Under the outbreak of the coronavirus, there have been strike actions of hospital staff in Hong Kong to demand full closure of Hong Kong’s borders with mainland China. The strike actions finally ended on February 7^th following the voting of the hospital staff against the extension of the strike.

In the wake of the strike, there has been much discussion on whether the hospital staff have a right to strike, and what follow-up actions may be taken by the Hospital Authority (“HA”) against them.

Legal context of strike actions  

Article 27 of Hong Kong’s Basic Law states: “Hong Kong residents shall have freedom of speech… and the right and freedom to form and join trade unions, and to strike.”

The Employment Ordinance prohibits an employer from summarily dismissing an employee who takes part in a strike[1].  It further mandates that an employee’s continuous employment is intact if the individual is absent from work for the whole or part of any hour because of a strike, as long as the strike is legal[2].

Restrictions on the right

The right to strike, just as other freedoms and rights enshrined in the Basic Law, is subject to restrictions. Article 39 of the Basic Law provides that the rights and freedoms enjoyed by Hong Kong residents shall not be restricted unless as prescribed by law.

This results in 2 tests to be applied:

1. Is a restriction prescribed by law; and
2. Does it meet the requirements of the Bill of Rights, which lays out the limits on the restrictions?

The limit to the restriction on right to strike, as set out in Article 16 of the Bill of Rights, is that the restriction has to be provided by law, necessary for respect of the rights or reputations of others; protection of national security or of public order, or of public health or morals.

As such, if employers wish to limit the right of its workers to join a strike legally organized by a labor union, it should take care to ensure the limitations it imposes satisfy the above requirements.

Rights of employers and employees

There may be some confusion as to whether or not employers can take action against employees for participating in strikes.

Under the Trade Unions Ordinance, a strike is defined as “the cessation of work… in consequence of a dispute, done as a means of compelling their employer … to accept or not to accept terms or conditions of or affecting employment”.

In other words, if the employees are protesting about issues that do not relate to the terms and conditions of his employment, any cessation of work arising thereof may not be qualified and protected as a strike under the Trade Unions Ordinance.

In 2000, certain pilots of Cathay Pacific in a registered trade union carrying out industrial action protesting against their rostering practices and contract entitlement. It was held that industrial action was within the definition of activities of a trade union, and thus protected by statute. As a result, termination of these pilots’ employment by Cathay Pacific was found to be in breach of the Employment Ordinance[3]. 

Taking the recent strike by hospital staff as an example, the participants were reportedly lobbying for full closure of the HK-China borders.

On one hand, the hospital staff may have a valid argument pertaining to their conditions of work, that the opening of HK-China borders could cause hospitals in Hong Kong to be overwhelmed by a surge in coronavirus cases as mainland Chinese seek to use Hong Kong healthcare system.

As such, it would increase the hospital staff’s workload as well as risk of exposure to the virus, which will potentially pose harm to their health and wellbeing.

On the other hand, it may also appear to some that the “strike” was not targeted at HA as an employer, but the broader government instead. It may also be said that the executive policy relating to border control is not materially related to the terms and conditions of hospital staff under HA’s employment.

It is therefore for the Hong Kong court, if the matter is to be brought up to legal proceedings, to decide if the hospital staff’s cause is or is not related to the terms and conditions of employment or their work in a public hospital.  If the court does not find a rightful cause of the action, the hospital staff’s action would not be legally classified as a “strike” under the Trade Unions Ordinance, which means HA can in principle take action against their absence from work in accordance with its internal disciplinary procedures.

The abovementioned protections under EO would therefore not be available to the participants of the “strike” either.  The writer does not know if HA may take this matter any further but believes that it is a matter of both employment and also political concern under the present circumstance, while everyone is still trying to battle against the outbreak of coronavirus.

Discussion

For pure legal discussions, in the event that the recent strike action by the hospital staff is found to be co-related to the terms and conditions of their employment, the next issue is whether any restriction on their right to strike is prescribed by law and at the same time necessary for the protection of some legitimate interests.

To define the reach of necessity, the proportionality test has to be applied[4]. A restriction will be proportionally justified, when it is connected to a legitimate purpose, and when it does not intervene in the right more than necessary to accomplish that purpose.

Some have argued that to impose a restriction on the hospital staff’s right to strike is connected to the legitimate purpose of protection of public health. The natural consequence of their strike would be reduction of staff at work in the hospitals, decreasing the quality of care provided to patients and adversely affecting the public healthcare system in Hong Kong. Public order, which includes the common welfare and collective needs of the community[5], will also be affected.

If this argument stands, any such restriction would have to be no more than necessary in protecting public health and wellbeing. In imposing any restriction on right to strike, the HA, and indeed employers in general, should be mindful of this issue.

