CSj takes a look at an issue which has become one of the most contested debates of the Companies Ordinance rewrite exercise – the proposal to withhold from public inspection the full identity numbers of directors and their residential addresses based on a perceived compromise between privacy concerns and public access to personal data.

There was a time when corporate governance was regarded as a rather academic and technical area of expertise, but those days are clearly gone. Many corporate governance issues – such as executive remuneration, shareholder rights and corporate responsibility – are now mainstream concerns. As a consequence, corporate governance professionals such as company secretaries increasingly find themselves professionally and even personally involved in issues at the top of the political and media agenda.

One such issue came up rather unexpectedly in Hong Kong earlier this year when a row developed over the proposals in the new Companies Ordinance to restrict public access to the full identity numbers and residential addresses of directors. The row was ‘unexpected’ because after the proposals were first put forward for public consultation back in 2010, it came to light that Octopus Cards Ltd, a subsidiary of MTRC Corporation, had collected and sold the personal data of some two million customers for reportedly HK$44 million since 2006 without informing them, and public opinion was shaped by such data protection concerns. After extensive public consultations, public hearings and Bills Committee scrutiny, the legislative changes were subsequently approved by the Legislative Council in July 2012.

The row recently surfaced after the government published the ‘Companies (Residential Addresses and Identification Numbers) Regulation’ for public consultation at the end of last year. This regulation is one of 12 pieces of subsidiary legislation which set out ‘technical and procedural’ matters necessary for the implementation of the new Companies Ordinance. It sets out the procedural matters relevant to section 54 of the new Companies Ordinance under which the full identity numbers and residential addresses of directors will become protected or withheld information. This time round, there has been extensive media coverage with various parties calling for the current regime with full disclosure of directors’ information to be retained.

The Administration on 28 March 2013 decided to allow more time for consultation and not to push forward with the arrangements pending such consultation because of ‘diverse’ stakeholder views. As directors were the focus of such views, the arrangement for company secretaries to file their correspondence addresses as against residential addresses would still be presented to the Legislative Council for consideration, but not partial redaction of identity information embodied within the directors’ arrangements.

What is being proposed?

At present, directors are required to state their full identity numbers and usual residential addresses in documents, such as their company’s annual returns, filed with the Companies Registry. These documents are available to the public for inspection subject to payment of a fee. The ‘Companies (Residential Addresses and Identification Numbers) Regulation’ proposes a mechanism whereby the full identity numbers and residential addresses of directors could be withheld from public inspection. It also sets out the circumstances under which certain specified persons could apply for access to this withheld information, and anyone could apply to the court for service, enforcement or otherwise for appropriate reasons under section 59 of the new Companies Ordinance.

In practice, the new regulation will mean that directors will still have to file their full identity numbers and two sets of addresses (their correspondence and residential addresses), but the Companies Registry will not disclose the full identity numbers and residential addresses to the public under a search. After the implementation of the new Companies Ordinance in 2014, only partial identity numbers and the correspondence addresses of directors would show up in a search.

This would apply to new records, but the regulation also sets out the means by which application can be made to the Companies Registrar to withhold from public inspection documents registered before the commencement of the new Companies Ordinance upon payment of a fee. It also sets out which ‘specified persons’ may apply to the Companies Registrar to gain access to the withheld information. These include those whose personal information has been withheld (the data subjects), members of the relevant company and various public officers, public bodies and specified public authorities. The court could also order disclosure of the withheld information.

In an article in the South China Morning Post, Legislative Councillor Regina Ip pointed out that there were some 40 public meetings on the topic prior to adoption of the legislative amendments and there was almost no dissent and there are overseas models, including the Australian model, which permits a director to substitute an alternative address based on safety concerns, and the ‘UK model’ allowing the listing of a service address in place of a residential address. Also, ‘in other parts of the world, the availability of such personal data has rendered directors liable to stalking, harassment and other threats to their personal safety’. Privacy and safety considerations versus the public’s right to know were all consulted upon prior to the proposals being adopted for legislation.

The case for

Supporters of the proposed measures believe that they strike the right compromise between directors’ right to privacy and the public interest. This view has been supported by a number of bodies in Hong Kong including HKICS, the Hong Kong Institute of Directors (HKIoD) and the Hong Kong General Chamber of Commerce (HKGCC).

