Background

In line with global trend to protect employees’ personal data privacy, the Hong Kong Office of the Privacy Commissioner ("Commissioner") issued a draft Code of Practice on Monitoring and Personal Data Privacy at Work in March 2002 to seek public views on such issues. After more than a year of consultation and discussions, the Commissioner decided on 18 December 2003 to develop a set of non-binding guidelines (the "Guidelines") on the subject of employee monitoring pursuant to section 8(5) of the Personal Data (Privacy) Ordinance (the "Ordinance"), instead of a binding law. Section 8(5) of the Ordinance states that "The Commissioner may from time to time cause to be prepared and published by notice in the Gazette, for the guidance of data users, guidelines not inconsistent with the Ordinance, indicating the manner in which he proposes to perform any of his functions, or exercise any of his powers, under the Ordinance." The Guidelines have been published in December 2004 and as promised previously, here is a brief summary of them.

Guidelines

The Guidelines allow surveillance of employees if it is done openly, it is necessary and the employees are kept informed. The purpose of the Guidelines is to provide guidance to employers on what steps they can take in assessing whether employee monitoring is appropriate for their business, and, where it is deemed appropriate, how they can develop privacy compliant practices in the management of personal data obtained from employee monitoring.

The Guidelines suggest employers consider an assessment process prior to making any final decision as to whether employee monitoring is appropriate to their needs, and there are three components of this process, namely :-

  1. Assessment – To assess the appropriateness of monitoring by considering the benefits to be derived and the purpose of it, e.g. collecting telephone records for the purpose of monitoring service delivery to ensure quality and consistency of telephone service to customers.
  2. Alternatives – To consider alternatives that may be equally cost-effective and practical in their application but less privacy intrusive, e.g. to prevent unauthorized access to web sites containing indecent material, or downloading of unacceptable content from the Internet, an employer may consider the installation of filter software instead of the employer logging on all web sites visited by employees.
  3. Accountability – To be responsible and accountable for the proper conduct and operation of its monitoring activities. The employer has a duty to ensure that a privacy policy pertaining to employee monitoring is developed and brought to the notice of employees before monitoring is introduced and privacy compliant measures are developed to protect the personal data of employees that may be collected in the course of monitoring.

In designing monitoring policies and data management procedures, employers are also encouraged to :-

  1. have a clear monitoring policy by specifying the circumstances under which monitoring may take place and the purposes for which personal data is obtained;
  2. communicate and take steps to ensure employees are notified of such policy by way of e.g. publishing the policy in the employee handbook or posting it on notice boards;
  3. control the holding, processing and use of monitoring records to safeguard the protection of employee’s personal data contained in them, e.g. personal data contained in monitoring records should not be kept any longer than is necessary for fulfilling the stipulated purpose, and it is recommended that personal data should not be retained for more than 6 months.

Guidelines for employers of domestic helpers

The Guidelines also apply in a limited manner to covert monitoring activities carried out by employers of domestic helpers. Domestic helper employers can now install cameras at home to monitor domestic helpers’ activities. However, they must seriously consider the reasonableness of the manner in which such monitoring is carried out, e.g. there is a reasonable suspicion that a child has suffered from abuse or neglect and that there are no realistic alternative ways of obtaining evidence of the abusive acts of commission or omission other than by way of covert monitoring. Domestic helpers must also be informed of the presence of any video monitoring system in the premises where they work and no cameras should capture images showing activities inside a bathroom or the private area where the domestic helpers rest after work.

Conclusion

The Guidelines were designed to standardize best practice if email, phone or camera monitoring is deemed necessary for security or business purposes. The implementation of the Guidelines is welcomed by employers, as they can now in certain circumstances monitor the emails or telephone calls of their employees "openly" by installing cameras or surveillance software in the work place.

Although the Guidelines are not definitive statements of law, the Commissioner strongly encourages employers to comply with the Guidelines when they adopt any employee monitoring activities, failing which employees can lodge a complaint with the Commissioner and legal action may then be taken by the Commissioner against the employer.

Members of our firm will be happy to provide a copy of the Guidelines on request. Meanwhile, lawyers in our Corporate Commercial Department can deal with any inquiries you may have regarding data privacy or employment issues in Hong Kong and the PRC.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.