Some might harbour suspicion as to the importance that a Secretary for Security may place on privacy, and might find that asking him to speak on privacy to be a contradiction in terms. But protecting privacy is not intrinsically anathema to having a safe society. Quite the contrary.

Imagine how someone could feel that their privacy is protected if all sorts of criminals were allowed to loom large. It is therefore important to ensure that a right balance is struck, and I would like to share with you how the Government has sought to achieve this through the recently enacted Interception of Communications & Surveillance Ordinance.

Law-enforcement agencies are responsible for maintaining law and order and protecting public security. They are there to serve the public. In Hong Kong, thanks to the fine performance of our law-enforcement agencies in carrying out their mission, many opinion polls show that the level of public trust in them is very high.

Enabling them to maintain their effectiveness in combating crime and protecting public security is crucial to ensuring that Hong Kong may continue to remain one of the safest cities in the world. Like their counterparts around the world, ours require interception of communications and covert surveillance as part of their repertoire of investigatory tools.

At the same time, we have to take into account the need to protect people's privacy. In this context, Article 30 of the Basic Law is particularly relevant. It provides that: "The freedom and privacy of communication of Hong Kong residents shall be protected by law. No department or individual may, on any grounds, infringe upon the freedom and privacy of communication of residents except that the relevant authorities may inspect communication in accordance with legal procedures to meet the needs of public security or of investigation into criminal offences."

The process leading to the enactment of the ordinance is a good example of how we strive to strike a balance between protecting privacy on the one hand, and ensuring the maintenance of law and order and protection of public security on the other.

First, when we formulated our legislative proposal we took reference from the many studies and discussions that we had had in our community in the past 10 years. In addition, we consulted various interested parties, including our legislators and the two legal professional bodies, and other organisations and individuals interested in this topic. These studies and consultations provided us with a useful understanding of how our community would like us to balance privacy and security.

In March this year we published our bill, which then went through our normal legislative process, including the scrutiny by a Bills Committee. The committee held a total of 46 sessions involving 120 hours' discussion. The scrutiny during these several months is at least comparable in detail to the most in-depth discussions over the most complex bills, and is almost unparalleled in terms of its intensity.

With the support and understanding of the Legislative Council, the bill was finally passed on August 6, 2006, after almost four full days of debate, and the ordinance came into effect on August 9, 2006.

I cannot say that I enjoyed every minute of those four days of marathon debate at the Legislative Council, but we take comfort from the fact that the piece of legislation passed after the massive effort by all concerned is one of the best among comparable jurisdictions in terms of the safeguards provided. Let me explain by taking you through the gist of the ordinance.

The ordinance covers interception of communications and covert surveillance. Interception of communications means the inspection of the contents of telecommunications and postal articles in the course of their transmission. As for covert surveillance, it refers to surveillance carried out with the use of a surveillance device in a manner calculated to ensure that the subject is unaware of the surveillance, and in circumstances where the subject of the surveillance is entitled to a reasonable expectation of privacy.

In accordance with Article 30 of the Basic Law that I mentioned earlier, the needs of public security and the investigation of criminal offences are the only two grounds on which relevant authorities may inspect communications in accordance with legal procedures.

Accordingly, the ordinance provides that interception or surveillance can only be done under the ordinance on the two grounds of preventing or detecting serious crime or protecting public security.

Apart from restrictions on grounds, the ordinance includes other stringent safeguards for privacy at all stages of the operation by law-enforcement agencies - from the initial application, execution of the authorisation, to the subsequent oversight.

First, under the ordinance, law-enforcement agencies must obtain an authorisation before carrying out an operation. All interception operations have to be authorised by one of the judges appointed in accordance with the ordinance. Similarly, a judge's authorisation is required for "more intrusive" covert-surveillance operations. For "less intrusive" covert-surveillance operations, the authorising authority is a senior officer of the law-enforcement agency concerned.

By "less intrusive" covert surveillance, we refer to covert surveillance carried out in two circumstances. The first is a "participant monitoring" situation, where a surveillance device is used by an undercover agent or informer whose presence is known to the target of the operation. The second relates to the use of an optical-surveillance device or tracking device in circumstances not involving entry onto premises or interference with the interior of any conveyance or object without permission.

