2017年2月28日
資訊洞見
Proposed legislation in the United States seeks to ban employer access to social media sites used by employees. As statistics show a growing trend for financial services intermediaries to use social media both for personal and business communication, financial services industry groups in the US are concerned the legislation may conflict with the supervision and record-keeping duties of their members.
What is the position in Hong Kong?
In summary, the Personal Data (Privacy) Ordinance (PDPO) does not prohibit an employer from monitoring employees’ social media postings. However, any employee monitoring that results in the collection of personal data must comply with the PDPO including the data protection principles and also the Monitoring Guidelines issued by the Privacy Commissioner.
The PDPO does not specifically deal with employers’ ability to monitor employees’ social media postings. Instead, the PDPO provides a number of principles which regulate the purpose and manner of personal data collection, the retention of personal data, the use of personal data, the security of personal data and the rights of a data subject regarding his personal data.
Under the Monitoring Guidelines, there are three steps an employer should take when evaluating the need for employee monitoring: (1) assessing the risks that employee monitoring seeks to manage and the benefits to be derived from applying it to those risks; (2) considering whether there are alternatives to employee monitoring; (3) accepting the responsibility and being accountable for the proper conduct and operation of the monitoring activities.
When assessing the risks that employee monitoring seeks to manage, an employer should not only identify the risks but also justify the measures to be taken having regard to the existence and extent of those risks. The employer must have well-founded reasons for the monitoring and ensure that the monitoring is related to and commensurate with its business needs: for example to protect business assets, intellectual property or to minimise the risk of the employer incurring liability for the actions of its employees. So where employers in Hong Kong permit employees to use social media for professional purposes and the firms have a duty, such as under the Securities and Futures Commission’s licensing code of conduct, to supervise business related conduct, this is likely to constitute a good reason for monitoring.
Is the employee’s consent required?
In general, employee monitoring should be conducted in an overt manner unless it is justified by the existence of special circumstances. An employer should obtain express consent from an employee to use personal data obtained from social media sites. This can be achieved by incorporating consent into the employer’s standard data collection statement and/or the employment contract to clarify the scope within which personal data gathered from social media sites can be used during the employment.
In addition, the implementation of a suitably drafted social medial policy will allow an employer to set guidelines on an employee’s use of social media and to protect the employer’s interest against prospective legal liability and harm to its reputation from the use of social media.
