territorial application of data protection statues are expressly provided for in statutes of some other jurisdictions. One example is section 5B(1A) of the Privacy Act 1988 in Australia, which applies to acts done, or practice engaged in, outside Australia by an organization, or small business operator, that has an Australian link. Another example is the Data Protection Act 1998 in the United Kingdom, which provides for extra-territorial application where the data controller is established outside the United Kingdom and the European Union, but uses equipment in the United Kingdom for processing the data otherwise than for the purpose of transit.' In Shi Tao v The Privacy Commissioner for Personal Data (unrep., Administrative Appeal No. 16/2007，26 November 2007), the appellant lodged a complaint with the Respondent against Yahoo! Holdings (Hong Kong) Limited ("Yahoo HK"), which had disclosed to the PRC State Security Bureau account holder information of his email account at the Yahoo! China website (see paragraphs 1-9 on pages 1-2). The Yahoo! China website was . wholly owned by Yahoo HK，but operated by a PRC entity and a wholly owned PRC subsidiary of Yahoo HK (see paragraphs 11-16 on pages 3-4). The Board held that Yahoo HK had control over the disclosed information (see paragraph 81 on page 17), but since such information did not constitute “personal data", Yahoo HK was not a “data user 53. " under the Ordinance (see paragraph 83 on page 17). In that case, the Board considered that since the Ordinance clearly applied, it was not necessary to decide whether it had extra-territorial ' application (see paragraph 89 on page 19). The Board nevertheless noted as dicta that section 39(l)(d) of the Ordinance, which empowers the Respondent to refuse to carry out or continue an investigation when the case has no connection with Hong Kong, is not a provision dealing with 44