1
UBS AG Hong Kong Branch
52/F, Two International Finance Centre,
8 Finance Street, Central,
Hong Kong
Allen & Overy
9th Floor Three Exchange Square
Central
Hong Kong SAR
China
Tel
+852 2974 7000
Fax
+852 2974 6999
Our
ref
CHLR/WWLL
/
0036335
-
0000808
20 October 2021
Dear Sir or Madam
UBS AG Hong Kong Branch SEC registration as a non-resident security-based swap dealer
1.
BACKGROUND
1.1
We understand that UBS AG (
UBS
), a bank authorised in Switzerland, is seeking to register with the
United States (
US
) Securities and Exchange Commission (
SEC
) as a non-resident security-based swap
(
SBS
) dealer (
SBSD
).
1.2
To register as an SBSD with the SEC, a non-resident SBSD
1
counsel to Form SBSE, SBSE-A or SBSE-BD affirming that the SBSD can, as a matter of law:
(a)
provide the SEC with prompt access to the relevant books and records as defined in paragraphs
3.3 and 3.4 (
Covered Books and Records
); and
(b)
submit to on-site inspection and examination of its Covered Books and Records by the SEC
(
On-Site Inspection
).
1
In the case of a corporation, an SBSD will be “non
-
resident” if it is incorporated in or has its principal place of business in any place not in
the United States (see 17 Code of Federal Regulations (
CFR
) § 240.15Fb2-4(a)(2)). As UBS is incorporated in Switzerland, UBS fulfils this
definition of a “non-resident” SBSD.
Managing Partner, Hong Kong
Vicki Liu
Partners
Registered Foreign Lawyers
Matthew J.
Bower
Jonathan C.H. Hsui
Roger S.W.Y. Lui
Yvonne E.M. Siew
Eugene T. Chen
2,3
Ian Chapman
Tsui Miu Jing
Simon G. Makinson
Ross A. Stewart
Victor G.H. Ho
2
Fai Hung Cheung
Hui Ting Joanne Lau
William J. McAuliffe
Agnes S.W. Tsang
Jun Kwon Lee
1, 2
Guanyu Fang
Lina Lee
David
A.
Norman
Patrick P.H. Wong
Stephen M. Miller
1
James Ford
Kung
-
Wei Liu
François A.C. Renard
Richard M. Woodworth
Matthew J. Hodgson
Cindy H.Y. Lo
Charlotte J.G. Robins
1 Admitted to practise in England and Wales
2 Admitted to practise in California
3 Admitted to practise in Washington DC
Allen & Overy is affiliated with Allen & Overy LLP, a limited liability partnership registered in England and Wales with registered office at One Bishops Square, London E1 6AD.
Allen & Overy LLP or an affiliated undertaking has an office in each of: Abu Dhabi, Amsterdam, Antwerp, Bangkok, Beijing, Belfast, Bratislava, Brussels, Budapest, Casablanca, Dubai,
Düsseldorf, Frankfurt, Hamburg, Hanoi, Ho Chi Minh City, Hong Kong, Istanbul, Jakarta (associated office), Johannesburg, London, Los Angeles, Luxembourg, Madrid, Milan, Moscow,
Munich, New York, Paris, Perth, Prague, Rome, São Paulo, Seoul, Shanghai, Silicon Valley, Singapore, Sydney, Tokyo, Warsaw, Washington, D.C. and Yangon.
2
1.3
UBS will maintain certain Covered Books and Records in its Hong Kong branch (
UBSHK
), which is
a licensed bank authorised by the Hong Kong Monetary Authority (
HKMA
),
and a registered
institution registered with the Securities and Futures Commission (
SFC
) in Hong Kong.
1.4
You have asked us to issue an opinion affirming that UBSHK will be able to provide the SEC with
prompt access to its books and records and submit to On-Site Inspection by the SEC in accordance
with paragraph 1.2 above.
1.5
This opinion is structured as follows:
(a)
Section 2: summary of opinion;
(b)
Section 3: scope, assumptions and qualifications;
(c)
Section 4: revisions to applicable law;
(d)
Section 5: reliance and confidentiality;
(e)
Annex 1: Opinion; and
(f)
Annex 2: Assumptions.
1.6
For the purposes of this opinion, the legal or natural person imparting the information subject to the
duty of confidentiality will be the
Rights Holder
and the person receiving that information, in this
case UBSHK, will be the
Recipient.
2.
SUMMARY OF OPINION
Subject to the assumptions and qualifications below it is our opinion that:
2.1
UBSHK can, as a matter of applicable Hong Kong law, submit to On-Site Inspection by the SEC.
There is no restriction on UBSHK submitting to On-Site Inspection by the SEC. The remainder of
this opinion focuses on UBSHK’s ability to disclose information contained in Covered Books and
Records to the SEC in the course of On-Site Inspection in Hong Kong and the ability to provide the
SEC with prompt access to Covered Books and Records.
2.2
UBSHK can, as a matter of applicable Hong Kong law, provide the SEC with prompt access to
Covered Books and Records held by UBSHK in Hong Kong.
2
Data protection
2.3
Disclosures of personal data relating to UBSHK’s clients and staff are subject to certain restrictions
under the Personal Data (Privacy) Ordinance (Cap. 486) (
PDPO)
. Provided that a data user (e.g.,
UBSHK) in Hong Kong controls the collection, holding, processing or use of personal data then the
PDPO applies.
2.4
Under the PDPO, there the six data protection principles (
DPP
) that UBSHK, as a data user, must
comply with. In particular, DPP 3 is directed against the misuse of personal data and sets out that
personal data shall not, without UBSHK’s clients’ and staff’s prescribed consent, be used for any
purpose other than the purpose for which the data was to be used at the time of the collection of the
data or a purpose directly related to the purpose at the time of collection. In this regard, “prescribed
consent” means consent that is expressly and voluntarily given and has not been withdrawn by
UBSHK’s clients and staff in writing.
2
Whe
re a restriction on the ability to transfer personal data or to disclose confidential information applies, consent from the R
ights Holder,
validly given in accordance with the relevant standard for consent under each applicable legal obligation, would allow for such information
to be lawfully transferred to the SEC or disclosed to the SEC during On-Site Inspection. Please note that valid consent is assumed in
Assumption
0036335-0000808 UKO1: 2005333372.8
3
2.5
Therefore, the disclosure and transfer of personal data to the SEC in the US would require UBSHK’s
clients’ and staff’s prescribed consent under DPP 3 if such use was not stipulated in a notification
given to its clients and staff – commonly known as the personal information collection statement
(
PICS
) – provided at the time the personal data was collected.
Common law duties of confidentiality
2.6
The general duty of confidentiality applies to non-public information held or controlled by UBSHK
that relates to any person. The banker’s duty of confidentiality arises due to the nature of the
relationship between a banker and their customer (and this duty does not apply to information held or
controlled by UBSHK that relates to any person other than its customers). Finally, every employment
relationship held by UBSHK contains an implied legal duty of mutual confidence, however, this is
very narrow in scope and is unlikely to apply where UBSHK is making disclosures to the SEC in the
normal course of its SBS business and in accordance with SEC requirements.
