[2008] 1 HKC A B Shi Tao v Privacy Commissioner for Personal Data (Administrative Appeals Board) 301 coupled with the relevant personal information would, indeed, constitute ‘personal data’. From such information, the identity of an individual could be ascertained. 72. Accordingly, the first ground of appeal must fail. 73. It is strictly speaking unnecessary to consider the other grounds of appeal. Nevertheless, for completeness, we shall consider those other grounds. G. GROUND TWO: WHETHER YHHK WAS DATA USER C D E F G H I 74. This ground hinges on whether YHHK exercised control over the disclosure of the relevant data. 75. As already stated, a ‘data user’ is defined under the Ordinance to mean one who ‘either alone or jointly in common with other persons, controls the collection, holding, processing or use of the data’. 76. In the present appeal, the Commissioner maintained his stance that although YHHK did have control over the relevant information, such control was ‘vitiated’ when it was compelled by the operation of PRC law to disclose the information. 77. Mr Ho submits that the Commissioner’s conclusion was erroneous for two main reasons. 78. First, the relevant disclosure order from the SSB (the Disclosure Order) was served on Beijing Yahoo! as the agent of YHHK, precisely because YHHK was in control of the relevant personal data in question. YHHK accepted that the YHHK chop was appended onto the documents disclosing the relevant information to the SSB. Mr Ho argued that at no point was such control over the relevant document ever ‘lost’. 79. Secondly, Mr Ho pointed out that it transpired from the Report that there were different views from PRC lawyers as to whether refusal to provide the information to the SSB pursuant to the Disclosure Order amounted to ‘obstruction’ under art 277 of the PRC Criminal Law.6 80. Mr Ho submitted that there were various options open to the management of YHHK instead of immediate compliance with the Disclosure Order, including, amongst others, instructing lawyers to seek direction from the PRC court as to whether the material provided by SSB in support of the Disclosure Order was sufficient to show that there was a breach of state secrecy law, and engaging PRC lawyers to challenge the legality of the Disclosure Order. 6. ‘Article 277 provides that ‘… whoever intentionally obstructs officers of a State security organ or a public security organ from maintaining State security in accordance with law and causes serious consequences, though without resort to violence or threat, shall be punished…’ and will be ‘…sentenced to fixed-term imprisonment of not more than three years, criminal detention, or public surveillance and be fined.’ It is not disputed that violation of Article 277 would attract penal sanction.