PCPD - Response to Judgment of judicial review application by Cathay Pacific

1.    Cathay Pacific Airways Limited ("Cathay") required its cabin crew members who took long or frequent sick leave to disclose to Cathay their medical records of the past 12 months; otherwise disciplinary procedures would be taken. The means of collecting these data was found by the Privacy Commissioner ("the Commissioner") to be unfair and in contravention of Data Protection Principle 1(2) because the data were collected under the threat of disciplinary process. In pursuance of the power vested on him, the Commissioner served an Enforcement Notice on Cathay requiring it to cease the practice and destroy all the medical records it had collected from its employees.

2.    Dissatisfied with the Commissioner's decision, Cathay lodged an appeal with the Administrative Appeals Board ("AAB"). The appeal was heard by the Board on 27 February 2008 chaired by Mr. Arthur Leong Shiu-chung, GBS, a retired Court of Appeal Judge, and two Board members. On 2 May 2008, the Board handed down its decision, which unanimously upheld the decision of the Commissioner and dismissed Cathay's appeal.

3.    Cathay was dissatisfied with the decision of the AAB and applied for judicial review in the Court. The Court today allowed the judicial review application of Cathay. Both AAB and the Commissioner lost their case. The Commissioner is disappointed with the decision of the Court. The Judgment is being examined. According to the preliminary advice of a Senior Counsel, the Commissioner is suggested to lodge an appeal against the decision.

4.    Pursuant to legal requirement, an appeal should be lodged within 28 days. The Commissioner will take all factors into consideration including the adequacy of the grounds for appeal, involvement of substantial public importance and the proper utilization of public fund.

5.    Although the Commissioner is disappointed with the Judgment, he reiterated that his decision was based on the principle to protect the personal data privacy of employees, in particular, employees' personal data should be collected by means that are lawful and fair, especially when employees’ sensitive medical records are collected by employers.

6.    Data users must note that as the Judgment was made on the special circumstances of the case, they should not rely on the Judgment to indiscriminately collect employees' medical records. When collecting employees' personal data, data users shall strictly comply with the Data Protection Principles. Any employee who believes that his/her personal data privacy is intruded, he/she may lodge a complaint with the Commissioner.

END