[2008] 1 HKC A B Shi Tao v Privacy Commissioner for Personal Data (Administrative Appeals Board) 295 Verdict) constituted personal data.3 The Commissioner concluded that ‘no safe conclusion can be drawn that the corresponding user information ex facie belong to a living individual as opposed to a corporate or unincorporated body or relates to a real as opposed to a fictitious individual’. 32. Having reached such conclusion, strictly speaking it was not necessary for the Commissioner to take the matter any further. Nonetheless, the Commissioner went on to consider four other questions. D2. YHHK not a ‘Data User’ C D E F G H I 33. The second conclusion which the Commissioner arrived at was that YHHK had no control over the disclosure of the data in question. Accordingly, it was not a ‘data user’ within the definition of the Ordinance. 34. Although what constitutes ‘control’ is not defined under the Ordinance, the Commissioner took the view that it can either mean the physical act of collecting, holding, processing or using the personal data or it can mean the ability of determining the purpose for which or the manner in which the data are to be collected, held, processed or used. 35. The Commissioner was of the view that YHHK did have control over the relevant information. This was because at the material time when such information was disclosed, YHHK (owned 100% of the shareholding of Beijing Yahoo! which operated the Yahoo! China website. The Commissioner considered that the division of labour within the Yahoo! group of companies was no more than internal and inter-companies management arrangement. Such arrangement did not affect the fact that YHHK remained a legal entity that should be held responsible for all acts carried out by YHHK itself or its agent in the PRC. 36. The Commissioner further reasoned that although strictly speaking, the actual physical act of collection and disclosure of the information in question might not be committed by YHHK but by Beijing Yahoo! in the PRC, it was an undisputed fact that the YHHK chop was appended onto the documents disclosing the information. Beijing Yahoo! was actually acting as an agent of YHHK. Hence, YHHK was accountable for the disclosure of such information under ss 65(1) and (2) of the Ordinance (whether because the act was done by the employees of YHHK or by Beijing Yahoo! as its agent). 37. Having formed such a view, the Commissioner then proceeded to say that the disclosure of the information in the circumstances of the case 3. The Commissioner received advice from leading counsel who advised that ‘an IP address alone is not ‘personal data’ but that ‘personal data’ can include an IP address when combined with, for example, identifying particulars of an individual. Whether or not it is part of any personal data in a particular case depends on the facts of the case and the two limbs of the definition of ‘personal data’…’: Report para 8.12.