Guidelines

Guidelines on Monitoring and Personal Data Privacy at Work

On the 17th December 2004 the Privacy Commissioner issued the "Privacy Guidelines: Monitoring and Personal Data Privacy at Work" ("the Guidelines").

The drafting of the guidelines has been influenced by the belief that employees should not forfeit all privacy rights afforded under the provisions of the Ordinance simply by virtue of entering the workplace. However, in fairness to employers, the PCPD has avoided making any moral judgement on whether employee monitoring should, or should not, be used to effectively manage the assets, resources and affairs of the employer. While that decision remains at the discretion of the employer it is nonetheless one that the PCPD would prefer to be taken in consultation with employees.

The Guidelines are designed to appeal to both employers and employees by offering practical advice that balances the legitimate business interests of employers with the personal data privacy rights of employees. Data users attention is drawn to their obligations under the provisions of the Ordinance, the factors that should be taken into consideration prior to determining whether employee surveillance is appropriate and the privacy issues that need to be addressed where such systems are in operation. In addition, employees' attention is drawn to the expectations they should have of their employers where their personal data is collected during the course of conducting monitoring.

The Guidelines adopt a 3A's and 3C's approach to determining whether employee monitoring is, in the first instance, an appropriate measure, and, where that is deemed to be the case, how employers can develop privacy compliant practices in the management of personal data.

The 3A's approach offers advice to employers by way of a three-step process:

• Assess the appropriateness of employee monitoring as a management tool;
• consider the Alternatives to employee monitoring; and
• recognize the need to accept Accountability for the management of employees' personal data privacy.

These considerations are supplemented by the 3C's which provide practical steps for employers to ensure:

• Clarity in the promulgation of employee monitoring practices by encouraging employers to draft and disseminate an Employee Monitoring Policy;
• Communicate the Employee Monitoring Policy to staff; and
• exercise Control over the processing, security, use and retention of employee monitoring records.

It is hoped that employers engaged in employee monitoring will respond positively to the Guidelines by either embracing the practices outlined or using them as a model upon which to formulate an in-house policy that better suits the needs of an individual organization.

To supplement the Guidelines the PCPD simultaneously released an information leaflet: "Points to Note for Employers of Domestic Helpers." In view of the large number of foreign domestic helpers employed in Hong Kong the PCPD felt that it would be beneficial to offer advice to householders. The principal reason for this is that the domestic household is an unusual form of employment environment in that it is both a place of work for the employee and residence for both employers and employees. The pointers address whether monitoring in the home is really necessary, the fairness and transparency of personal data collection and the retention of video records.

The Guidelines and Points to Note can be viewed in full at : http://www.pcpd.org.hk/english/publications/files/monguide_e.pdf http://www.pcpd.org.hk/english/publications/files/DH_e.pdf