2.7
Disclosure with consent, or under another recognised exception, would not amount to a breach of these
legal duties.
2.8
These duties of confidentiality will not apply to any information contained in the Covered Books and
Records or to On-Site Inspection insofar as information made available to the SEC is owned by or
relates to UBSHK itself, rather than owned by or relating to UBSHK’s clients or, in the case of the
general and employer’s duties only, its staff.
2.9
In this regard, reliance on valid consent would establish certainty that the duties of confidentiality have
been overcome. Alternatively, it may be possible, where the information held relates to clients, to rely
on the own interest exception to the banker’s (but not general or employer’s) duty of confidentiality.
However, as this requires a case -by-case balancing of the competing factors in favour of each of the
bank and the Rights Holder, this will provide a less reliable basis for disclosure than the bases noted
above. However, absent consent and the own interest exception, and because the public interest
exception is yet to receive formal judicial recognition in Hong Kong, UBSHK may, as a last resort,
consider seeking a court order prior to permitting the SEC to access its Covered Books and Records
and to conduct On-Site Inspection of UBSHK.
Privacy
and
human rights
2.10
At present, there is no stand-alone basis to bring a claim for ‘invasion of privacy’ under Hong Kong
law. Article 14 of the Hong Kong Bill of Rights Ordinance (Cap. 383) (
BOR
) states that no person
shall be subjected to “
arbitrary or unlawful interference with his privacy, family, home or
correspondence
”, and that everyone has the right to the protection of the law against such interference.
2.11
Insofar as remedies are concerned however, the BOR only binds the Hong Kong government and
public authorities. The right to privacy under the BOR cannot be enforced against private persons.
3
Accordingly, Article 14 affords no protection to UBSHK’s staff or clients whose right of privacy has
been infringed by UBSHK, being a private person.
This summary opinion is not a substitute for the full expression of our views set out in Annex 1.
3
In
Tam Hing Yee v Wu Tai Wai
[1992] 1 HKLR 185
, the court ruled that the BOR does not apply to litigation involving only private citizens
and therefore consistency of a statutory provision with the BOR cannot be challenged in such proceedings.
0036335-0000808 UKO1: 2005333372.8
4
3.
SCOPE, ASSUMPTIONS AND QUALIFICATIONS
3.1
This opinion relates solely to access provided to the SEC of Covered Books and Records held by
UBSHK in Hong Kong and On-Site Inspection of UBSHK by the SEC in Hong Kong. This opinion
applies equally to remote access from the US to Covered Books and Records held in Hong Kong. This
opinion excludes books and records held in the US.
3.2
This opinion has been prepared in accordance with UBS’s specific instructions as to the scope of the
opinion. For this purpose you have issued us with guidance from a third party US law firm which we
have used to inform the scope of our opinion.
3.3
This opinion only covers access to and the On-site Inspection of Covered Books and Records. Covered
Books and Records include only those books and records which:
(a)
relate to the US business
4
5
SBS that is either:
(i)
entered into, or offered to be entered into, by or on behalf of the non-resident SBSD,
with a “U.S. Person” as defined in 17 CFR § 240.3a71-3(a)(4)
6
US Person
) (other
than an SBS conducted through a foreign branch of such US Person
7
); or
(ii)
arranged, negotiated, or executed by personnel of the non-resident SBSD located in a
branch in the US (
US branch
) or office or by personnel of an agent of the non-resident
SBSD located in a US branch or office;
8
(b)
constitute financial records necessary for the SEC to assess the non-resident SBSD’s
compliance with the SEC’s margin and capital requirements, if applicable.
9
3.4
Further to Assumption 1, this opinion is limited to those types of records that are relevant to
prudentially regulated SBSDs, which excludes financial records as noted in paragraph 3.3(b) above.
For this opinion, the term “Covered Books and Records” extends to these record types alone.
3.5
The issues addressed in this opinion apply equally across the different document types which constitute
the Covered Books and Records based upon the information actually contained in each of the relevant
Covered Books and Records. We have not examined any such documents or records.
3.6
In giving this opinion, we have made the further assumptions set out in Annex 2.
3.7
No opinion is expressed on matters of fact.
4
As defined in 17 CFR §240.3a71
-
3(a)(8).
5
Cross
-
Border Application of Certain [SBS] Requirements, 85 Fed. Reg. 6270, 6296 (Feb. 4, 2020) (the
SEC Guidance
).
6
A “U.S. person” means any person that is “(i) a natural person resident in the U.
S.; (ii) a partnership, corporation, trust, investment vehicle,
or other legal person organized, incorporated, or established under the laws of the United States or having its principal place of business in
the United States; (iii) an account (whether discretionary or non-discretionary) of a U.S. person; or (iv) an estate of a decedent who was a
resident of the United States at the time of death.” 17 CFR § 240.3a71-3(a)(4).
7
A “foreign branch” means “any branch of a U.S. bank if: (i) the branch is located
outside of the United States; (ii) the branch operates for
valid business reasons; and (iii) the branch is engaged in the business of banking and is subject to substantive banking regulation in the
jurisdiction where located.” (17 CFR § 240.3a71-3(a)(2)). An “SBS conducted through a foreign branch” means an SBS that is “arranged,
negotiated, and executed by a U.S. person through a foreign branch of such U.S. person if: (A) the foreign branch is the counterparty to such
security-based swap transaction; and (B) the security-based swap transaction is arranged, negotiated, and executed on behalf of the foreign
branch solely by persons located outside the United States.” (17 CFR § 240.3a71-3(a)(3)(i)).
8
17 CFR § 240.3a71
-
3(a)(8)(i)(B).
9
The requirement set o
ut in this paragraph
requirements as it is assumed that UBSHK is a prudentially regulated SBSD – please see the assumptions set out in
0036335-0000808 UKO1: 2005333372.8
5
4.
REVISIONS TO APPLICABLE LAW
4.1
We note that the SEC rules
10
changes in the legal or regulatory framework that would:
(a)
impact the ability of the SBSD to provide prompt access to its Covered Books and Records;
(b)
impact the manner in which it would provide prompt access to its Covered Books and Records;
or
(c)
impact the ability of the SEC to conduct On-Site Inspections.
4.2
Upon a change in law or regulatory framework of the sort outlined in paragraph 4.1 above, the SBSD
is required to submit a revised opinion describing how, as a matter of law, the SBSD will continue to
meet its obligations.
4.3
This opinion relates solely to the laws of Hong Kong in force as at the date of this opinion. We have
no obligation to notify any addressee of any change in any applicable law or its application after the
date of this opinion.
5.
RELIANCE AND CONFIDENTIALITY
5.1
This opinion is given for the sole benefit of the addressee. It may not be relied upon by anyone else
without our prior written consent.
