HONG KONG PRIVACY COMMISSION TO INVESTIGATE

C O N F I D E N T I A L SECTION 01 OF 02 HONG KONG 001941 SIPDIS SIPDIS DEPT FOR EAP AND EAP/CM NSC FOR DENNIS WILDER E.O. 12958: DECL: 05/10/2031 TAGS: PGOV PHUM PINR PREL HK CH SUBJECT: HONG KONG PRIVACY COMMISSION TO INVESTIGATE YAHOO!'S ROLE IN DETENTION OF CHINESE DISSIDENT REF: 05 HONG KONG 4265 Classified By: E/P Chief Simon Schuchat. Reasons: 1.4(b,d). ¶1. (C) Summary: On May 2, Hong Kong's Privacy Commissioner confirmed to poloff that the Commission was investigating whether information provided by Yahoo! regarding mainland journalist Shi Tao, had violated the territory's Personal Data (Privacy) Ordinance. Although Shi is not a Hong Kong resident, the International Chinese Pen Center, an organization of exiled mainland writers, has filed a complaint with the privacy watchdog on Shi's behalf. Of particular concern to lawmakers and human rights activists was speculation that Yahoo!'s Hong Kong-based operations had provided information to PRC law enforcement officials -- a clear violation of Hong Kong's status as an autonomous territory with a separate legal structure. In response, representatives of Yahoo! have emphasized that Yahoo! China, not Yahoo! Hong Kong, responded to the request from mainland law enforcement in Shi's case. However, it is unclear what role Yahoo! Holdings (Hong Kong) Limited, the holding company which previously owned both Yahoo! China and Yahoo! Hong Kong at the time of Shi's arrest, played in passing, authorizing, or directing the transfer of data to PRC authorities; it may therefore be the current focus of the Privacy Commission's investigation. End Summary. Commission Investigates Yahoo! -------------- ¶2. (C) On May 2, Hong Kong's Privacy Commissioner for Personal Data Roderick Woo confirmed to poloff that the Commission was investigating whether information provided by Yahoo! regarding mainland journalist Shi Tao, had violated the territory's Personal Data (Privacy) Ordinance. According to Shi's mainland court verdict, Yahoo! Holdings (Hong Kong) Limited provided information to China's state security authorities which later led to Shi's arrest and conviction. Although Shi is not a Hong Kong resident, Zhang Yu, Secretary General of the International Chinese Pen Center, an organization of exiled mainland writers, filed a complaint with the Privacy Commission -- a statutory body separate from the Hong Kong Government and charged with protecting the privacy of personal data -- on Shi's behalf. During the meeting, Woo was not forthcoming about the details of the case, citing the sensitive nature of the ongoing investigation. ¶3. (C) In his initial response to the media storm regarding Yahoo!'s role in Shi Tao's imprisonment last September, Yahoo! co-founder Jerry Yang did not deny that his company had provided information to mainland authorities; he instead emphasized that the company had no choice but to obey the national laws in the countries in which it operated. According to press reports, a total of four mainland internet writers have been imprisoned (Shi Tao, 10 years; Li Zhi, 8 years; Jiang Lijun, 4 year; and Wang Xiaoning, 10 years) after Yahoo! Holdings (Hong Kong) Limited turned over information regarding their yahoo.cn email accounts. Yahoo! Denies Violating Hong Kong Autonomy -------------- ¶4. (C) Of particular concern to Hong Kong lawmakers and human rights activists was the possibility that the Yahoo! operations based in Hong Kong had provided information to PRC investigators, a clear violation of Hong Kong's status as an autonomous territory with a separate legal structure. In two separate instances, representatives of Yahoo! vigorously denied that Yahoo! Hong Kong had provided information on Shi Tao to mainland authorities. In October 2005, Hong Kong's legislature convened a special Panel meeting to ascertain whether the territory's privacy laws had been violated. Allan Kwan, Managing Director of Yahoo! Holdings (Hong Kong) Limited stated in an October 28, 2005 letter to Legco that "Yahoo! Hong Kong has not been involved in any disclosure of information, including that relating to Shi Tao, to the mainland authorities...Since compliance with law enforcement mandates in mainland China are handled by Yahoo! China, Yahoo! Hong Kong is not aware of what information was provided in that case or the circumstances thereof. Our understanding of this matter is that the data disclosure was made by the Yahoo! China operation for a PRC user in China holding a .cn email account. Neither Yahoo! Hong Kong nor any .hk user data was involved, and as such we do not believe that there are any implications with respect to the Personal Data (Privacy) Ordinance." Furthermore, on February 15, during testimony before the U.S. House Committee on HONG KONG 00001941 002 OF 002 International Relations on the issue of the Internet in China, Michael Callahan, Senior Vice President and General Counsel for Yahoo! Inc. again stated that Yahoo! Hong Kong "was not involved in any disclosure of information about Mr. Shi to the Chinese Government." Privacy Violation? -------------- ¶5. (C) At issue is the role of three separate entities potentially involved in the case of Shi Tao: Yahoo! China, Yahoo! Hong Kong, and Yahoo! Holdings (Hong Kong) Limited, the holding company which previously owned the former two companies. Since August of last year, Yahoo! China has been owned and controlled by Alibaba.com Corporation, a Chinese technology firm. It is clear that Yahoo! China responded to a request from mainland law enforcement authorities regarding Shi and that Yahoo! Hong Kong played no role in this transfer of user information. However, what is unclear is the role of the holding company, Yahoo! Holdings (Hong Kong) Limited in passing, authorizing, or directing the transfer of data to PRC authorities and may be the focus of the Privacy Commission's investigation. Woo confirmed that if the complainant (in this case, the International Chinese Pen Center) has legal standing to lodge a complaint, then the Commission would be obligated to investigate the case. If Yahoo! -- whether it is Yahoo! Hong Kong, or Yahoo! Holdings (Hong Kong) Limited is found to have violated Shi Tao's privacy, then the Privacy Commissioner may serve an enforcement notice on the company which may carry a penalty of a fine and/or imprisonment. ¶6. (C) The Privacy Commissioner told the "South China Morning Post" on April 26 that Shi's case was challenging because, "there are difficulties with the technical definition of the term 'personal data' and (issues) involving jurisdictional points." Moreover, the Ordinance also provides for exemptions to the privacy law "where their application is likely to prejudice certain competing public or social interests, such as security, defense and international relations; prevention or detection of crime;" etc. For example, on May 10, the Court of First Instance issued a court order requiring four Internet service providers to provide the identities of 49 users who allegedly downloaded local films illegally. In this case, the Hong Kong Court found that the users' privacy was exempt from the Privacy Ordinance in order to detect criminal activity. Cunningham