Million Mask March in Hong Kong, 2014. Demotix/Gonzales Photo. All Rights Reserved.Hong Kong’s top security official has finally clarified the legal procedure governing law enforcement’s requests for user information from Internet service providers. Unsurprisingly, there is no legal procedure. We can’t help but ask: is our metadata non-sensitive enough to justify government agencies’ access without any judicial review or oversight?

During a Legislative Council meeting in late April, Lai Tung-kwok, the Secretary for Security, said that law enforcement agencies may request necessary user information (such as account names, IP addresses and log records) from service providers for locating witnesses, evidence or suspects when investigating crime cases. Warrants are only required for seizure of communications content and documents, and no warrants are required for requests for metadata. That means there is no judicial scrutiny of the 23,946 user information requests the Hong Kong Police Force and the Customs and Excise Department have issued over the past five years.

The lack of judicial oversight is particularly worrying given the fact that since last June, at least nine social activists have been arrested for radical comments on social media platforms, according to a database maintained by Hong Kong Transparency Report, an independent research project at the Journalism and Media Studies Centre, University of Hong Kong. The police obtained the activists’ IP addresses and managed to track their physical locations without any judicial scrutiny.

Law enforcement may assume metadata, or non-content data, is non-sensitive, and therefore access to netizens’ metadata without going through any legal procedures does not constitute a violation of citizens’ privacy rights. But someone’s metadata can reveal a lot about them. The website log records and IP addresses, for instance, can tell the police when you log into a local forum, how long you stay at the forum and, with the assistance of Internet service providers, your physical location when you access the forum. The development of big data and targeted advertising proves metadata is not non-sensitive and companies and governments can learn a lot about you by merely studying your metadata.

Chiang Yam Wang, Hong Kong’s privacy commissioner, raised his concern over the lack of protection of Internet users’ metadata in a recent blog post. Chiang believes that our metadata can be more revealing than the actual content of the communication: “Metadata portrays a detailed, comprehensive and time-stamped picture of who is communicating with whom, when, how often, and for how long; where the senders and recipients are located, who else is connected to whom, and so forth. It thus reveals the details of our personal, political, social, financial, and working lives.”

Hong Kong’s legal framework for regulating law enforcement’s access to personal identification information has lagged behind other jurisdictions. The United States’ Electronic Communications Privacy Act, despite constantly coming under attack for its weak protection for metadata, sets out rules for law enforcement officers to follow when they extract users’ metadata from service providers. For instance, agencies must apply for a subpoena to access Internet users’ account information (for example, name and physical address) and session metadata (network address, time and duration), and a D order (another type of court order) for access to message metadata (‘to and from’, time and length).

Elsewhere in the world, governments are either eager to expand law enforcement’s surveillance powers on metadata or have to curtail that power due to social pressure. During the UK election, the Conservatives pledged to “keep up to date” powers to access citizens’ communications metadata, and the Labour party declared in its manifesto that it is devoted to “strengthening” the powers available. In Australia, Prime Minister Tony Abbot has agreed to amend the legislation to require agencies to obtain a warrant before they access journalists’ metadata for the purpose of identifying their sources.

And when it comes to the ‘individual privacy versus public safety’ debate, it is worth revisiting the notion proposed by legal theorist Robert Post: privacy isn’t the trumpeting of the individual against society’s interests, but the protection of the individual based on society’s own norms and values. Privacy issues involve balancing societal interests on both sides of the scale.

The Internet has become an integral part of the lives of Hong Kong’s citizens. It is lamentable that Hong Kong, a city that prides itself on its rule of law, does not have any laws or regulations to regulate and oversee law enforcement’s access to users’ metadata. This becomes increasingly disturbing when we think about its implications for social activists’ online campaigns. The loss of online privacy is certainly not the price Hong Kong citizens want to pay to stay away from criminals.