The Privacy Commissioner for Personal Data (the “Commissioner”) had earlier found that Cathay Pacific Airways Limited (“Cathay”) was acting “unfairly” by threatening disciplinary action or even termination of employment contracts if the employees who have high  records of absence from duty refused to consent to the release of their medical records to Cathay.  The Court of First Instance overturned this decision and remitted the case to the Commissioner for fresh consideration.

Background

With a view to discharging its obligation of ensuring that all cabin crew, when they were flying on duty were medically fit, Cathay instituted a programme in November 2005 requiring its cabin crew staff who had high records or patterns of absence from work to consent to the release of their medical records (“Programme”). The purpose of the Programme was to investigate the causes of the long or frequent sickness and to consider whether these employees were unable to meet the inherent requirement of the job, i.e. discharging full time flying duties. Cathay had in various documents relating to the Programme informed the cabin crew that they might be subject to disciplinary action and even termination of employment contracts if they refused to give the consent. The employees lodged complaints to the Commissioner that Cathay had breached the Personal Data (Privacy) Ordinance (Cap. 486) (“Ordinance”). Both the Commissioner and the Administrative Appeals Board (who heard Cathay’s appeal from the decision of the Commissioner) found that although Cathay’s request for their cabin crew’s medical records was lawful and not excessive, the method of collection was unfair because Cathay had not given the cabin crew a freedom to determine whether or not to give the consent. As a result, Cathay instituted these judicial review proceedings seeking orders to quash the decisions of the Commissioner and the Administrative Appeals Board.

Purpose and Manner of Data Collection

S.4 of the Ordinance directs that a data user such as an employer, in collecting and using its employees personal data, must do so in accordance with the ‘Data Protection Principles’ which includes:

S.s.(1) of the first principle: Personal data shall not be collected unless -

(a)      the data are collected for a lawful purpose directly related to a function or activity of the data user who is to use the data;

(b)     … the collection of the data is necessary for or directly related to that purpose; and

(c)       the data are adequate but not excessive in relation to that purpose.

S.s.(2) of the first principle: It shall be collected by means which are -

(a)       lawful; and

(b)      fair in the circumstances of the case.

The Court of First Instance held that the Commissioner was wrong in his reasoning that a data subject must have “complete freedom” of choice whether to consent or not; that is, a freedom unburdened by any possible adverse consequences and that, if “complete freedom” is in any way compromised, then the collection of private data is made unfair. The data protection principles recognize that there may be circumstances in which the disclosure of data may properly be compulsory (S.s.(3) of the Schedule of the Ordinance).  If the collection of data is obligatory, the data subject must be informed of the consequences of a refusal to supply the data. In the present case, Cathay was merely complying with the requirements of the Ordinance in informing the cabin crew of the possible consequences when failing to disclose the medical records and that advice should not, by itself, be considered as a threat or an exertion of undue influence.  Cathay’s disciplinary procedures ensured not only the protection of Cathay’s interest but also ensured that the cabin crew staff was not in any way prejudiced in their employment without a full and fair investigation.  Therefore, the manner of Cathay in collecting the data could not be said to be unfair.

Proper Explanations should be Given to Data Subjects

Data users such as employers must be aware that Cathay was obliged under the law to ensure all its cabin crew staff are medically fit to perform their duties, hence the disclosure of their medical records was properly and fairly rendered mandatory. Employers should not solely rely on this judgment to indiscriminately collect employees’ medical records.  In particular, when collecting employees’ personal data, including but not limited to medical records, the purpose of collection must be a lawful one and the means of collection must be both lawful and fair. It is advisable that proper explanation should be given to employees regarding the collection and use of the data, the information must be nuanced and clearly reasoned, expressed in modest terms which may not reasonably be perceived to be threatening or oppressive. Also, data subjects must be provided with all necessary information in order to make an informed choice.