30 May, 2018
It was widely reported in the news earlier that Legislative Councillor Ted Hui (Hui) snatched a phone from an administrative officer of the government, allegedly for finding out the types of information retained by the officer.
Shortly after the incident, the Office of the Privacy Commissioner for Personal Data (PCPD) published a media release stating that officer’s collection of information on lawmakers’ locations in the Legislative Council Complex (LegCo Complex) would not constitute unfair or unlawful collection of personal data, and accordingly did not breach the Personal Data (Privacy) Ordinance (Ordinance). Hui then asked the PCPD to further address several issues in relation to information collection from lawmakers, including whether it was necessary and relevant for the government to monitor lawmakers’ movement and whether the collection was fair or excessive.
So what are the legal restrictions in the collection of personal data?
Data protection principle
It is set out in Schedule 1 of the Ordinance that:
“1. Principle 1 – purpose and manner of collection of personal data
(1) Personal data shall not be collected unless
(a) The data are collected for a lawful purpose directly related to a function or activity of the data user who is to use the data;
(b) Subject to paragraph (c), the collection of the data is necessary for or directly related to that purpose; and
(c) The data are adequate but not excessive in relation to that purpose.
(2) Personal data shall be collected by means which are
(a) lawful; and
(b) fair in the circumstances of the case.”
Responses from the PCPD
On 3 May 2018, the PCPD provided a public response to Hui’s enquiries with reference to the data protection principles under the Ordinance. In particular, the PCPD responded that while data protection principle 1 stipulates that personal data must be collected in a lawful and fair way, for a purpose directly related to the function or activity of the data user, it is not a prerequisite that consent be required from the data subject for collection of his personal data.
In the PCPD’s opinion there was neither unfair nor unlawful collection of personal data in the tracking of the lawmakers’ locations in the LegCo Complex, taking into account that
(i) the officer’s duties of tracking lawmakers’ locations in the LegCo Complex concerned important public interests and served legitimate purposes;
(ii) the venue where the lawmakers’ locations were tracked (the LegCo Complex) was not one with a high expectation of privacy; and
(iii) the officer only tracked movements of lawmakers in the public areas of the LegCo Complex, which does not constitute sensitive information.
As regards whether the government has published any privacy policy statement in relation to the tracking of lawmakers’ locations in the LegCo Complex, the PCPD cited a response made by the then Secretary for the Civil Service in the Legislative Council in 2003 to the question “Arrangement of public officers to station at the LegCo Complex”. The government had explained arrangements of its officers to assist Secretaries of Departments and Directors of Bureaux in matters relating to the Legislative Council. The Ordinance does not mandate the giving of written notice of relevant privacy policy statements.
Take-away points for employers
Employers will collect personal data from its employees and job applicants from time to time. While the Hui incident is not an employment related matter, the same personal data collection principles also apply in the context of employment. For instance, is the recruitment advertisement a “blind” one which is condemned by the PCPD? Is there any personal collection statement in place? What information is collected by the employer – and is it necessary or excessive? Employers should ensure that in collecting personal data from their employees or job applicants, the relevant data protection principles are complied with. The above are just a few of the questions an employer should consider.
For further information, please contact:
Elsie Chan, Partner, Deacons
elsie.chan@deacons.com.hk
