Employers duties under the National Security Law from a Data Privacy Perspective

Of the 66 articles comprising the NSL, Article 43 has attracted a lot of attention due to the wide-ranging powers it provides to the Hong Kong police force. For example, under Article 43, and the related implementation rules, a Hong Kong police officer may apply to a magistrate for a warrant to enter and search a place (including an office) and electronic devices for evidence relating to an alleged offence under the NSL and, in exceptional circumstances, if the police officer is not below the rank of Assistant Commissioner of Police, he/she may authorise his/her officers to carry out the search without a warrant.  In addition, any person who is suspected on reasonable grounds to possess information relevant to an investigation under the NSL can be required to answer questions and furnish such information (Article 43(7)).

As a result, employers in Hong Kong are wondering whether their obligations to comply with police requests under the NSL and their obligations regarding employees’ personal data under Hong Kong’s Personal Data (Privacy) Ordinance (“PDPO”) are compatible or in conflict.

Under the PDPO, any data collected from an employee can be used by the employer only for the purpose for which it was collected. Providing personal data of an employee to a police officer to assist investigation may potentially breach a core data protection principle.  In addition, where employers hold personal data and confidential information of third parties, such as clients, they will owe a duty to the third party under the PDPO and a common law and/or contractual duty of confidentiality in relation to the confidential information, which they will need to take into account if requested to provide information or access to information under the NSL.

Employers should bear the following in mind when faced with a situation where their obligations under the PDPO and NSL are both in play:

Practical considerations

• Under the PDPO, there are exemptions for providing personal data in connection with the investigation of a crime or the apprehension of an offender. A request in relation to the NSL may fall within those exemptions, and the provision of relevant data to assist investigation may not constitute a breach of the PDPO. However, employers should consider whether they can rely on the exemptions in the PDPO on a case-by-case basis, and not just assume they can.
• Before any entry and search of a workplace is conducted, the employer should request to see a copy of the warrant, or, if no warrant is issued, be satisfied that appropriate authority has been obtained and that the urgency of the circumstances justifies a search without a warrant.
• The employer should aim to be present at the premises during the whole search to check that only data and information relevant to the investigation is disclosed to the law enforcement agencies, and to prevent to the extent possible confidential information of any third party (especially clients) from being unnecessarily disclosed.
• Employers should seek assistance from legal counsel (criminal, data privacy and employment) when faced with a police request or search to ensure they tread the right path of compliance with both the NSL and the PDPO in the specific circumstances.
• Employers should consider reviewing their personal information collection statements and data privacy notices to ensure they are able to provide personal data to law enforcement agencies in accordance with the requirements of the NSL. For instance, they should make clear that where permitted or required by law, the employer may disclose employee personal data to third parties, such as the police, without employee consent.
• Employers should ensure that their management, HR and communications teams are trained on the NSL and its implications and know how to coordinate with each other to respond to any requests from law enforcement agencies under the NSL and be ready with any internal and/or external statements that may be necessary.
• It should also be noted that if there is any conflict between the NSL and local Hong Kong laws, then the provisions of the NSL will prevail (Article 62).