49 / 192
5.39
Another investigation
33
carried out by the Commissioner on the issue of covert
surveillance was in relation to the installation of pinhole cameras by a property
management company responsible for managing a private residential estate with a car
park. The relevant facts are that two of the employees of the property management
company were dismissed as they were found lingering for long periods of time in the
changing room while on duty. Such conduct was discovered as a result of their images
being captured by the pinhole cameras installed by the employer on the wall of the
staircase leading to the changing room. The employees were not aware of the
existence of the pinhole cameras and lodged complaints to the Commissioner on the
grounds that their personal data was collected by means which were unfair.
5.40
The employer explained that after it had received complaints from the residents of the
estate that promotional materials were placed on the windscreens of cars in the car
park, the pinhole cameras were installed to investigate the complaints and for security
reasons, not for staff monitoring. Following the Eastweek case, the Commissioner found
that the employer had collected the personal data of the employees when their act of
lingering was recorded by the pinhole camera which the employer relied on when
terminating their employment. As overt surveillance devices, i.e. CCTVs, were already
installed for security reasons inside the car park which should have been sufficient to
detect and deter the conduct complained about by the residents of the estate, the
employer had failed to give valid reasons for installing the pinhole cameras, which were
in fact used for the purpose of monitoring employees. Having considered the intrusive
nature of engaging in covert monitoring activities without sufficient justification, the
Commissioner found the employer to have contravened DPP1(2).
5.41
The act of covertly collecting an employee’s web-browsing activities was criticized by
the AAB in its decision, AAB No. 14/2006. In this case, the employer asked for the
computer log-in password of the employee and used the password to access the
computer assigned for use by the employee after he had left the office. The employer
collected the cookies recording usage of the computer and used the information to
terminate the contract of employment of the employee. According to the policy of the
employer, the computer was the employer’s property and could only be used for work
purposes. The employee was found to have used the computer for browsing non-work
related websites. The AAB expressed the view that while the computer was the property
of the employer, there existed other less privacy intrusive alternatives to collect the
information contained in the computer which might include personal data of the
employee, for instance, by collecting the web-browsing activities through the server
administrator or collecting the data in the presence of the employee. Following the
AAB’s directive to investigate further into the case, the Commissioner found that the
employer had in the circumstances failed to show that the personal data was collected
by fair means.
5.42
In a case concerning the secret recording of conversations, the Commissioner
considered that the personal data of the complainant was collected by unfair means.
The conversations were secretly recorded by a teacher during a lunch meeting that
33
See Investigation Report No. R12-4839, available on the Website:
https://www.pcpd.org.hk/english/enforcement/commissioners_findings/investigation_reports/files/R12_4839_e.pdf