5.2
This opinion is not to be disclosed to any person outside of UBS AG’s group or used, circulated,
quoted or otherwise referred to for any other purpose. However, we agree that a copy of this opinion
letter may be disclosed:
(a)
where disclosure is required or requested by any governmental, banking, taxation or other
regulatory authority or similar body having jurisdiction over UBS AG (including to the SEC
as part of UBS AG’s SBSD registration application) or by the rules of any relevant stock
exchange or pursuant to any applicable law or regulation; and
(b)
to UBS AG’s affiliates, and any of their officers, directors, employees, auditors, insurers,
reinsurers, insurance brokers and professional advisors (in their capacity as such).
5.3
Any such disclosure must be made on the basis that it is for information purposes only, no recipient
may rely on this advice, no client-lawyer relationship between us and the recipient arises following,
or as a result of, any such disclosure. We assume no duty or liability to any recipient, and any recipient
under paragraph 5.2(b) above will be subject to the same restrictions on disclosure as set out above.
5.4
We assume no obligation to advise you or any other person or to make any investigations as to any
legal developments or factual matters arising subsequent to the date hereof that might affect the
opinions expressed herein.
Yours faithfully,
Allen & Overy
10
17 CFR §
240.15Fb2
-
4(c)(2).
0036335-0000808 UKO1: 2005333372.8
6
ANNEX 1
OPINION
1.
DATA PROTECTION
1.1
The PDPO will apply to UBSHK’s disclosure of Covered Books and Records to the SEC to the extent
that these comprise or contain personal data. “Personal data” is data relating directly or indirectly to
a living individual, from which it is practicable for the identity of the individual to be directly or
indirectly ascertained and in a form in which access to or processing of the data is practicable, so may
extend to information on UBSHK staff as well as clients.
1.2
Key restrictions in the PDPO relating to UBSHK’s ability to disclose personal data to the SEC are set
out below.
Legal basis for the disclosure
1.3
Pursuant to section 4 of the PDPO, a “data user” must not do an act, or engage in a practice, that
contravenes a DPP save as required or permitted under the PDPO. A “data user”, in relation to
“personal data”, means a person who, either alone or jointly or in common with other persons,
“
controls
the collection, holding, processing or use
” of the data. In particular, the word “use” is defined
to mean “
in relation to personal data, includes disclose or transfer the data”
. Note that the PDPO
does not have extra-territorial application and only applies to data users who control the collection,
holding, processing or use of “personal data” in Hong Kong.
11
collection, holding, processing or use of personal data in Hong Kong and is “data user” under the
PDPO.
1.4
Of note, the PDPO does not (currently) regulate the transfer of personal data to places outside of Hong
Kong.
12
1.5
Schedule 1 of the PDPO sets out the six DPPs, namely:
(i)
Principle 1—purpose and manner of collection of personal data (
DPP 1
);
(ii)
Principle 2—accuracy and duration of retention of personal data;
(iii)
Principle 3—use of personal data (
DPP 3
);
(iv)
Principle 4—security of personal data;
(v)
Principle 5—information to be generally available; and
(vi)
Principle 6—access to personal data.
Applicable DPPs
1.6
In the event that UBSHK is required to disclose any personal data to the SEC, DPP 3, which governs
the use of personal data, is most relevant for UBSHK as a data user. As mentioned, disclosure also
amounts to “use” and therefore, any improper use (including disclosure or transfer) of personal data
by the data user may contravene the requirements under DPP 3.
11
However, control would not be lost or vitiated even if disclosure would be required under compulsion of law, if any, so long
as such person
had control over the relevant personal data in the first place (see AAB No. 16/2007, a case decided by the Administrative Appeals Board
that hears and determines appeals lodged against PCPD’s enforcement decisions).
12
See
discussion on section 33 of the PDPO below.
0036335-0000808 UKO1: 2005333372.8
7
1.7
In order not to contravene DPP 3, the use of personal data must be for a purpose:
(a)
that is the same as the purpose for which the data was to be used at the time of their original
collection by the data user;
(b)
directly related to the original purpose of collection; or
(c)
to which the “prescribed consent”
13
1.8
Separately, in situations where the use of personal data for purposes unrelated to the original purpose
of collection is necessary, and the prescribed consent of the data subject is not possible (e.g., in
reporting of evidence of crime to the law enforcement agencies), then Part 8 of the PDPO contains
relevant provisions exempting personal data from the application of DPP 3 in certain circumstances
(see paragraph 1.15 below).
Original Purpose
1.9
In ascertaining what amounts to the original purpose of collection, one major factor would be the
purpose of collection as stated in the notification given to the data subject under DPP1 – commonly
known as the Personal Information Collection Statement (
PICS
).
1.10
In particular, under DPP 1(3)(b)(i), the individual must be, on or before the collection of the data,
explicitly informed of:
(a)
the purpose (in general or specific terms) for which the data are to be used; and
(b)
the classes of persons to whom the data may be transferred.
1.11
In this regard, the data subject’s reasonable expectation on the data user’s use of his personal data
would also be a major factor to determine whether or not it relates directly to the original purpose.
14
1.12
Therefore, whether UBSHK would be able to disclose personal data to the SEC depends on whether
disclosure to the SEC was the same as the purpose for which the data was to be used at the time of its
original collection or directly related to the original purpose of collection.
Prescribed Consent
1.13
Section 2(3) of the PDPO defines “prescribed consent” to be an express consent given voluntarily and
consent that has not been withdrawn by notice in writing.
15
or omission would not be sufficient and should not be deemed given by silence or no objection.
1.14
If UBSHK is able to obtain prescribed consent from its staff or clients then it would be able to disclose
such personal data to the SEC.
Part 8 Exemptions
1.15
Part 8 of the PDPO provides for exemptions to, among others, DPP 3 where use of the personal data
is for certain exempted purpose(s) and the data user has reasonable grounds to believe that failure to
so use the personal data would prejudice the exempted purpose(s).
13
See paragraph
14
In
Data Protection Principles in the Personal Data (Privacy) Ordinance – from the Privacy Commissioner’s perspective (2nd Edition)
, the
PCPD notes an example where data subject would have reasonable expectation that his data provided in an account opening form would be
used for purposes related to his application for service, but not for any other unrelated purposes, for instance selling the data to third parties
15
Section 2(3) states that “Where under this Ordinance an act may be done with the prescribed consent of a person (and howsoeve
r the person
is described), such consent – (a) means the express consent of the person given voluntarily; (b) does not include any consent which has been
withdrawn by notice in writing served on the person to whom the consent has been given (but without prejudice to so much of that act that
has been done pursuant to the consent at any time before the notice is so served).”
0036335-0000808 UKO1: 2005333372.8
8
1.16
Of note, the Part 8 exemptions do not require the data user to disclose or use the personal data for the
exempted purpose(s) but it is only to be invoked by the data user to justify the use of personal data as
“permitted” under section 4 of the Ordinance.
