294 Hong Kong Cases [2008] 1 HKC at any time the act or practice was done or engaged in, as the case may be; A (ii) the complainant (or, if the complainant is a relevant person, the individual in respect of whom the complainant is such a person) was in Hong Kong at any time the act or practice was done or engaged in, as the case may be; B (iii) in the opinion of the Commissioner, the act or practice done or engaged in, as the case may be, may prejudice the enforcement of any right, or the exercise of any privilege, acquired or accrued in Hong Kong by the complainant (or, if the complainant is a relevant person, the individual in respect of whom the complainant is such a person)….’ C 27. Sections 65(1) and (2) provide for the liability of employers and principals under the Ordinance as follows: ‘(1) Any act done or practice engaged in by a person in the course of his employment shall be treated for the purposes of this Ordinance as done or engaged in by his employer as well as by him, whether or not it was done or engaged in with the employer’s knowledge or approval. (2) Any act done or practice engaged in by a person as agent for another person with the authority (whether express or implied, and whether precedent or subsequent) of that other person shall be treated for the purposes of this Ordinance as done or engaged in by that other person as well as by him.’ D. THE REPORT D E F 28. After a thorough investigation into the incident, the Commissioner came to 5 main conclusions in the Report. D1. IP Address is not ‘Personal Data’ within the definition of the Ordinance 29. First, the Commissioner found that the IP address of an internet account holder is not ‘personal data’ within the definition of the Ordinance. 30. The Commissioner was of the view that an IP address is a specific machine address assigned by an internet service provider to the user’s computer. It is information about an inanimate computer, not an individual. Further, an IP address alone cannot reveal the exact location of the computer concerned or the identity of the computer user. Accordingly, an IP address per se is not ‘personal data’ under the Ordinance. 31. The Commissioner went on to consider whether on the facts, the IP address combined with other information disclosed (as stated in the G H I