Data privacy rights of transgender persons in Hong Kong – Protection of gender information on birth registers

Ariel Wong

Ariel Wong is an HKU law student enrolled in the LLB programme. 


Introduction

The right to privacy is guaranteed under Article 14 of the Hong Kong Bill of Rights. (“HKBORO”)

American scholar Lisa Mottet proposes that, when devising policies concerning the privacy of transgender persons, the government should “consider the impact of government disclosure on transgender people as well as constitutional privacy rights that may be implicated”. She suggests that an individual’s privacy right may be implicated if information regarding that individual’s gender assigned at birth (“birth gender”), history of gender transition, or transgender status is disclosed. [1] She further notes that the decision as to when and how one discloses one’s transgender status is a matter of individual choice, especially where disclosure of such information may entail potential discrimination and risk of violence. [2] 

In view of the importance of privacy to transgender persons particularly with regards to their gender history, this blog post argues that the current data protection laws in Hong Kong should be improved to better protect the data privacy rights of transgender persons, specifically on the issue of disclosure of the birth gender and gender transition history of transgender persons.

Current data protection laws in Hong Kong

Hong Kong passed the Personal Data (Privacy) Ordinance (Cap. 486, the “PDPO”) with an aim to protect citizens’ privacy and which is applicable to both the private and public sectors. The six Data Protection Principles (“DPPs”), contained in Schedule 1 of the PDPO, outline the manner in which personal data should be collected, retained and used. A data subject is an individual who provides the data, a data user is the party that collects, retains and uses such data.

Among them, DPP 3 is of particular relevance to the discussion in this blog post, which prohibits the use of personal data for any new purpose which is not or is unrelated to the original purpose upon collection of the data, unless with the data subject’s express and voluntary consent. [3] This provision guards against possible abuse or misuse of personal data by the data user, such as by leaking them to a third party without the consent of the data subject.

DPP 1 stipulates that personal data collection must be for “lawful” purposes, and the data collected should be “necessary, adequate but not excessive” for such purpose. The collection of personal data should also be via “lawful and fair” means. In that vein, DPP 5 requires data users to be open about their personal data policies and practices, the kind of personal data held and the main purposes for holding it.

Further, DPP 4 imposes an obligation on data users to ensure data security for their data subjects against unauthorised or accidental access, processing, erasure, loss or use. They must take reasonable practicable steps to guard the personal data they hold against any foreseeable “potential harm”.

Current situation relating to the disclosure of personal data of transgender persons

The present data privacy framework is insufficient in protecting the disclosure of gender history of transgender persons in Hong Kong. 

The gender history of transgender persons can be accessed by others without prior consent from the affected individual under the present birth records maintenance system. Under the present birth records maintenance system, anyone can apply to the Registrar of Births and Deaths for a search of an individual’s birth record (which contains the individual’s birth gender), as long as they state their relationship with the data owner and the purpose of acquiring such data. The biggest problem is no prescribed consent from the data subject is required for such use or disclosure of personal data about birth gender. Worse still, the data subject does not receive any notification from the Registrar of Births and Deaths if anyone requests for access to their birth records, let alone whether such requests are granted. The individual can be completely in the dark about such access.

Although the requirement of stating the searcher’s relationship with the data owner and purpose of search may serve as a screening mechanism for limiting access to the gender history of data owner, it is argued that the protection afforded by such mechanism is low, and falls short of fulfilling DPP 3 to prevent unconsented use of personal data for purposes other than those laid out upon collection. For instance, job applicants and employees are not obliged to disclose their gender history to their (potential) employers. However, companies or their human resources department may still be able to access the applicants or employees gender history through the present mechanism without obtaining the affected individuals’ consent, nor will the affected individuals be notified. 

It should be noted that the birth records are collected likely at a time when the individual is vastly underage as a newborn to make any legal decision. While the government may find reasonable and “lawful” justifications to collect such data in such a way with regards to DPP 1, again the standard for retention and (non-)dissemination does not seem to match the requirements in DPP 3 (i.e. acquisition of data owner’s consent) and DPP4 (i.e. data security).