1.17
Among the Part 8 exemptions, the most relevant in this case would be section 58 of the PDPO. Section
58(1) and (2) state that:
“(1) Personal data held for the purposes of—
(a) the prevention or detection of crime;
(b) the apprehension, prosecution or detention of offenders;
(c) the assessment or collection of any tax or duty;
(d) the prevention, preclusion or remedying (including punishment) of unlawful or seriously
improper conduct, or dishonesty or malpractice, by persons;
(e) the prevention or preclusion of significant financial loss arising from—
(i)any imprudent business practices or activities of persons; or
(ii) unlawful or seriously improper conduct, or dishonesty or malpractice, by persons;
(f) ascertaining whether the character or activities of the data subject are likely to have a
significantly adverse impact on any thing—
(i) to which the discharge of statutory functions by the data user relates; or
(ii) which relates to the discharge of functions to which this paragraph applies by
virtue of subsection (3); or
(g) discharging functions to which this paragraph applies by virtue of subsection (3),
is exempt from the provisions of data protection principle 6 and section 18(1)(b) where the
application of those provisions to the data would be likely to—
(i)prejudice any of the matters referred to in this subsection; or
(ii)directly or indirectly identify the person who is the source of the data.
(2)Personal data is exempt from the provisions of data protection principle 3 in any case in
which—
(a) the use of the data is for any of the purposes referred to in subsection (1) (and whether or
not the data is held for any of those purposes); and
(b) the application of those provisions in relation to such use would be likely to prejudice any
of the matters referred to in that subsection,
and in any proceedings against any person for a contravention of any of those provisions it
shall be a defence to show that he had reasonable grounds for believing that failure to so use
the data would have been likely to prejudice any of those matters.”
0036335-0000808 UKO1: 2005333372.8
9
1.18
To summarise, exemption from DPP 3 is available under section 58(2) for the purposes specified in
section 58(1)
and
specified in section 58(1).
1.19
We understand that disclosure to the SEC is, at least in part and/or for certain types of records, for the
purposes of preventing fraud or crime (e.g., records relating to transactions and persons involved in
transactions), further supporting this view.
1.20
Therefore, the most relevant limbs under section 58(1) may be paragraphs (a) (the prevention or
detection of crime), (b) (the apprehension, prosecution or detention of offenders), and (d) (the
prevention, preclusion or remedying (including punishment) of unlawful or seriously improper
conduct, or dishonesty or malpractice, by persons).
1.21
As regards paragraphs (a) and (b), the Administrative Appeals Board has previously decided that it
only applies to crimes and offences under Hong Kong law and therefore violation of foreign laws
would not be sufficient.
16
apply to situations that occur outside Hong Kong and UBSHK may be unlikely to rely on any unlawful
and seriously improper conduct that occurred outside Hong Kong or in accordance to foreign laws in
order to satisfy section 58(2).
1.22
In addition, even if any of the purposes under section 58(1) apply, UBSHK would have to prove that
the effect of such failure to disclose data to the SEC would be “likely to prejudice” any such matters
(as required by section 58(2)(b)). In this regard, the Office of the Privacy Commissioner for Personal
Data (
PCPD
), the statutory body enforcing the PDPO, has recommended that in case of doubt, it is
prudent for the data user to ask the law enforcement agency why the data was considered necessary
and also how the failure to use such data would be likely to prejudice the intended purpose.
17
International transfers
1.1
As mentioned previously, the PDPO does not have extra-territorial application and only applies to data
users who control the collection, holding, processing or use of “personal data” in Hong Kong.
Furthermore, the PDPO does not (currently) regulate the transfer of personal data to places outside of
Hong Kong.
18
2.
COMMON LAW DUTIES OF CONFIDENTIALITY
2.1
The general banker’s and employer’s duties of confidentiality are distinct duties. However, the case
law on each duty informs the approach to the other, with the banker’s and employer’s duties existing
in acknowledgement of the specific circumstances that arise as between a bank and its customers or
employees (respectively). Given the common law position on these duties is largely aligned, these are
dealt with together here.
19
16
AAB No. 16/2007
17
Data Protection Principles in the Personal Data (Privacy) Ordinance – from the Privacy Commissioner’s perspective (2nd Edition)
,
paragraph 12.43.
18
For completeness, section 33 of the PDPO restricts the transfer of personal data to a place outside Hong Ko
ng unless one of the specified
conditions is met. However, section 33 has yet to be brought into force since its enactment in 1995 and there is no timeline indicated by the
Hong Kong government as to when section 33 may come into force.
19
The vast
majority of common law principles cited in this legal opinion remain based on English case law. In considering the constituti
onality
and binding effect of these English cases, it was held in
A Solicitor (FACV 24/07) v Law Society of Hong Kong
that:
(a)
after 1 July 1997, Article 8 of the Basic Law provides that the laws previously in force in Hong Kong (i.e., the common law,
rules of equity, ordinances, subordinate legislation and customary law) shall be maintained except for any that contravene the
Basic Law and subject to any amendment by the Hong Kong legislature;
(b)
prior to 1 July 1997, decisions of the Privy Council functioning as the final appellate court in Hong Kong remains binding on
all
the courts in Hong Kong;
(c)
pri
or to 1 July 1997, decisions of the House of Lords were not binding in Hong Kong but, like Privy Council decisions on appeal
from other jurisdictions, had considerable persuasive authority. Unless local circumstances were material, the Privy Council,
sharing essentially common membership with the House of Lords, on an appeal from Hong Kong was unlikely to diverge from
a decision of the House of Lords;
(d)
after 1 July 1997 the establishment of the Hong Kong Court of Final Appeal introduced a new constituti
onal order. Article 84 of
the Basic Law expressly provided that the courts in Hong Kong might refer to precedents of other common law jurisdictions and
the Hong Kong courts should continue to derive assistance from overseas jurisprudence. Bearing in mind that historically Hong
Kong’s legal system originated from the British legal system, decisions of the Privy Council and House of Lords should be treated
10
2.2
Where Covered Books and Records do not contain any relevant forms of information, and it is likely
that many aspects of the information required will not (e.g., transaction data such as volumes and
prices), these duties of confidentiality will not apply.
Scope of duties
2.3
The leading case on the common law duty of confidentiality is
Coco v AN Clark (Engineers) Ltd
[1968] F.S.R. 415, which was applied by the Hong Kong Court of First Instance in
AXA China Region
Insurance Co Ltd v Pacific Century Insurance Co Ltd
[2003] 3 HKC 1. This case established that to
be protected under the common law of confidentiality, two requirements must be met. Firstly, the
information must have the “
necessary quality of confidence
”.
20
been given in a situation which imposed an obligation of confidence.
(a)
The necessary quality of confidence is negatively defined as information which is not “
public
property and public knowledge
”.
21
Records is not publicly available, it will likely possess this necessary quality of confidence
insofar as that information relates to UBSHK’s clients or staff and is not information owned
by or relating to UBSHK itself.
(b)
To be protected under the common law duty of confidentiality, the information must have
been communicated in a situation where an obligation of confidence was either expressly or
impliedly imposed.
22
or ought to have known, that there was a duty of confidentiality attached to that information.
