Q: We are trading company. An employee of our company was charged for theft. As an employer, are we entitled to check with the police relating to prosecution of the employee and the outcome of the Court's decision?
A: The question has to be looked at from two angles: your collection of such information and release of the information by the Police to you.
So far as your collection of the information is concerned, if such information is given to you orally and not recorded by you, it does not amount to collection of personal data as defined in the Personal Data (Privacy) Ordinance ("the Ordinance") and hence the data protection principles are not engaged at all.
If there is collection of employee's personal data, such collection will then be subject to the requirements of data protection principle ("DPP") 1 of Schedule 1 to the Ordinance. DPP1(1) of the Ordinance provides that personal data shall not be collected unless the data are collected for a lawful purpose directly related to a function or activity of the data user who is to use the data; the collection of the data is necessary for or directly related to that purpose; and that the data are adequate but not excessive in relation to that purpose. It seems to us that if the purpose for collecting the data to which you refer in your letter is, say, for satisfying yourself as an employer as to the integrity of your employee, this may be considered as directly related to your functions and activities as a data user. Hence, the collection by you of the data may be in accordance with the requirements of DPP1(1). However, as a general matter, please note that the Rehabilitation of Offenders Ordinance (Cap. 297) contains certain provisions restricting the disclosure of information relating to previous convictions, or the use of such information as a ground for dismissing or excluding the individual concerned from employment. If you have any doubt concerning whether your intended use of such information is lawful, you should consult your legal advisers.
DPP1(2) of the Ordinance provides that personal data shall be collected by means which are lawful and fair in the circumstances of the case. In determining whether there is unfair collection of personal data, we will take into account that (1) there is no direct relationship between you and the Police, and (2) the Police's disclosure of the offenders' information relating to his/her convictions to third parties is generally considered outside the reasonable expectation of the offenders in relation to the use of his/her personal data. It is therefore advisable to collect the data from the employee concerned direct or after prior consent of such collection from the employee concerned.
On the other hand, the release of personal data to you by the Police is covered by DPP3 of the Ordinance. DPP3 provides that personal data shall not, without the prescribed consent of the data subject, be used (including disclosed or transferred) for any purpose other than the purpose for which the data were to be used at the time of collection of the data, or for a directly related purpose. In the present case, it seems to us that the purpose of the Police in collecting the information concerned is for the purpose of criminal investigation and prosecution, not for the purpose of assisting an employer to make an assessment of the integrity of the individual concerned. Therefore, any disclosure of the data (which includes disclosure of information inferred from the data) by the Police for this purpose would appear to be in contravention of the requirements of DPP3, unless the prescribed consent of the employee in question has been obtained. Please note, however, that prescribed consent under the Ordinance means essentially consent given expressly and voluntarily. Hence, any consent obtained by exerting pressure on an individual will not be prescribed consent. Even if prescribed consent is obtained from the individual, the Police may still choose not to release the information to you on other legal or policy grounds.
Lastly, there is, at least theoretical, the possibility that you could gather the information you want from the courts. This is a natural consequence of the fact that Hong Kong operates under an open justice system. Generally speaking, any person may view the court lists, some of which are also published in newspapers to ascertain the names of individuals against whom criminal cases are being heard in the courts on any particular day. The verdict in all criminal cases is also made public at the time it is given. Incidentally, as a general matter, such disclosure of information by the courts in these circumstances is considered by us to be consistent with DPP3.
uploaded on web in February 2009