All other covert surveillance requires authorisation by an appointed judge. This includes, for example, using an aural or optical-surveillance device to record the private conversation or activities of the target without the involvement of an undercover agent or informer.

The conditions for authorisation are strictly defined under the ordinance. As I have just said, the purpose of the operation must be confined to the prevention or detection of serious crime and the protection of public security. Where serious crime is concerned, the ordinance sets different thresholds for interception of communications and covert surveillance.

Since the degree of intrusiveness of interception of communications is generally higher, only offences for which the maximum penalty is imprisonment of not less than seven years count as serious crime.

As for covert surveillance, offences that count as serious crime is imprisonment of not less than three years or a fine of not less than $1 million. This approach is consistent with those adopted in other common law jurisdictions.

I must emphasise that the thresholds are no more than an initial screen. The ordinance also requires that the proportionality and necessity tests are met, and that there is reasonable suspicion regarding a person's involvement in the serious crime or the threat to public security.

Obtaining an authorisation is not the end of the story. During the implementation of an authorisation, the law-enforcement agencies must ensure that the terms of the authorisation are complied with. The ordinance also requires the agencies to continuously review the situation.

The materials obtained by covert operations may contain sensitive private information about the targets and other innocent persons. Improper use or disclosure of such materials would result in a serious infringement of their privacy. The ordinance therefore strictly regulates the handling of such materials by the law-enforcement agencies.

The ordinance expressly requires heads of departments to make arrangements to ensure that the extent to which such materials are disclosed, the extent to which they are copied and the number of such copies made should be limited to the minimum that is necessary; that all practicable steps are taken to ensure that such materials are protected against unauthorised or accidental access, processing or erasure; and that such materials are destroyed as soon as their retention is not necessary for the relevant purpose of the authorisation.

In addition to the various safeguards mentioned above, throughout the entire process -   whether before, during or after the operation - the compliance of the law-enforcement agencies with the relevant requirements is subject to independent oversight as well as the law enforcement agencies' internal reviews.

The ordinance especially provides for a Commissioner on Interception of Communications & Surveillance, who is a serving or former judge of the Court of First Instance or Court of Appeal, or a former permanent judge of the Court of Final Appeal.

The Commissioner has the power to review all relevant records of the law-enforcement agencies, to require any public officer or other person to answer any question and provide information, and to require any officer to prepare a report on any case. He may make recommendations to the heads of the law-enforcement agencies, and to me on what should be in the Code of Practice that I issue to the agencies.

Above all, if he deems necessary, he may report to the Chief Executive, the Secretary for Justice, or one of the judges appointed under the ordinance. The law-enforcement agencies are under a statutory obligation to report to the Commissioner any irregularities under the ordinance.

The Commissioner also acts on complaints to determine whether any interception or covert surveillance has been carried out without proper authority. He may notify the applicant if he has found in the applicant's favour and order the Government to pay compensation.

Furthermore, he may give notice and award compensation to the subject of an operation which has been carried out without proper authority even where the subject has not made any complaint. This serves as yet another powerful incentive for the law-enforcement agencies to comply with the relevant requirements.

Interception of communications and covert surveillance operations are by their nature secret. Nonetheless, to enhance transparency and accountability, the ordinance provides that the Commissioner must submit an annual report to the Chief Executive, who will cause it to be tabled before the Legislative Council.

The report will cover such matters as the various aggregate statistics and the compliance of the law enforcement agencies with the relevant requirements.

While signs are that the regime is working, as we have set out to do, to enhance protection of privacy and to provide clearer legal basis for law enforcement, it is too early to draw conclusions on the ordinance. But the ordinance builds in mechanisms for review. After the Commissioner has submitted his annual report, we will review the matters raised and report to the Legislative Council.

The occasions of the annual reports provide a basis for public review. In addition, we have undertaken to carry out a comprehensive review of the implementation of the whole ordinance after the Commissioner has submitted his second full-year annual report.

I have emphasised at the outset the importance of striking a right balance. I believe that we have achieved that in the Interception of Communications & Surveillance Ordinance. But we are keenly aware that society's needs and values keep changing, and this is especially true in such an evolving subject as the protection of privacy.

The Administration will keep in close view developments in this area, and I believe that forums like today's provide a good source of valuable discussion that goes into the policy-formulation process.

Secretary for Security Ambrose Lee gave this address at the 26th Asia Pacific Privacy Authorities Forum.