45 / 192
be mindful that the personal data collected has to be necessary for the lawful functions
and activities of the data user. Under the revised direct marketing regime, the kinds of
personal data to be collected for use in direct marketing shall be clearly stated so that
the data subject can be fully informed before giving his consent or indicating no
objection to the use of his personal data (see paragraphs 5.91 to 5.108 below).
Collection of Health Data of Employees
5.26
It may be a job requirement that an employee must be physically fit. For example, for
the sake of public safety, a driver of public vehicles may need to show that he is not
suffering from illness that will render him physically unfit to operate the vehicles. If the
employee’s health data is required to satisfy such job requirements, the employer should
ensure that only necessary, adequate but not excessive health data is collected.
5.27
The collection by Cathay Pacific Airways Limited (“CX”) of past medical data of its
cabin crew members was the subject matter of an investigation carried out by the
Commissioner in 2008.
22
CX required its cabin crew members who took long or frequent
sick leave to consent to the release of their medical data which related to the causes of
their absences for the previous twelve months.
The Commissioner found that the
collection of medical data under the specific circumstances of the case was necessary,
adequate but not excessive for the purpose of rehabilitation and assessment of the
cabin crew members’ suitability to perform the inherent requirements of the job, and
thus there was no contravention of the requirements under DPP1(1).
5.28
There are situations where more personal data from an employee is required before his
supervisor can grant approval for a medical leave application. For instance, in AAB
No.23/2013, an employee produced a certificate issued by a hospital confirming
attendance by the employee of a “health talk” to support his medical leave application.
Since the mention of the “health talk” in the certificate alone was not sufficient to show
that it was related to the sickness of the employee, the employer asked the employee to
produce the medical appointment slip for processing his leave application. The AAB
agreed with the Commissioner that the collection of the medical appointment slip in the
circumstances of the case was necessary to support that the leave applied for was
related to the employee’s medical condition.
Collection of Criminal Records of Prospective Employees
5.29
A prospective employer should be careful when collecting personal data of a sensitive
nature, such as health data, credit data and criminal records from a job applicant.
In
relation to the collection of criminal records of sex offenders, the Government
introduced, on 1 December 2011, an administrative measure, known as Sexual
Conviction Record Check Scheme,
23
whereby a prospective employer can, with the
consent of the job applicant, seek confirmation from the police of any criminal records
of the job applicant relating to a list of sexual offences covered under the Scheme. The
22
See
AAB No. 3 /2007
.
23
The details on the Scheme can be found on the website of the Hong Kong Police Force.