankruptcy records of the targeted individuals before considering hiring them. The Commissioner was of the view that the app had breached PDPO because:  (i) it was not in line with Data Protection Principle (“DPP”) 3 of the PDPO as personal data is used outside the original purpose of being available in public authorities [to be further discussed below]; (ii) data subjects had reasonable expectation of privacy. It is perhaps not surprising to note that such views were subject to legal criticism.  First, “reasonable expectation of privacy” has no place in PDPO. Even if “reasonable expectation of privacy” exists, individuals waive such expectation or cease to have such expectation when their data have lawfully and officially been published in public domain. Second, nowhere was the “original purpose” stated in those public authorities. It appears artificial to imply certain restriction over the scope of purpose. In any event, in this particular case, the mobile app provider was only required by the Commissioner to cease disclosing data. The case was not brought to the Court system for adjudication and the legal issue therefore remains unsettled.

Is reposting of personal data found from public domain lawful?

PDPO imposes onerous obligations over data users in handling personal data received from the internet. DPP3 specifies that personal data should not be used for a new purpose without the prescribed consent of the data subject. “New purpose” under this principle refers to any purpose other than the one which was originally intended for when it was provided or collected or a directly related purpose. “Prescribed consent” means the express and voluntary consent given by the data subject in writing which has not been withdrawn. The Guidance on Use of Personal Data Obtained from the Public Domain published by the Office of the Privacy Commissioner for Personal Data makes it clear that “the fact that a data subject’s personal data can be obtained from the public domain shall not be taken to mean that the data subject has given blanket consent for use of his/her personal data for whatever purposes.” This view has also now been judicially affirmed in the court case of Re Hui Kee Chun CACV 4/2012. This evinces the PDPO’s strict objective to ensure personal data is kept adequately protected from misuse and abuse. For example, if a data user extracts different pieces of personal information of the data subject (from the same source or different sources) on the internet and publishes such information in a combined form on a social media platform, such as Facebook, this may breach DPP3 as each piece of information may have been initially provided for one or more specific purposes and their combination could potentially constitute a “new purpose” forbidden by DPP3.

Furthermore, in such a case, even if the data user does not himself makes adverse comments about the individual, if there is realistic risks of harm, including identity theft, financial loss, harassment, injury to feelings of the individual (such as allowing other forum users to hurl harassing comments on the individual), the data user may also breach section 64 of the PDPO, which prohibits usage of personal data with the intent to (a) obtain gain for himself/herself or another person or (b) cause loss to the data subject or (c) if the disclosure causes psychological harm to the data subject. An offence under this section is punishable by a fine of $1,000,000 and to imprisonment for 5 years. It should be noted that this section was rarely invoked in the past.  The actual application of this section could be problematic. First, it requires investigation on the state of mind of the data user because an “intent” is required. Second, psychological harm to the victim is largely subjective. The government emphasized, prior to the promulgation of PDPO, that the court will rely on expert evidence to prove whether disclosure of information has caused psychological harm to the victim.

It may also be worth noting that there are statutory exemptions to the above position under Part VIII of the PDPO. In brief, it would be lawful if the “new purposes” are:-

1. prevention or detection of crime (section 58);
2. prevention of serious physical or mental harm of any person (section 59);
3. it is required by law to do so or it is for exercising or defending a person’s legal rights in Hong Kong (section 60B);
4. it is published by a news activity business (section 61);
5. it is for research and statistics where the identity of the data subject is kept anonymous (section 62); and
6. emergency situation which calls identification of an individual who is reasonably suspected to be or is involved in a life-threatening situation (section 63 C).

OLN provides a range of legislative compliance legal services. If you have any questions on the above, please contact one of the members of our Team.

Disclaimer: This article is for reference only. Nothing herein shall be construed as legal advice to any person. Oldham, Li & Nie shall not be held liable for any loss and / or damage incurred by any person acting as a result of the materials contained in this article.