28 February, 2020
In part 3 of our series covering the response to the novel coronavirus 'COVID-19' (Coronavirus) in Asia, we look at employers' responsibilities in Hong Kong.
With the spread of the Coronavirus, governments are implementing stricter immigration control and public health measures including through social distancing and quarantine. Businesses are faced with a difficult decision – how do they ensure the safety of their staff while ensuring business continuity, and compliance with the law?
Employers are required to provide a safe place of work
Employers are required under section 6 of the Occupational Safety and Health Ordinance (OSH Ordinance) to ensure, so far as reasonably practicable, the safety and health at work of all the employer's employees.
It can be difficult to know what measures are reasonably practicable where the public health situation is constantly evolving. A measure that is reasonably practicable one day may be inadequate the next. The safest approach for employers is to follow the latest guidance published by relevant Hong Kong Government Departments, such as the Centre for Health Protection's Health Advice on Prevention of Severe Respiratory Disease associated with a Novel Infectious Agent in Workplace (Health Advice) and guidance issued by the Labour Department from time to time.
The Health Advice sets out a range of measures that employers are recommended to adopt such as relating to the cleaning of workplaces and the maintenance of facilities such as toilets and air conditioners. Guidance from the Labour Department encourages employers to provide relevant personal protective equipment to employees, particularly those whose roles require public interaction. That equipment may vary depending on an employee's role, but could, for example, include surgical masks.
While this approach does require regular monitoring of communications from the relevant departments, it is the most prudent approach in circumstances where there are regular changes in public health measures.
Mandatorily quarantined employees
As of 8 February 2020, the Hong Kong Government requires mandatory quarantine:
- in hospital, for those suspected to be infected with Coronavirus;
- at home or in mandated quarantine centres, for those who have been in close contact with a confirmed case; and
- at home, or other accommodation, for those entering Hong Kong who have been to Mainland China in the past 14 days, including those entering Hong Kong via a place other than Mainland China.
For those under mandatory quarantine orders, the Hong Kong Government has encouraged employers to show understanding and adopt flexible arrangements including, where practicable, allowing employees to work from home or granting them paid leave. For those who have contracted Coronavirus, sick leave should be provided in accordance with the Employment Ordinance or the terms of the employee's employment contract.
Penalties apply for failure to comply with a mandatory quarantine order. The Department of Health has indicated that it will prosecute such violations and on 17 February 2020 announced that summons will be issued against two persons suspected to be in violation of such orders. Employers should not require employees subject to a mandatory quarantine order to attend work during this time.
Requiring employees to stay away from work, or work remotely
Depending on their contractual arrangements, employers may not have an express right to require employees to stay home from work where they are not under mandatory quarantine. Employers who wish to enforce an unofficial quarantine should check their contracts carefully before doing so, especially if they are not able to implement remote working during the quarantine period. If there is no contractual right to require an employee to stay away from the workplace, the employee's agreement to the absence should be sought.
If employees under an unofficial home quarantine are fit to work, they should be offered the opportunity to work remotely. Where remote working arrangements are not possible for an employee under informal quarantine, we recommend that the employee be paid during the period. This time would be counted as "special leave" that is in addition to other statutory and contractual entitlements. Failure to pay wages and benefits as normal may expose the employer to breach of contract claims, or even a disability discrimination claim.
The Hong Kong government has, as of the date of this article, extended its work from home arrangements for most government employees until 1 March 2020, with government departments offering emergency, essential and limited basic public services during such period. Consistent with such position, many private sector employers are offering remote working arrangements to all but front line staff, regardless of their recent travel history. While the majority of employees are likely to agree to such arrangements, whether an employer can require employees to work remotely will again depend on the relevant employment contract's terms. Further, employers should be mindful of the individual circumstances of employees, and whether remote working is practical and safe for all employees.
When can my employees return to work?
If an employee's medical quarantine has expired, they are likely able to return to work. Whether an employer can require an employee to undergo a medical assessment to determine whether they could pose a risk of infection in the workplace depends on the particular circumstances. We consider that employers are within their rights to request a medical certificate confirming an employee's fitness for work, if the employee has been under mandatory quarantine. It would be appropriate for the employer to meet the cost of the relevant assessment, if not otherwise funded by the government.
