Skip to content

Media Statements

Media Statements

Date: 14 February 2012

Investigation Report: A Property Management Company Collected Employees' Personal Data by Covert Recording Device

1.The Privacy Commissioner for Personal Data (“the Commissioner”) Mr. Allan Chiang published an investigation report today (14 February) on a case concerning the collection of employees’ personal data by covert recording by Hong Yip Service Company Limited (“Hong Yip”), which contravened the Data Protection Principles (“DPP”) of the Personal Data (Privacy) Ordinance (“the Ordinance”) on collection of personal data.

2.The two Complainants in this case are ex-employees of Hong Yip. Their duties related to the security of a private residential estate (“the Estate”) managed by Hong Yip. The Complainants were dissatisfied that Hong Yip had invaded their privacy by collecting their personal data through the covert recording device without their knowledge and hence lodged a complaint with the Office of the Privacy Commissioner for Personal Data (“PCPD”).

3.The Complainants were summarily dismissed by Hong Yip on the ground of unauthorized absences from duty because Hong Yip learnt from the images captured by the covert recording device that the Complainants were respectively found to have lingered while they were on duty for a long time in the staff changing room of the Estate.

4.Hong Yip explained that the installation of the covert recording device was for security purpose, in particular for investigation into the owners’ complaints about distribution of promotional materials in the car park. However, upon investigation, the Commissioner found that Hong Yip’s real purpose of installing the covert recording device was to monitor the performance of its employees when they were on duty. Such act of covert surveillance had contravened the requirements under DPP1(2), which required that the Complainants’ personal data must be collected by means which were lawful and fair in the circumstances of the case.

5.The Commissioner did not consider that the seriousness of unauthorized absences from duty justified Hong Yip in conducting covert monitoring, which was highly privacy intrusive. In the circumstances of the case, Hong Yip could have chosen other less privacy intrusive alternatives to monitor the Complainants, e.g. by conducting a surprise check. The Commissioner also found that Hong Yip had not developed a privacy policy on employee monitoring, and that its employees had not been informed of such arrangement.

The Commissioner’s Comments
6.Mr. Chiang stressed, “The decision of this case should not be construed as encouraging employees to use privacy as an excuse for neglect of duty, although whether the Complainants had neglected of duty in this case was beyond this Office’s investigation and jurisdiction. In fact, in order to achieve effective human resources management, it is widely accepted that employers would monitor employees’ daily work performance. This investigation report aims to promote employers’ understanding of personal data protection and the appropriate measures for employee monitoring in compliance with the Ordinance. In this regard, the PCPD’s “Privacy Guidelines: Monitoring and Personal Data Privacy at Work” issued in 2004 advises on the matters that employers need to consider before deciding whether employee monitoring should be conducted (under what circumstances and how to conduct this).”

7.“Covert monitoring by employers is generally regarded as highly privacy intrusive. Hence, covert monitoring should only be used when employers have no other alternative and if it is absolutely necessary to do so, e.g. (a) there is a reasonable suspicion that an unlawful activity is about to be committed, is being committed or has been committed; (b) the need to resort to covert monitoring to detect or to collect evidence of that unlawful activity is absolutely necessary given the circumstances; and (c) the use of overt monitoring would likely prejudice the detection or the successful gathering of evidence of that unlawful activity,” Mr. Chiang added.

8.“Employers should formulate privacy policy related to employee monitoring to clearly explain to their employees the purpose of monitoring, possible cases and ways of monitoring, and they should properly manage the accuracy, retention and access of the data obtained. When formulating and expounding on monitoring policy, they should maintain active communication with employees to enhance transparency of the policy and to promote trust between employers and employees,” Mr. Chiang concluded.

Collection of the Report
9.For details of the case background, findings, the Commissioner’s recommendations and other comments, please refer to the Report. Copies of the Report can be obtained from the PCPD at 12/F., Sunlight Tower, 248 Queen's Road East, Wan Chai, Hong Kong or downloaded from its website (