This duty of confidentiality can be imposed by contract, implied by the circumstances of the
disclosure, or implied by a special relationship of the parties.
(c)
Where, and to the extent that, the Covered Books and Records concern either customer
information or employee information, this would likely satisfy the requirement that the
Recipient, in this case being UBSHK, knew or ought to have known that the information was
to be treated confidentially.
2.4
In Hong Kong, the common law banker’s duty of confidence, established by
Tournier v National
Provincial and Union Bank of England
[1924] 1 KB 461 (
Tournier
), is one such instance where a
special relationship exists between the parties. Under this duty of confidence, banks, such as UBSHK,
must keep their customers’ affairs private – in this respect the general duty is broader than the banker’s
duty as the general duty extends to benefit others, such as UBSHK’s staff.
(a)
The scope of the duty is wide – as Atkin LJ outlined in the judgment:
“
It
[the duty of confidentiality]
clearly goes beyond the state of the account, that is, whether
there is a debit or credit balance, and the amount of the balance. It must extend at least to all
the transactions that go through the account, and to the securities, if any, given in respect of
the account
”.
23
with great respect. Their persuasive effect would depend on all relevant circumstances including, in particular, the nature of the
issue and the similarity of any relevant statutory or constitutional provision.
20
Megarry J in the
Coco v AN Clark (Engineers) Ltd
Engineering Co Ltd v Campbell Engineering Co Ltd
21
Saltman Engineering Co Ltd v Campbell Engineering Co Ltd
22
Megarry J in
Coco v AN Clark (Engineers) Ltd
23
Tournier v National Provincial and Union Bank of England
[1924] 1 KB 461 at 485.
0036335-0000808 UKO1: 2005333372.8
11
(b)
The temporal scope of the banker’s duty is also wide. Atkin LJ judged that the banker’s duty
of confidentiality “
extend
[s]
beyond the point when the account is closed, or cease
[s]
active account
”,
24
another within the same corporate group.
25
2.5
While an employer’s duty of confidence under common law does exist,
26
will only be restricted in its use of information held in relation to its employees “
where there is no
reasonable and proper cause for the employer
[’]
s conduct and only then if the conduct is calculated
to destroy or seriously damage the relationship of trust and confidence.
”
27
2.6
No distinction is drawn in the case law on either of the general or banker’s duties regarding the nature
of the person to whom the duty is owed – i.e. a natural or a legal person – and so we consider that the
duties apply equally to any person irrespective of their legal status. The employer’s duty can clearly
be owed only to a natural person.
Unauthorised disclosure
2.7
A successful claim for breach of confidentiality must demonstrate that there has been an unauthorised
use of confidential information to the detriment of the Rights Holder.
28
2.8
For those Covered Books and Records that contain customer information, which is unlikely to include
all Covered Books and Records, these duties of confidentiality will apply and so UBSHK will only be
able to disclose Covered Books and Records containing confidential information in un-redacted form
where one of the exceptions below is met.
2.9
Tournier
established four exceptions to the banker’s duty of confidentiality,
29
apply equally to the general and employer’s duties of confidentiality:
(a)
where the disclosure is made by the express or implied consent of the customer;
(b)
under compulsion of law;
(c)
where the disclosure is in the public interest; or
(d)
for the banker’s duty of confidentiality only, where it is in the interests of the bank to make
disclosure.
Consent
2.10
Disclosure of confidential information is permissible where the Rights Holder
31
to the disclosure of their confidential information.
32
24
Tournier v National Provincial and Union Bank of England
[1924] 1 KB 461 at 485.
25
Bank of Tokyo Ltd v Karoon
[1987] 1 AC 45 at 54.
26
Hui King Fai
v Hong Kong Council of Social Service
[2017] 6 HKC 350 at 36;
Semana Bachicha v Poon Shiu Man
[2000] 3 HKC 452 at
469.
27
Malik v Bank of Credit and Commerce International SA
Semana
Bachicha v Poon Shiu Man
[2000] 3 HKC 452.
28
Megarry J in
Coco v AN Clark (Engineers) Ltd
[1968] F.S.R. 415at 421.
29
Tournier v National Provincial and Union Bank of England
[1924] 1 KB 461 at 485 at 473.
30
For the general duty of confidentiality: This was confirmed by Arnold J in
Primary Group (UK) Ltd v The Royal Bank of Scotland Plc
[2014]
R.P.C. 26
at 246.
31
Where the banker’s duty of confidentiality applies this will be the customer.
32
Due of the overlap between bank confidentiality and
the PDPO
it would be advisable to clarify when obtaining consent that another, separate,
legal basis applied to the processing of the personal data under the PDPO.
0036335-0000808 UKO1: 2005333372.8
12
Compulsion of law
2.11
Information that would otherwise be confidential may be disclosed when required by a statutory
provision
33
34
FDC Co Ltd and Others v The
Chase Manhattan Bank, N.A.
[1990] 1 HKLR 277 that the compulsion of law exception only applies
to Hong Kong law and did not include a foreign law.
of a foreign court will not release a bank from its duty of secrecy to its customer where that duty is
governed by the law of Hong Kong.
2.12
Therefore, to satisfy this compulsion of law UBSHK would have to rely on Hong Kong statute – a
provision of US law, such as an SEC Rule, is unlikely to be sufficient for this purpose. While there
are numerous statutory provisions that require the disclosure of information that would otherwise be
confidential, none applies directly to this situation.
2.13
Equally, a US court order is also unlikely to be sufficient for this purpose: it was held in
X AG and
others v A bank
[1983] 2 All ER 464 at 475 that a subpoena requiring disclosure issued by a foreign
court did not qualify as compulsion by law on the basis that “[t]
he fact is that confidentiality is not
rendered illegal by a subpoena requiring disclosure, which is to be contrasted with some form of
legislation to that end
”. The facts in
FDC Co Ltd v The Chase Manhattan Bank, N.A.
277
36
X AG and others v A bank
[1983] 2 All ER 464, where, as noted, it
was held by that the first qualification, compulsion of law, applied only to a Hong Kong law and did
not include a foreign law.
37
For completeness, while it is possible to rely on implied consent, there is likely to be a high bar to meet in order to do so. In
Turner v Royal
Bank of Scotland Plc
[1999] 2 All E.R 664, regarding the banker’s duty of confidentiality, it was decided that established market practice of
sharing of customer information between banks (which practice was generally known only to the banks themselves) did not amount to
implied consent of the customer as this practice was not known by the customer. To amount to implied consent, the practice under which
disclosure is made must be “
notorious, certain and reasonable
” (
Turner v Royal Bank of Scotland Plc
[1999] 2 All E.R 664 at 670, Sir
Richard Scott VC quoting from
Chitty on Contracts
The practice of sharing information with local regulators in order to enable banking business to be conducted within the relevant local
jurisdiction is, in our experience, well established such that it might be considered “
notorious, certain and reasonable
”. In this context, it is
possible that much of the information contained in the Covered Books and Records would be information of a sort that customers (and
particularly more sophisticated customers of the kind that would normally be offered services by UBSHK in respect of SBSs) may expect
would be shared with the SEC.