Compliance with data privacy laws
Employers who require employees to undertake assessments or provide medical evidence of their fitness for work should bear in mind their obligations under both the Personal Data (Privacy) Ordinance (PDPO) and their organisational personal data policies. In particular, if employers are:
- asking an employee if they are experiencing any Coronavirus symptoms or to submit a health declaration form – the employee must be advised of the purpose for which the employer is requesting this information (for example, to assess whether the employee poses any risk to their workplace), and the details of any classes of person to whom the employee's data might be transferred (for example, to their supervisor or the human resources department). It should also be made clear that the employee is not obliged to provide this information if they do not wish to do so and that they have the right to request access to and correct the data that they provide in the future;
- using employees' health or travel information – pursuant to Data Protection Principle (DPP) 3 of the PDPO, personal data can only be used or disclosed by a data user for the original purpose of collection or directly related purposes. However, in the context of managing Coronavirus related issues, the following exemptions may apply:
– Section 59 of the PDPO – personal data relating to the physical or mental health of a data subject is exempt from the data use restriction (DPP 3) and provisions relating to data access requests (DPP 6 and section 18(1)(b)) of the PDPO, if the application of such provisions would be likely to cause serious harm to the physical or mental health of the data subject or any other individual; and
– Section 59(2) of the PDPO – personal data relating to the identity or location of a data subject is exempt from the data use restriction (DPP 3) of the PDPO, if the application of such provision would be likely to cause serious harm to the physical or mental health of the data subject or any other individual; and
- storing employees confidential information – Information regarding an employee's health status should be kept confidential, and pursuant to DPP 3 of the PDPO, employers should take all practicable steps to protect all personal data held against unauthorised or accidental access, processing, erasure, loss or use. In addition, and pursuant to DPP 2 of the PDPO, if any personal data is collected from employees for the management of Coronavirus-related issues, employers should take all practicable steps to ensure that this personal data is not kept longer than is necessary for fulfilling that purpose.
Meeting regulatory requirements during periods of remote work
While most employers have been agreeable to implementing remote working arrangements, their long term use raises other issues, such as the proper supervision of employees. This is particularly the case for employers who operate in licensed industries, such as the financial sector.
There is a general requirement across the banking, securities and insurance sectors that licensees conduct effective business continuity planning, appropriate to the size of the licensee, to protect against the risk of interruption to business continuity. Since the SARS outbreak in 2002/2003, the risks of serious communicable diseases impeding business continuity are expected to have been one of the risks modelled in this planning. Circulars published in late 2003 by the SFC (Ref 250/LC/24) and HKMA (Ref B1/15C), for example, speak specifically to the need for business continuity planning to take into account the risks around staff infection. Subsequent circulars in 2009 in the context of the human swine influenza outbreak reiterated this expectation, and the SFC's Management, Supervision and Internal Control Guidelines, the IA's Guideline on the Corporate Governance (GL10), and the HKMA's Supervisory Policy Manual module on Business Continuity Planning (TM-G-2) require licensees to establish and maintain policies and procedures.
The need for social distancing through remote working arrangements is acknowledged by regulators but it also poses a specific risk to one of the central pillars of a robust internal control environment: the day-to-day supervision of a business's representatives by management. Effective supervision often assumes or requires co-location of staff and management. Care will be required to adapt management structures to ensure that senior management continue to be able to discharge their obligation to ensure the maintenance of appropriate standards of conduct and adherence to proper procedures by employees whilst they are working remotely.
For certain individuals, their roles or licence conditions may restrict the extent to which they, personally, can operate remotely and/or ability to operate from a location outside Hong Kong. SFC-approved responsible officers are, for example, generally required to reside in Hong Kong and to supervise regulated activities from within Hong Kong. Similarly, Hong Kong-based alternate chief executives should step into the shoes of a bank chief executive who is overseas.
Care will also be required to ensure that arrangements respond to requirements which specify the location at which they must take place; such as ensuring that SFC-regulated business takes place at, and mandatory records are stored at, approved business premises. Certain conduct requirements are also linked to location, such as the SFC requirements around order-recording (see paragraph 3.9 of the SFC's Code of Conduct), which imply the need for additional controls where orders are accepted "outside the trading floor, trading room, usual place of business where order is received or usual place where business is conducted". Beyond explicit requirements such as these, many licensee's internal policies around, for example, client confidentiality, the control and safe-guarding of inside information, and the design and resilience of electronic trading systems are founded on requiring relevant information to be retained and processed only within the controlled environment of the firm's premises.
In certain circumstances, the impact on a licensee's business, activities, structure and/or overall condition caused by remote working may be sufficiently substantial to warrant reporting under, for example, the Securities and Futures (Licensing and Registration) (Information) Rules or to the HKMA in line with Basel Core Principle 9. Indeed, the SFC and HKMA have, during previous outbreaks required licensees to inform them immediately if any of their staff are either suspected of or diagnosed with a communicable disease (although this has not been specifically mandated in the current outbreak). Licensees would be advised to ensure that the emergency contact person details are up to date with their regulators. Licensed corporations and registered institutions must notify of any changes within seven business days.
Notwithstanding the care that is required to ensure that business, and a licensee's clients, are not adversely affected by the risks posed by remote working arrangements, there is a recognition that such arrangements are components of a prudent response to the risk of contagion and so ensuring business continuity in exceptional times. Both the SFC and HKMA have recently issued guidance which makes clear their expectation that business as usual will be maintained insofar as possible, but have also exhibited a willingness to be flexible with licensees encountering specific difficulties.
For further information, please contact:
James Comber, Partner, Ashurst
james.comber@ashurst.com
