Employers have legitimate reasons to monitor their employees in the workplace. However, they should be very careful about the collection, use, security and retention of the employees’ personal data which were collected in the course of staff monitoring because such personal data are protected by the Personal Data (Privacy) Ordinance.

Various means of staff monitoring

Many employers provide their employees with computers, telephones and other kinds of equipment for carrying out their duties. As the employers are “paying” for the employees’ working hours and equipment, they believe that they have the absolute right in monitoring their employees. Some employers may use various means to monitor their staff (e.g. taking record of the employees’ finger print for attendance record, reviewing the employees’ emails which were sent or received through the company's computer, reviewing the record of the employees’ website browsing activities, recording the employees’ telephone calls or requesting for the record of the telephone calls of the employees which were made via the company's mobile phone). Some employers even install close circuit TV systems (“CCTV”) in the workplace to “watch” the activities of the employees.

Justification for staff monitoring

Staff monitoring through the various means may be necessary because employers want to make sure that the quality of goods and services provided by their employees meet the company's standard. If complaints are made against employees, employers may require the relevant record to resolve the dispute with the customers, to defend the company or to prevent similar complaints. In some industries, telephone calls between employees and customers must be recorded as required by the regulatory authorities (e.g. services provided by the financial institutions for the sale and purchase of shares via telephone).The installation of CCTV in banks and jewellery shops may be essential for the safety and protection of the employees.

Collection and handling of employees’ personal data

According to the Personal Data (Privacy) Ordinance (“PDO”), “personal data” means “any data relating directing or indirectly to a living individual; from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and in a form in which access to or processing of the data is practicable.” Based on such definition, fingerprint data, email address, telephone number and photographs of employees will be regarded as personal data. Therefore, employers may be collecting the personal data of employees during the course of staff monitoring. As such, employers should comply with the requirements of the PDO in relation to the collection, use, accuracy, retention and security of the employees’ personal data.

Employers should obtain the employees’ personal data in a fair way. Employees should be informed of the reasons, justifications, purposes and uses of their personal data. Employees should also be notified of the classes of person to whom their personal data may be transferred. Their consent should be obtained before employers use the monitoring devices which will collect the employees’ personal data.

Employers should also ensure that the personal data collected are not excessive for the purposes they are collected, to ensure the security of the personal data collected and to retain them only for a period that is necessary for serving the purposes of the collection.   

Employees should also be given a right to make enquires with employers concerning their personal data collected and have access to them.

 What is the most suitable method of staff monitoring?

The Office of the Privacy Commissioner for Personal Data had published a number of guidelines to assist employers in determining the most suitable staff monitoring measures. Such publication includes the “Privacy Guidelines: Monitoring and Personal Data Privacy at Work”, “Guidance on Collection of Fingerprint Data” and “Point to Note for Employers of Domestic Helpers”.

According to the above guidelines, employers should consider 3 “A” in relation to the method of staff monitoring:

1.       Assessment: whether the particular method of staff monitor (which will collect the    employees’ personal data) is necessary and whether a balance can be struck between the protection of the company’s interest and the privacy of the employees.

2.       Alternative: whether there are less intrusive means which can achieve the same purpose of staff monitoring.

3.       Accountability: employers should communicate with the employees, explain the reasons for the particular method of staff monitoring and obtain their consent before implementing the staff monitoring measures.

Management of the employees’ personal data

The guidelines published by the Privacy Commissioner also suggest that employers should consider 3 “C” in relation to the management of the employees’ personal data:

1.       Clarity: employers should have a clear policy in relation to staff monitoring and employees’ privacy. The policy should set out the purposes of the staff monitoring measures, the rights of the employers in conducting various means of staff monitoring, give examples of the prohibited acts and the consequences of a breach of the privacy policy.

2.       Communication: employers should consult and communicate with their employees, conduct regular training and review of the policy to suit the changing work environment.

3.       Control: employers should ensure the security of the employees’ personal data collected during the course of staff monitoring, use such personal data for the specified and related purposes only. Employees should also have the right to access their personal data collected by the employers.

Conclusion

In view of the requirements of the PDO concerning the personal data of living individuals, employers should consider the various factors mentioned above and communicate with the employees before implementing any staff monitoring measures which will unavoidably collect the employees’ personal data. Effective and constant communication between employers and employees are essential for building and maintaining a harmonious work environment which will lead to the business growth and development of companies.