In part, the ability to rely on implied consent will depend on the information provided to customers when UBSHK provides services in SBSs.
If no information about the jurisdiction or regulators involved is provided then UBSHK would rely on the customer’s own understanding of
regulatory obligations on banks, the US nexus and the SEC’s role in these services. Conversely, if customers are informed that UBSHK’s
activity in SBSs is conducted on a cross-border basis into the US and is subject to oversight by the SEC then the ability to rely on implied
consent increases. Similarly, if customers are informed that de tailed information on all aspects of UBSHK’s activity in SBSs is subject to
examination by the SEC then the ability to rely on implied consent increases further still.
33
See the example given by Bankes LJ in
Tournier v National Provincial & Union Bank
Evidence Act 1879. In Hong Kong, various ordinances and subsidiary legislation set out provisions requiring disclosure under compulsion
by statute.
34
For the general duty of confidentiality: compulsion by an or
der of a Hong Kong court includes a mareva (freezing injunction) under the
High
Court Ordinance (Cap. 4), section 21L and Practice Direction 11.1; garnishee order (order to show cause) under Rules of the High Court
(Cap. 4A), Ord 49, Garnishee Proceedings; and a writ of subpoena (witness summons) under Evidence Ordinance (Cap. 8), section 77A.
For the banker’s duty of confidentiality:
X AG and others v A bank
[1983] 2 All ER 464 at 475.
35
In
FDC Co Ltd and Others v The Chase Manhattan Bank, N.A.
[1990] 1 HKLR 277, the US Internal Revenue Service (
IRS
) wanted to
inspect the plaintiff’s records regarding accounts held with the Hong Kong branch of the defendant bank. The IRS served notice on the
defendant bank’s US headquarters and obtained US court orders for the production of the records. The plaintiff applied for and obtained
interim injunctions against the defendant in Hong Kong to restrain disclosure pending trial. In this appeal to have the interim injunctions
discharged, the Hong Kong Court of Appeal considered the four exceptions, as established in
Tournier
and held that the compulsion of law
exception only applies to Hong Kong law and did not include foreign law.
36
In
FDC Co Ltd and Others v The Chase Manhattan Bank, N.A.
[1990] 1 HKLR 277, a request for customer information was made to the
head office of the defendant’s bank in New York by the Inland Revenue Services to assist a tax investigation. However, since the accounts
were held in the Hong Kong branch of the bank the request was denied. See
FDC Co Ltd and Others v The Chase Manhattan Bank, N.A.
[1990] 1 HKLR 277 at 284.
37
It is noted that the Court of Appeal in
FDC Co Ltd v The Chase Manhattan Bank, N.A
.
[1990] 1 HKLR 277 did not take the same approach
as Leggatt J in
X AG and others v A bank
[1983] 2 All ER 464, and did not feel it necessary to consider the effect of the subpoena upon the
bank by regarding the matter as irrelevant to the decision. Ibid. at 286 (Yang J A): “
Mr Hoffman argues that our case is a dispute between
Hong Kong courts and United States courts. With respect to him, I do not see the problem quite in that light. The question is simply one of
applying our own law in our own courts
”. The English courts have affirmed the approach of the Hong Kong Court of Appeal in
Bank of
Tokyo Ltd v Karoon
0036335-0000808 UKO1: 2005333372.8
13
2.14
Finally, as the Memorandum of Understanding between the SFC and the SEC dated 18 January 2017
38
(the
Memorandum of Understanding
) lacks the authority of statute, it is very unlikely to meet this
exception and should not be relied upon by UBSHK (though it is of some relevance in the context of
the public interest exception – please see paragraphs 2.15 to 2.21 below).
39
opinion, there is no publicly available Memorandum of Understanding between the HKMA and the
SEC but for completeness, as regards banking activities, section 7(e) of the Banking Ordinance (Cap.
155) empowers the Hong Kong Monetary Authority to “
co-operate with and assist recognized
financial services supervisory authorities of Hong Kong or of any place outside Hong Kong, whenever
appropriate, to the extent permitted by this or any other Ordinance
”. However, section 7 is not directly
applicable to UBSHK and only sets out the functions of the HKMA. Similarly, in relation to matters
regulated under the Securities and Futures Ordinance (Cap. 571) (
SFO
), section 186 of the SFO
empowers the SFC,
40
Hong Kong. However, UBSHK itself cannot rely on sections 186 and 186A as those provisions only
set out the power available to the regulators.
Public interest
2.15
Determining whether the public interest exception applies requires a balance to be struck between the
rights of the Rights Holders and the public interest in the SEC obtaining that information.
41
to be applied when considering whether confidentiality should be breached in favour of freedom of
expression is whether, in all the circumstances, it is in the public interest that the duty of confidence
should be breached.
42
2.16
The public interest test has not been exercised in Hong Kong in the context of bank confidentiality
(see paragraph 2.21 below) and, in any event, disclosure in the public interest has been narrowly
construed by the English courts.
43
confidential information
44
general position is that voluntary disclosure, including in relation to disclosures to the police in respect
of suspicions of criminal activity, would breach the duty of confidence other than as permitted under
statute,
45
in pursuit of a greater public interest. Bankes LJ suggested in
Tournier
that national security concerns
would meet this criterion,
46
fraud or crime.
47
2.17
However, there is well established precedent for public interest in effective regulation and supervision
of banking institutions outweighing the public interest in maintaining confidentiality even in the
absence of statutory authority.
48
Tournier
regarding the prevention of fraud or crime. In such cases, the weight of the claim for disclosure is
38
See Memorandum of Understanding Concerning Consultation, Cooperation and the Exchange of Information Related to Related to the
Supervision of Cross-Border Regulated Entities
(
https://www.sfc.hk/-/media/EN/files/ER/MOU/2017-01-18-SEC-SFC-MoU.pdf
).
39
The SFC and the SEC are, among o
thers, also signatories to the
International Organization of Securities Commissions
’ ‘
Multilateral
Memorandum of Understanding Concerning Consultation and Cooperation and the Exchange of Information’ but it also lacks the authority
of statute. Therefore, it is very unlikely to meet this exception and should not be relied upon by UBSHK.
40
UBSHK is registered institution regulated by the SFC so the SFC has powers to, among other things, require information from U
BSHK.
However, as UBSHK is also a licensed bank, the SFC is required in certain circumstances to consult the HKMA, as the primary regulatory
of banks.
41
AG v Guardian Newspapers (No 2) and Others [1990] 1 A.C. 109
Spycatcher
) at 268.
42
Prince of Wales v Associated Newspapers Ltd (CA)
[2007] 3 WLR at 68. In the context of that case, it is relevant that the test is not simply
whether the information is a matter of public interest, as, unlike disclosure to the SEC, that case involves public dissemination of information.
