Data privacy vs public health needs

With tracking and tracing of potential Covid-19 cases playing such a vital role in Hong Kong’s fight against the pandemic, the city’s privacy watchdog has reminded employers about appropriate use of personal data. Boase Cohen & Collins Associate Allison Lee and Trainee Claire Chow examine the guidelines.

Hong Kong, 22 June 2020: The Privacy Commissioner for Personal Data of Hong Kong (the “Commissioner”) recently published guidelines to draw employers’ awareness to the collection and use of personal data in the current public health situation.

The Commissioner, Stephen Wong, acknowledges that there is a legitimate basis for employers’ assistance to control the spread of the coronavirus by collecting additional employee’s personal data. At the same time, he reminds employers that the data collected must be “necessary, appropriate and proportionate to the purpose to be achieved”.

Under the Personal Data (Privacy) Ordinance (“PDPO”), exemptions are provided for in situations of public health emergency.

1. Section 59(1) of the PDPO provides that personal data relating to the physical or mental health of the data subject is exempt from the provisions of either or both of data access requests (Data Protection Principle 6 and section 18(1)(b) of the PDPO) and restriction on data protection (Data Protection Principle 3) in any case in which the application of those provisions to the data would be likely to cause serious harm to the physical or mental health of the data subject or any other individual.
2. Section 59(2) further provides that personal data relating to the identity or location of a data subject is exempt from the provisions of data protection (Data Protection Principle 3) if the application of those provisions to the data would be likely to cause serious harm to the physical or mental health of the data subject or any other individual.

The Commissioner sets out various important points in the guidelines, including:-

1. For the purpose of protecting public health and/or the health of their employees, it is generally justifiable for employers to collect temperature measurements and request travel data from employees who have returned from overseas.
2. For the purpose of tracking down and treating the infected, it is generally also acceptable for employers to disclose the identity, health and location data of employees to the government or health authorities.
3. Proper and strong digital security should be in place to safeguard the transfer and use of documents and data when employees have to work from home during the pandemic.
4. Employers should be transparent and explain the proposed measures to be taken to safeguard the employee’s health.

In issuing the guidelines, Mr Wong stresses: “The public health and safety of the community in times of the pandemic remains our primary concern. We should be mindful of the compelling public interests in the current public health emergency when considering compliance with data protection laws, which should not be seen as hindering the measures taken in fighting or combating the pandemic especially when the collection and use of personal data is in the public interest and/or in the interest of public health.”

For clarity, the Commissioner states that personal data collected by employers for combatting Covid-19 must not be used or disclosed for other unrelated purposes, unless voluntary consent is obtained from the individuals concerned or exemptions under the PDPO apply.

He also says that if an employee unfortunately contracts Covid-19, the employer may notify other employees, visitors, the property management office and other interested parties without disclosing personally identifiable information of the infected. For example, it is generally sufficient for the employer just to issue a notice with information that it has staff infected. Under most circumstances, disclosure of the name and other personal particulars of an infected employee in the notice will not be considered as necessary or proportionate.

To summarise, in the time of a pandemic, protecting public health emerges as the absolute right. However, with the increasing awareness of data privacy rights, employers should understand their legal obligations and continue to comply with all personal data protection principles. They should take proactive measures to ensure the safety and health at work of employees.

The coronavirus pandemic has posed data privacy concerns for employers and staff alike.