In this article, we examine a recent Hong Kong High Court decision on Cathay Pacific's policy requiring consent by cabin crew to disclosure of their medical records.

On 28 August 2008, the High Court in Hong Kong found for Cathay in quashing decisions of (i) the Privacy Commissioner of Personal Data and (ii) the Administrative Appeals Board in respect of Cathay's policy requiring cabin crew to consent to disclosure of private medical records.

In November 2005, Cathay instituted an Attendance Monitoring Programme ("AMP"), to investigate why a small minority of cabin crew members had levels or patterns of absence from work, purportedly due to illness. Cathay sought medical and other information as part of its obligation to ensure that cabin crew members remain medically fit to discharge their duties (Directive 360 of the Civil Aviation Directive). The AMP stated that any cabin crew member who did not co-operate and participate in the program could be subject to disciplinary action.

The office of the privacy Commissioner for personal data (PCPD) is an independent statutory body set up to oversee the enforcement of the personal data (privacy) ordinance (cap. 486) (the ordinance). In January 2007, as a result of anonymous complaints, the PCPD carried out an investigation to determine whether Cathay's requirements under its AMP contrived the requirements of the ordinance, in particular requirements that the collection of the personal data be necessary, adequate, but not excessive and that the means of collection be lawful and fair in the circumstances of the case.

The Commissioner, reporting in January 2007, accepted that Cathay had not breached any of the data protection principles set out in the ordinance, but found that the manner in which Cathay set about collecting the data was not fair, though lawful. Cabin crew were made to give consent under the threat, or for fear of a disciplinary process for failure to co-operate. Cathay was ordered to cease the practice and to destroy all the medical records it had collected from employees under the AMP.

Cathay appealed to the administrative appeals Board (AAB) against the Commissioner's decision. On 2 May 2008, the AAB dismissed Cathay's appeal. In late May 2008, Cathay instituted judicial review proceedings of both decisions before the High Court. In judgment handed down on 28 August, the High Court quashed the decisions both of the Commissioner and of the Board. The High Court accepted that a data subject must be provided with all necessary information in order to make an informed choice but the Court was unable to accept that, in terms of the ordinance, a data subject must have "complete freedom" of choice whether to consent or not. The data protection principles themselves recognise that there may be circumstances in which the disclosure of data may properly be made compulsory. It has been provided that, if the collection of data is obligatory, the person from whom the data is to be collected must be informed of the consequences of a refusal to supply the data. The judges found that Cathay, in informing all cabin crew members of the possible consequence of failure to disclose relevant medical records, was doing no more than meeting the requirements of the ordinance and that such advice does not thereby, of itself, constitute a threat or the exertion of undue influence. The application for judicial review was accordingly allowed, and the decisions of the Commissioner and the Board quashed.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.