This case is cited in the
University of
Hong Kong v Hong Kong Commercial Broadcasting Co Ltd & Anor
43
As noted, the public
interest test has not been exercised in Hong Kong but, in our view, this may be construed to refer to the Hong Kong
public.
44
Price Waterhouse v BCCI Holdings (Luxembourg) SA
45
Tournier v National Provincial and Union Bank of England
[1924] 1 KB 461 at 474.
46
Tournier v National Provincial and Union Bank of England
[1924] 1 KB 461 at 485 at 473 where Bankes LJ quotes Lord Finlay’s judgment
in
Weld-Blundell v Stephens
[1920] A.C. 956
at 965 where “
danger to the state
” was given as an example where an exception could be made
to the duty of confidentiality.
47
Tournier v National Provincial and Union Bank of England
[1924] 1 KB 461 at 486.
48
Price Waterhouse v BCCI Holdings (Luxembourg) SA
0036335-0000808 UKO1: 2005333372.8
14
greater when considering limited disclosure, such as to a relevant authority acting under its own duties
of confidence, as opposed to public dissemination of information.
49
2.18
That there is a public interest in banks making adequate disclosures to foreign regulators is reflected
the
Memorandum of Understanding, which relates to consultation, cooperation and the exchange of
information related to market oversight and supervision of regulated entities as well as the provisions
under the SFO and the BO empowering the SFO and the HKMA, as relevant, to assist regulators
outside Hong Kong (see paragraph 2.14 above).
50
2.19
In an example of the application of this principle in the context of bank confidentiality, an English
case held that compliance with a foreign subpoena could occur without breaching the duty of
confidentiality on the basis of the public interest exception.
51
was less willing to apply public duty qualification unconditionally and stressed that disclosure should
be limited to “
what was reasonably necessary to achieve the purpose of the public interest in
disclosure”.
therefore, it does have formal judicial recognition in Hong Kong.
2.20
It is assumed that disclosure to the SEC is solely in furtherance of the SEC’s supervisory mandate.
We further understand that such disclosure to the SEC is, at least in part and/or for certain types of
records, for the purposes of preventing fraud or crime (e.g., records relating to transactions and persons
involved in transactions), further supporting this view. Therefore, there may be an argument for public
interest in disclosure, given the public interest in enabling effective supervision of financial services
business, including SBS business.
2.21
That being said, the public interest test has not been exercised in Hong Kong in the context of bank
confidentiality. Dr. Claire Wilson, author of
Banking Law and Practice in Hong Kong
,
52
argued that “
in the modern banking environment it does not appear necessary for the continuation of
the
[public interest]
where a disclosure can be made in a public interest situation. Further, it is safer for a bank to seek a
court order prior to divulging information
.”
53
exception – which has not been tested in the Hong Kong courts – it would be prudent for UBSHK to
instead seek a court order prior to permitting the SEC to access its Covered Books and Records and to
conduct On-Site Inspection of UBSHK.
In the interests of the bank
2.22
In limited cases, disclosure of confidential information that is subject to the banker’s duty of
confidentiality may be permissible where it is in the interests of the bank. This exception does not
apply to information that is subject to the general duty of confidentiality. However, we consider that
this exception is available to information that is subject to both such duties, leaving only information
that does not relate to customers (e.g., information relating to staff) beyond the scope of this exception.
2.23
It is clearly in the interests of UBSHK to comply with the SEC’s requests. However, the majority of
case law on this exception points to there being a high bar to meet.
2.24
In
X AG and others v A bank
[1983] 2 All ER 464 it was held that a bank could not comply with a
subpoena from a New York court without breaching its duty of confidentiality. However, in
considering arguments based on the banker’s own interest, Leggatt J judged that it was not clearly in
49
AG v Guardian Newspapers (No 2) and Others
[1990] 1 A.C. 109 (known as
Spycatcher
) at 268.
50
Similarly, as noted above, section
186 of the SFO
empowers the SFC to assist regulators outside Hong Kong.
51
Pharaon v Bank of Credit and Commerce International SA
the public
interest in upholding the duty of confidentiality existing between banker and customer was subject to being overridden by the greater public
interest in making confidential documents relating to the alleged fraud of an international bank available to the parties to private foreign
proceedings for the purpose of uncovering that fraud. However, such disclosure should be limited to what was reasonably necessary to
achieve the purpose of the public interest in disclosure
”.
52
Sweet & Maxwell
Hong Kong
, 201
7.
53
Dr. Claire Wilson
, Banking Law and Practice in Hong Kong (
Sweet & Maxwell Hong
Kong
, 2017), paragraph 3.109.
0036335-0000808 UKO1: 2005333372.8
15
the bank’s own interests to comply with the subpoena, as the bank would not, as a matter of fact in
that particular case, face any serious detriment for its failure to comply.
54
the example in
Tournier
of a bank commencing an action against a customer where the customer’s
overdraft is in arrears, acknowledging that, in that situation, the banker would be able to disclose the
amount of the overdraft in its claim. These cases suggest that the bank’s own interest exception will
be construed narrowly and the court will take a view on whether the bank’s own interests are genuinely
threatened by non-disclosure.
2.25
In Hong Kong, the Court of Appeal in
FDC Co Ltd v The Chase Manhattan Bank, N.A.
277 has applied this qualification more narrowly than the English courts, where Silke J A stated that
“
the interest of the bank
” must “
mean in the interests of ordinary banking practice
The issues
here are very much wider than those narrow interests of the bank as I see them to be
”. Therefore,
disclosure under this limb has to be strictly limited to information that is necessary to protect the
interests of the bank and not simply to disclose information when it is in the bank’s interest. In the
context of requests by the SEC, it is assumed that failure to comply could result in enforcement action
and potentially even the cessation of UBSHK’s ability to conduct SBS business in US markets.
Accordingly, it is expected that UBSHK may face serious detriment for a failure to comply with the
SEC’s demands, and so this exception may be available to UBSHK.
2.26
However, to rely on this exception, UBSHK must balance its interests in complying with the SEC’s
disclosure request against the competing interest of its customers in the banker’s duty of confidence
being maintained, and UBSHK must satisfy itself that those interests do not outweigh its own. This
would need to be assessed on a case-by-case basis. Due to the differing circumstances of each
customer, this exception is perhaps less likely to provide a consistent basis on which to provide
information to the SEC than the public interest exception considered above.
3.
MISUSE OF PRIVATE INFORMATION
3.1
Where Covered Books and Records do not contain, and On-Site Inspection would not reveal, any
relevant forms of information, an action for misuse of private information will not be able to prevent
the sharing of information with the SEC. Considering the nature of the Covered Books and Records
(e.g., transaction data such as volumes and prices), and the focus of actions for misuse of private
information (as explained below), it is likely that many, and perhaps most, aspects of information
disclosed to the SEC required will not fall within scope of this action.