Suggestions for better protection of gender history of transgender persons in Hong Kong 

To ensure confidentiality of gender history of transgender persons in Hong Kong, we recommend the Registrar of Births and Deaths may follow the practice adopted by the United Kingdom (“UK”) Registrar General in maintaining the UK birth register and the Gender Recognition Register (“GRR”) with slight modifications, understanding the UK operates a dual-register system while the Hong Kong system remains singular.

UK’s practice of maintaining gender history information 

A brief summary of the UK’s practice is as follows: [4]

Having adopted a gender recognition scheme under the Gender Recognition Act 2004, the UK Gender Recognition Panel (“GRP”) will issue a Gender Recognition Certificate (“GRC”) stating the individual’s legal gender (which may be different from that individual’s birth gender) after verification of medical reports and other evidence. At the same time, the individual’s legal gender will be entered into the GRR which is not open to public inspection or search. There will be no indication on the birth certificate of a change of gender, it will simply state the legal gender. 

In addition, under the Gender Recognition Act 2004, an offence is created for disclosing any gender recognition application or a person’s previous gender as may be reflected in any past employment, welfare or other records. Along with the offence-creating provision, the Gender Recognition (Disclosure of Information) Order 2010 prescribes the exceptional circumstances where such disclosure will not constitute an offence. The exemptions include disclosure for the purpose of obtaining legal advice (Art 3), disclosure for religious purposes (Art 4) or medical purposes (Art 5), disclosure by or on behalf of a credit reference agency (Art 6) and disclosure for purposes in relation to insolvency or bankruptcy (Art 7). [4]

Specific recommendations for Hong Kong

Firstly, Hong Kong can draw reference from UK’s practice of maintaining a separate register for the acquired gender of transgender persons who have undergone gender transition and which access to such register should be limited. Though it is acknowledged that presently, there is no gender recognition scheme in Hong Kong, the government can still formulate a mechanism that allows transgender persons who have undergone sexual reassignment surgery to register their acquired gender and maintain such gender information on the separate register. The UK’s practice of issuing new birth certificates bearing no indication of gender change history can also be followed. 

Secondly, the Registrar of Births and Deaths may consider raising the search requirements of birth records such that the search results will only be generated if the exact name and/or date of birth of the individual was provided. 

Thirdly, the PCPD may also consider creating a special provision under the current PDPO that criminalises disclosure of a person’s previous gender, subject to certain exceptional circumstances as may be stipulated. 

The above three recommended measures should help to reduce the risks of unwanted disclosure and privacy invasion targeting transgender persons, whereas data security is lacking in the current practice. 

Conclusion

In conclusion, Hong Kong’s present practice in maintaining its birth register subjects transgender persons to significant risks of exposing their gender history against their will. To better safeguard the data privacy rights of transgender persons, the Hong Kong government should refer to the UK’s practice to reform its birth register containing the gender history of all Hong Kong individuals. 

​References

[1] Lisa Mottet. (2013). Modernizing State Vital Statistics Statutes and Policies to Ensure Accurate Gender Markers on Birth Certificates: A Good Government Approach to Recognizing the Lives of Transgender People. Michigan Journal of Gender and Law, 19, 373 at 437.

[2] Ibid at 444.

[3] The Office of the Privacy Commissioner for Personal Data. The Personal Data (Privacy) Ordinance. https://www.pcpd.org.hk/english/data_privacy_law/ordinance_at_a_Glance/ordinance.html (last accessed on 25 Oct 2021)

[4] Home Office. (18 March 2021) Gender recognition: Guidance for Her Majesty’s Passport Office staff examining passport applications from customers who ask for a change of gender on their passport (Version 8.0) Retrieved from: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/974817/Gender_recognition_V8.pdf

​