Supervisors requiring sick staff to provide a copy of the check-up cards for file record.

Q: There are concerns from the staff about the practice of supervisors requiring the subordinates to provide a copy of the check-up cards. The purpose is to show the date and time of medical appointments for record purpose. However, the health status of a staff member will also be revealed by such a copy. Given that the staff member can produce the check-up card for inspection by the supervisor, the question is whether the said practice contravenes the Personal Data (Privacy) Ordinance ("the Ordinance")?

A: Data protection principle ("DPP") 1(1) in Schedule 1 to the Ordinance requires that a data user shall not collect personal data which are excessive for a lawful purpose directly related to the function and activity of such data user. In the case you mentioned, we note that while the date and time of a medical appointment may be relevant to staff management (e.g. as a reason to permit absence from duty), the health status of the staff may not be so relevant. Accordingly, the collection of such data on check-up cards may amount to excessive collection of personal data in contravention of DPP 1(1).