New regime on restricting disclosure of directors personal data

In Hong Kong, directors and company secretaries of companies incorporated in Hong Kong (and registered non-Hong Kong companies) are currently required to state their residential addresses and identification document numbers ("ID numbers") in filings with the Companies Registry. This personal data can then be obtained by the public by accessing filings in person or online.

In light of concerns over personal privacy, a restricted disclosure regime was proposed when the new Companies Ordinance (Cap. 622) (the "CO") was drafted.  The proposed regime was incorporated in the CO but did not come into effect on the commencement of the CO in 2014 because of local objections at the time. Recently, the Financial Services and the Treasury Bureau and the Companies Registry have been reviewing these provisions and have made proposals to implement the regime and bring the relevant provisions in the CO into effect.  

The adoption of the regime will bring Hong Kong into line with a number of other jurisdictions which permit restricted public disclosure of company officer's personal information, such as the UK.

The new regime under the CO

The relevant provisions are set out in sections 47 to 59 of the CO, which seek to strike a reasonable balance between satisfying the public need to access information and the protection of privacy of directors and company secretaries. Under the new regime:

1. the residential address of a director and the full ID numbers of any person (the "Protected Information") will not be made available for public inspection on records at the Companies Registry or a company's own register, except as permitted by the CO;

2. only the correspondence addresses of the directors and company secretaries will be shown on the publicly available registers;

3. only certain digits of the ID numbers of individuals will be shown on the publicly available registers;

4. the Protected Information already available on the records at the Companies Registry will be withheld from public inspection only upon application and payment of a fee;

5. the Registrar of the Companies Registry (the "Registrar") may use and disclose the residential address information if it cannot effectively communicate with the director using the correspondence address provided;

6. specified persons prescribed by subsidiary regulation may apply to the Registrar for disclosure of the Protected Information; and

7. a creditor or any other person appearing to the Court to have a sufficient interest may apply to the Court for an order for the disclosure of the Protected Information.

Under the draft subsidiary legislation Companies (Residential Addresses and Identification Numbers) Regulation published in 2012, the specified persons who may apply to the Registrar for disclosure of the Protected Information include the data subject themselves; persons authorised by the data subject; members of the company; liquidators; a trustee in bankruptcy; and public officers and public bodies.

The proposed new regime is similar to the approach adopted in the UK, where directors are permitted to provide a service address for public inspection and their residential address is kept on a separate record to which access is restricted to specified public authorities and credit reference agencies.

Progress of implementing the new regime

The discussion on the implementation of the new regime by the Legislative Council Panel on Financial Affairs was held on 9 April 2021. As the full operation of the new regime will require substantial system and operational modifications at the Companies Registry, the proposal is for the new regime to be implemented in phases.  

The CO provisions limiting disclosure of Protected Information in company's own registers will take effect as soon as possible and the provisions limiting disclosure of Protected Information on documents filed with the Registrar will commence in October 2022.  The remaining CO provisions (including the ability to apply to the Registrar to withholding Protected Information already available at the Companies Registry) will commence in December 2023. In addition, it is proposed that the subsidiary legislation for the new regime will be introduced into the Legislative Council in May 2021.