Article 30 of the Basic Law directly addresses the privacy of people's communications, while Article 28 protects personal privacy and Article 30 protects the privacy of where someone lives.
The freedom of the person of Hong Kong residents shall be inviolable.
No Hong Kong resident shall be subjected to arbitrary or unlawful arrest, detention or imprisonment. Arbitrary or unlawful search of the body of any resident or deprivation or restriction of the freedom of the person shall be prohibited. Torture of any resident or arbitrary or unlawful deprivation of the life of any resident shall be prohibited.
The homes and other premises of Hong Kong residents shall be inviolable. Arbitrary or unlawful search of, or intrusion into, a resident's home or other premises shall be prohibited.
The freedom and privacy of communication of Hong Kong residents shall be protected by law. No department or individual may, on any grounds, infringe upon the freedom and privacy of communication of residents except that the relevant authorities may inspect communication in accordance with legal procedures to meet the needs of public security or of investigation into criminal offences.
The Interception of Communications and Surveillance Ordinance provides a statutory regime for the authorization and regulation of interception of communications and covert surveillance conducted by law enforcement agencies to prevent or detect serious crime and protect public security.
Section 2: Interpretation
“Type 1 surveillance” (第1類監察) means any covert surveillance other than Type 2 surveillance;
“Type 2 surveillance” (第2類監察), subject to subsections (3) and (4), means any covert surveillance that—
(a) is carried out with the use of a listening device or an optical surveillance device by any person for the purpose of listening to, monitoring or recording words spoken or activity carried out by any other person, if the person using the device—
(i) is a person by whom the other person intends, or should reasonably expect, the words or activity to be heard or seen; or
(ii) listens to, monitors or records the words or activity with the consent, express or implied, of a person described in subparagraph (i); or
(b) is carried out with the use of an optical surveillance device or a tracking device, if the use of the device does not involve—
(i) entry onto any premises without permission; or
(ii) interference with the interior of any conveyance or object, or electronic interference with the device, without permission.
Section 8: Application for judge’s authorization for interception or Type 1 surveillance
(1) An officer of a department may apply to a panel judge for the issue of a judge’s authorization for any interception or Type 1 surveillance to be carried out by or on behalf of any of the officers of the department.
Section 14: Application for executive authorization for Type 2 surveillance
(1) An officer of a department may apply to an authorizing officer of the department for the issue of an executive authorization for any Type 2 surveillance to be carried out by or on behalf of any of the officers of the department.
The PDPO protects personal data -- name, address, phone numbers, etc., -- rather than privacy, which is a broader concept than information or data protection. The ordinance set out six Data Protection Principles (DPPs), which applies to both the public and private sectors.