Lexis Insights

Legal News, Views, and Insights from LexisNexis Hong Kong

16 April 2020 | by LexisNexis Hong Kong

Introduction

The Privacy Commissioner for Personal Data (“PCPD”) issued a statement in late February 2020 clarifying the position of privacy law with regards to the issues in obtaining personal data/information of the potential carriers or individuals of the novel coronavirus (“COVID – 19”) through the use of social media and tracking technologies.

The General Rule

Personal data obtained from the social media in a public domain is regulated by the Personal Data (Privacy) Ordinance (Cap 486) (“PDPO”). The use of personal data must be consistent with or directly related to the original purpose for which the data is collected.

Tracking an individual or an employee for potential infection of COVID – 19 requires prior consent

If an employer obtains information about an employee or an individual from a social media chat group, that information must be used for the same purpose of that chat. If the information is being used for a different purpose, like tracking potential virus carriers, then prior consent of the parties concerned must be obtained. The Data Protection Principle 3 (“DPP 3”) under the PDPO protects one’s personal data from being abused or misused as such personal information belongs to the individual concerned. Further, personal data privacy is a fundamental human right.

Personal data rights are not absolute

However, personal data privacy right is not an absolute right. It may be subject to other competing rights or interests, including the absolute right to life and public health.

Right to Life

“Right to Life” refers not only to the right of life of the potential carrier of the virus or the data subject, but also to the general public in the society. The United Nations Human Rights Committee affirmed that life is a supreme right and the government should take appropriate measures to address the general conditions in the society that may be affected by the prevalence or communicable disease such as COVID – 19, which may be a direct threat to life.

Further, COVID – 19 is regarded as one of the notifiable infectious disease under the Prevention and Control of Disease Ordinance (Cap 599), which requires all registered medical practitioners to notify the Centre for Health Protection of the Department of Health (“The Centre”) of all suspected or confirmed cases of the coronavirus. The Centre is responsible for conducting surveillance and control of COVID – 19. So, if an individual or an employee is suspected of having close contacts with infected persons, it would be in the public interest to closely monitor their whereabouts, including places and the people that they have visited and contacted. The objective is to control the virus to not spread any further in the society.

Exceptions to the DPP 3 in the interests of health or public interest

Section 59 of the PDPO provides for cases in which the use of personal data may be exempted from applying DPP 3 in situations relating to safeguarding the physical or mental health concerns of the data subject or of any other individual for public interest. That is to say, any breach of the general rule on the use of data without the consent of the individual may be exempted or rescued by the fact that the misuse arises from the need to protect public health.

Particularly, section 59(2) of the PDPO states that in circumstances where applying the restrictions of DPP 3 would be likely to cause serious harm to the physical or mental health of the data subject or any other individual, then personal data in relation to the identity or location of the data subject may be disclosed to a third party without the individual’s consent.

Pragmatic tips in the business context

Businesses must be meticulous in handling such information and avoid the risks of breaching the PDPO or acting in non-compliance to its own privacy policy before sharing such personal data to various authorities.

In addition, businesses should be mindful that the personal data collected should generally not be kept longer than is necessary once its primary purpose of obtaining such personal information is already satisfied. Otherwise, such information should be erased at the earliest practicable availability.

The Lexis Insights articles are provided for reference purposes only and are not intended, nor should they be used, as a substitute for professional advice or judgment or to provide legal advice with respect to specific circumstances. If you require any legal advice or other expert assistance, please consult a competent professional adviser.

For enquiries about the following publications, please contact your Account Manager via marketing.hk@lexisnexis.com