On 16 March 2010, in response to Financial Services and Treasury Bureau’s (FSTB’s) consultations, HKICS submitted that there were views both for and against the disclosure of directors’ residential addresses. The arguments for disclosure related to directors’ responsibilities to shareholders, creditors and other stakeholders, and for effective service of proceedings. The arguments against disclosure were that directors and their family members should not be subject to possible security risks, and that an address for service, but not a post box, should be sufficient for service.

‘On balance, more members seem to be in favour of not making directors’ residential address available for inspection on the public register’, the HKICS submission states. Also, on the issue of masking certain digits of identification numbers, based on ‘increasing risk of identity theft’ this was acceptable.

On 15 February 2012, when the Companies Registry further consulted on the administrative arrangements to disclose partial identification numbers for public inspection under the Companies Bill, HKICS submitted that it supported the proposals which were in line with the ‘protection of data privacy’, and reflective of public opinion and members’ views after the Octopus incident.

To explain HKICS’s view further, there are three pillars to a person’s identity, the person’s name, identification number and residential address, and there needs to be a compromise on the extent of disclosure and the public’s right to know under company filings. The current legislative amendments contain such a compromise along with a safeguard that those with a genuine need to know, like shareholders, are empowered to seek the withheld information. Also, anyone with wider concerns, based on appropriate reasons, including fraud, anti-money laundering or other concerns, could apply to the court for disclosures.

‘HKICS supports the government’s proposal as a fair compromise between the protection of data privacy and the right of the public to know,’ says Mohan Datwani, Director, Technical and Research, HKICS. ‘We are not completely persuaded by the argument that because directors chose voluntarily to be appointed that they should bare all, especially in terms of their residential addresses, and submit themselves to potential interference in their private and family lives, and other safety and identity related issues. Similar to legislation in other jurisdictions like Australia and the UK, where directors do go astray, certain specified persons and ultimately the court could order disclosure of the withheld information, which is eminently sensible and based on respect for the rule of law.’

The HKIoD views include the point that many companies and organisations in Hong Kong ask for their clients’ identity numbers in order to confirm their identity during telephone transactions. ‘The Hong Kong identity number is the most commonly used method to verify the personal identity of Hong Kong persons. Hong Kong identity card numbers are strictly personal. The disclosure of them may give rise to risk of computer wizards abusing such information for whatever purpose that can be detrimental to directors,’ the HKIoD stated. The HKGCC also supports the government’s amendments as being appropriate.

The case against

Those opposed to the new measures argue that they will be a retrograde step for Hong Kong which currently enjoys a relatively good reputation for transparency, certainly when compared to other jurisdictions in Asia. Few have opposed the measures restricting access to directors’ residential addresses, the opposition has focused on the importance of maintaining public access to the identity numbers of directors.

Opponents argue that, since it is relatively common for people in Hong Kong to have the same name, individuals seeking to pursue a remedy against the company and/ or its directors may only be able to identify the directors via their identity card numbers on the public register. In a submission to the original public consultation on the proposals in 2010, The Law Society of Hong Kong recommended that identity numbers should be ‘recorded and disclosed in full [because] persons with identical names are not uncommon’.

The Hong Kong Journalists Association has also pointed out that the proposed measures will be a serious limitation on investigative reporting. The measures, as currently drafted, make no mention of journalists in the list of persons who may apply for access to the withheld information. Earlier this year the Foreign Correspondents Club of Hong Kong posted an open letter calling on the government to withdraw the proposals.

Gordon Jones, Hong Kong’s former Registrar of Companies, pointed out in an article in the South China Morning Post (‘Black mark’ 13 February 2013) that directors have to surrender some personal privacy for the benefit of enjoying limited liability – this protects the interests of creditors, investors and all others who have dealings with the company. He added that the disclosure of identity numbers has not so far created a major problem of abuse. ‘A confidential register of directors’ residential addresses had to be introduced in Britain because the directors of certain companies and their families, particularly those involved in biological and medical research involving animals, were subject to very serious threats of harassment and intimidation by animal rights activists. These included physical violence and arson attacks. No such risk exists in Hong Kong and will, hopefully, never exist.’

With such strength of feeling on both sides of the argument, it is inevitable that this issue will continue to be debated in the full media glare until a final decision is made as to whether or not the legislative provisions are to take full effect.

More information relating to the disclosure of directors’ identity numbers can be found on the Financial Services and the Treasury Bureau website (www.fstb. gov.hk/fsb). The full text of the new Companies Ordinance is available for viewing and downloading on the Companies Registry website (www.cr.gov.hk).