3.2
However, the doctrine of misuse of private information has yet to receive formal judicial recognition
as a cause of action in Hong Kong. It was discussed by the Court of First Instance in
Sim Kon Fah v
JBPB & Co (A Firm)
X and Another v Z
[2020] HKCU 1959
and
X v Y
[2014] 5 HKLRD 823, but the matter was resolved without the court needing to make any
determination on that cause of action. However, the court, in obiter in
X and Another v Z
[2020]
HKCU 1959, seemed to suggest that the tort of misuse of private information might be recognised.
55
3.3
In the context of the SEC’s ability to access Covered Books and Records and to conduct On-Site
Inspections of UBSHK, it is anticipated that most information that would be subject to such exercises,
and which relates to a person other than UBSHK, would properly fall to be addressed by an action in
confidence regarding secret information rather than an action in misuse of private information.
Information that is both confidential and private will be subject to the restrictions on confidential and
the restrictions on private information. Please see section 2 above regarding the ability of UBSHK to
share confidential information with the SEC.
54
X AG and others v A bank
[1983] 2 All ER 464 at 475.
55
X and Another v Z
[2020] HKCU 1959 at paragraph 146, where Hon Coleman J in the Court of First Instance commented that “ […]
it is in
my view high time that the Hong Kong Court recognised the tort of misuse of private information. If indeed it has not happened, it is likely
that it has not happened simply because the right case has not come before the Court and pursued to the full conclusion.
”
0036335-0000808 UKO1: 2005333372.8
16
4.
RIGHT TO PRIVACY
4.1
At present, there is no stand-alone basis to bring a claim for ‘invasion of privacy’ under Hong Kong
law.
56
as applied to Hong Kong. Article 14 of the Hong Kong BOR, states that no person shall be subjected
to
“
arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to
unlawful attacks on his honour and reputation
” and that “
everyone has the right to the protection of
the law against such interference or attacks
” (
Article 14
).
4.2
The BOR does not elaborate on the right to privacy under Article 14. Insofar as remedy is concerned
however, the BOR
binds only the Hong Kong government and public authorities, and any person
acting on behalf of the Hong Kong government or a public authority. The right to privacy under the
BOR cannot be enforced against private persons.
As UBSHK is a private entity, BOR affords no
protection to UBSHK’s staff and clients in a private context and would not be relevant.
56
For completeness, t
he
Hong Kong
Legislative Council is currently reviewing the PDPO. Under the Personal Data (Privacy) (Amendment)
Bill 2021, a new offence is proposed to be introduced into the PDPO under which a person commits an offence if the person discloses any
personal data of a data subject without the data subject’s consent, (a) with an intent to threaten, intimidate or harass the data subject or any
immediate family member, or being reckless as to whether the data subject or any immediate family member would be threatened, intimidated
or harassed; or (b) with an intent to cause psychological harm to the data subject or any immediate family member, or being reckless as to
whether psychological harm would be caused to the data subject or any immediate family member; and the disclosure causes psychological
harm to the data subject or any immediate family member.
0036335-0000808 UKO1: 2005333372.8
17
ANNEX 2
ASSUMPTIONS
This opinion relies on the following assumptions:
1.
UBS AG, including UBSHK, has a “prudential regulator” as defined by Section 3 of the US Securities
Exchange Act of 1934 (the
Securities Exchange Act
). As such, the Covered Books and Records
considered in this opinion are limited to what a prudentially regulated SBSD must be able to share
with the SEC.
2.
Additionally, in accordance with SEC Guidance at 85 FR 6297, books and records pertaining to SBS
transactions entered into prior to the date that UBSHK submits an application for registration are not
Covered Books and Records.
3.
UBSHK has obtained any necessary prior consent of the persons (e.g
.
, counterparties, employees)
whose information is or will be included in Covered Books and Records in order to provide the SEC
with access to its Covered Books and Records or to allow On-Site Inspections, to the extent, as
considered in this opinion, such consent would constitute valid consent and such consent has not been
withdrawn. Insofar as Covered Books and Records relate to employees of UBSHK, such employees
are “associated persons” of UBS for purposes of 17 CFR § 240.18a-5(b)(8) who have agreed to sharing
of their personal/employment information with the SEC in the event of a request for information from
the SEC.
4.
The SEC will restrict its information requests for, and use of, any information pursuant to its access to
Covered Books and Records and On-Site Inspections to only the information that it requires for the
legitimate and specific purpose of fulfilling its regulatory mandate and responsibilities by evaluating
compliance with legal obligations designed to ensure the proper legal administration of SEC-regulated
firms (which includes regulating, administering, supervising, enforcing and securing compliance with
the securities or derivatives laws in its jurisdiction) and to prevent and/or enforce against potential
illegal behaviour.
5.
Similarly, UBSHK will ensure that its disclosures are compliant with the data protection principles set
out in Schedule 1 of the PDPO. We understand that UBSHK’s general experience in responding to
information requests from the SEC (or other US and non-US regulators) leads it to maintain a belief,
which it considers to be reasonable, that UBSHK can and (subject to any changes in applicable law
and regulation and/or the approach of relevant regulators) will continue to be able to comply with these
data protection principles in the course of making disclosures of the sort required when providing
access to Covered Books and Records and submitting to On-Site Inspection.
57
6.
It is the SEC's practice to limit the type and amount of personal data it requests during examinations
to targeted requests based on risk and related to specific clients and accounts, and employees. We
understand that this aligns with UBSHK’s general experience in responding to information requests
from the SEC, leading it to maintain a belief, which it considers to be reasonable, that this assumption
is, and will remain, accurate (subject to any changes in applicable law and regulation and/or the
approach of relevant regulators).
57
See the
SEC
G
uidance at 85 FR 6298
.
0036335-0000808 UKO1: 2005333372.8
18
7.
Information, data and documents received by the SEC are maintained in a secure manner and, under
strict US laws of confidentiality, information about individuals cannot be onward shared save for
certain uses publicly disclosed by the SEC, including in an enforcement proceeding, pursuant to a
valid and non-exempt US Freedom of Information Act (
FOIA
) request,
58
of the US Congress or a properly issued subpoena, or to other regulators who have demonstrated a
need for the information and provide assurances of confidentiality.
58
We do not give any views in the opinion to matters of US law, though we understand that information can be
made public pursuant to
requests under the US FOIA, and that certain information is exempt from such requests, including (among others): (1) a trade secret or
privileged or confidential commercial or financial information obtained from a person; (2) a personnel, medical, or similar file the release
of which would constitute a clearly unwarranted invasion of personal privacy; (3) information compiled for law enforcement purposes, the
release of which (a) could reasonably be expected to interfere with law enforcement proceedings; (b) would deprive a person of a right to a
fair trial or an impartial adjudication; (c) could reasonably be expected to constitute an unwarranted invasion of personal privacy; (d) could
reasonably be expected to disclose the identity of a confidential source; (e) would disclose techniques, procedures, or guidelines for
investigations or prosecutions; or (f) could reasonably be expected to endanger an individual's life or physical safety; (4) contained in or
related to examination, operating, or condition reports about financial institutions that the SEC regulates or supervises.
0036335-0000808 UKO1: 2005333372.8