In late 2005, the largest airline company in Hong Kong, Cathay Pacific Airways Limited ("CX"), implemented a programme requiring its cabin crew members who took long or frequent sick leave to disclose their medical records in the past 12 months. Failure to consent to the disclosure may be treated as a "Disciplinary and Grievance" matter. The Privacy Commissioner for Personal Data (the "Commissioner") carried out extensive investigation into the matter and later found that although CX's demand for medical records was lawful, but the method of collection was unfair and thus contravened the Data Protection Principle 1(2) in Schedule 1 of the Personal Data (Privacy) Ordinance (the "Ordinance"). The Commissioner exercised the power vested in him and issued an enforcement notice to CX requiring it to cease the practice and destroy all the medical records it had collected from its employees.
CX lodged an appeal to the Administrative Appeals Board ("AAB") against the Commissioner's findings and the AAB unanimously upheld the Commissioner's decisions. Dissatisfied with the AAB's decisions, CX applied for a judicial review in the Court of First Instance ("Court"). The Court gave judgment in favour of CX on 28 August 2008.
Background
Before examining the Court's decisions, it will be useful to first look into the Commissioner's (also the AAB's) findings :-
1. Data Protection Principle 1 ("DPP 1")
DPP 1(1) states that personal data shall not be collected unless :-
- the data are collected for a lawful purpose directly related to a function or activity of the data user who is to use the data;
- subject to paragraph (c), the collection of the data is necessary for or directly related to that purpose; and
- the data are adequate but not excessive in relation to that purpose.
DPP 1(2) states that personal data shall be collected by means which are :-
- lawful; and
- fair in the circumstances of the case.
The Commissioner's interpretation is that, the collection of personal data was necessary and in compliance with DPP 1(1) but it did not mean that the act or practice was not subject to regulation under DPP 1(2).
2. Why is CX's collection of medical records lawful (DPP 1(1))?
In order to maintain its air operator's certificate, CX is required to ensure that all cabin crew when they are flying on duty are medically fit (Directive 360 of the Civil Aviation Directives). As a commercial enterprise, CX also seeks to ensure that all cabin crew are able to attend to their duties on a regular basis.
Therefore, CX has a direct interest in the health and well-being of its cabin crew and CX explained that without the past medical records, it would not be able to assess whether the employee is fit to return to flight duties.
Based on the above, the Commissioner concluded that the collection of previous medical records under the circumstances was necessary under DPP 1(1) as being for a lawful purpose directly related to the functions and activities of CX.
3. Why is CX's means of collecting medical records unfair (DPP 1(2))?
The Commissioner considered that medical information of an individual is extremely sensitive and demands a high level of protection. Although the collection of medical records had compiled with DPP 1(1), the manner of collection is still subject to DPP 1(2). CX failed to provide the employees with all necessary information which would enable them to choose freely whether to give their consent or not. The employees were made to give their consents under threat or fear of disciplinary actions for not cooperating. The Commissioner concluded that such means of collection are unfair and in breach of DPP 1(2).
In its rulings, the Court overturned the decisions of the Commissioner and the AAB and remitted the case to the Commissioner for fresh consideration.
Court's Ruling
The Court considered that both the Commissioner's and AAB's findings were based on "incorrect construction" of the true meaning and intent of the Ordinance. The Commissioner must take into account that CX has a duty in law to monitor the health of its cabin crew members and that the collection of medical records sprung directly from that duty and the data sought was not excessive. While the judges accepted that the employees must be provided with all necessary information in order to make an informed choice, they were unable to accept that, in terms of the Ordinance, the employees must have "complete freedom" of choice whether to consent or not, unburdened by any possible adverse consequences and if the "complete freedom" is in any way compromised, then the collection of private data should be regarded as unfair.
The judges interpreted the Ordinance as recognising that there may be circumstances in which the disclosure of personal data may properly be compulsory and went on to quote DPP 1(3) that when personal data is to be collected from a person, "all practicable steps shall be taken to ensure that the person is" –
"... explicitly or implicitly informed, on or before collecting the data of –
- whether it is obligatory or voluntary for him to supply the data; and
- where it is obligatory for him to supply the data, the consequences for him if he fails to supply the data; and ..."
The judges therefore concluded that CX was merely complying with the Ordinance in informing all cabin crew members of the possible consequences of a failure to disclose the relevant medical records and further commented that since CX is obliged under law to ensure its cabin crew members are fit to perform their duties, the disclosure of medical records is properly rendered mandatory. It is therefore necessary to advise the employees of the adverse consequence of failing to disclose and that advice should not be viewed as a threat or the exertion of undue influence.
Further, the disciplinary procedures for employees failing to disclose the records are not only protecting CX's interests but also ensuring that the employees are not prejudiced in their employment without a full and fair investigation.
The Commissioner is of the view that his initial decisions were correct and is considering to appeal against Court's decision. However, he has to take into account the merits of the case, public interest and the Commission's financial situation before proceeding.
Conclusion
Employers are advised to pay close attention to the development of this case and make proper explanation to employees regarding the collection and use of personal data, including but not limited to medical records.
Experienced lawyers in our Employment Practice regularly advise both private and corporate clients on employment matters in Hong Kong and China. If you have any question on the above eNews or employment laws, please do not hesitate to contact us.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