Where employees are of the view that their fundamental rights have been infringed upon, Article 35 of the Basic Law provides that Hong Kong residents have the right to judicial remedies, which includes raising a judicial review.     

Balancing the rights of employees and employers

In view of the above illustration of example, when considering a strike action, employees and trade unions should be aware of the requirements on and legitimate causes of strikes for such to be protected under relevant laws.

Meanwhile, employers should recognize employees’ fundamental right to strike as described above.  If a strike does happen, an employer should consider not only the employees’ legal right to strike, but also how to balance the collective interests of employees and other stakeholders of the employing company as well as public interest, if it is a matter of concern.

The rights and freedoms of the residents of Hong Kong are not absolute under the Basic Law. The laws discussed were drafted with a view to protecting and strike a balance between individual rights, public welfare and collective interests of the society as a whole.

If you have any question regarding the topic discussed or on other employment issues, please contactvictor.ng@oln-law.com.

This article is for reference only. Nothing herein shall be construed as any formal legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

[1] Section 9(2), Employment Ordinance.

[2] Para 4(a), First Schedule, Employment Ordinance.

[3] Blakeney-Williams v Cathay Pacific Airways Ltd (2012) 15 HKCFAR 261

[4] Leung Kwok Hung v HKSAR [2005] 3 HKLRD 164, paras 182 & 185

[5] Wong Yeung Ng v. Secretary for Justice [1999] 2 HKLRD 293, (CA)

Prelude

With death toll and confirmed cases mounting up, HK and many other major cities have experimented the largest scale of flexi-working and/or working from home arrangements for its employees in an unprecedented way to safeguard their health and safety. Although affording employees with the option to work from home can no doubt reduce close personal contact and thereby disease spreading, and is advantageous from a public health viewpoint, what sort of legal risks do companies put themselves into when this happens? This article examines this topical question by focusing on the confidentiality and data privacy issues arising from such work-from-home arrangements, as well as the dangers they present in terms of confidential information and data privacy. Finally, it suggests the “vaccines” which may eradicate such confidentiality and data privacy pitfalls.

Confidentiality and Data Privacy Obligations

What confidentiality and data privacy obligations are certain employers and professionals bound by, which equally apply in work-from-home arrangements?

Confidentiality

In addition to the general common law principles on confidentiality, many professionals are expected to comply with tighter industry-specific confidentiality obligations in relation to client’s information and other confidential information. Such requirements are often enshrined in their respective code of conduct or guidelines. For lawyers, it can be found, for example, in Principle 8.01 of the Hong Kong Solicitors’ Guide to Professional Conduct, which expressly states that:

“a solicitor has a legal and professional duty to his client to hold in strict confidence all information concerning the business and affairs of his client acquired in the course of the professional relationship, and must not divulge such information unless disclosure is expressly or impliedly authorized by the client or required by law or unless the client has expressly or impliedly waived the duty.”

Accountants, on the other hand for instance, are subject to no less stringent confidentiality requirements. Section 100.5(d) of the Code of Ethics of Professional Accountants of HKIPCA requires practitioners to:

“…respect the confidentiality of information acquired as a result of professional and business relationships and therefore, not disclose any such information to third parties without proper and specific authority, unless there is a legal or professional right or duty to disclose, nor use the information for the personal advantage of the professional accountant or third parties.”.

Breach of such confidentiality obligations by a certified public accountant can result in various serious penalties such as reprimand, fine, cancellation of practicing certificate, removal from the register of certified public accountants and non-issue practicing certificate for a specified number of years.

Data Privacy

As for data privacy, companies in any trade or profession who collect data from third-parties including clients are bound by the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”). In the case of accounting firms, access to underlying documents (including employment contracts, employer’s returns etc.) during the auditing exercise may contain personal data and trigger privacy issues. There are six data protection principles (DPPs) set forth in the PDPO, which include:

• DPP1 Data Collection
  • Personal data must be collected in a lawful and fair way, for a purpose directly related to a function /activity of the data user, data subjects must be notified of the purpose and the classes of persons to whom the data may be transferred, and data collected should be necessary but not excessive;
• DPP2 Accuracy & Retention
  • Practicable steps shall be taken to ensure personal data is accurate and not kept longer than is necessary to fulfil the purpose for which it is used;
• DPP3 Data Use
  • Personal data must be used for the purpose for which the data is collected or for a directly related purpose, unless voluntary and explicit consent with a new purpose is obtained from the data subject;
• DPP4 Data Security
  • A data user needs to take practicable steps to safeguard personal data from unauthorized or accidental access, processing, erasure, loss or use;
• DPP5 Openess
  • A data user must take practicable steps to make personal data policies and practices known to the public regarding the types of personal data it holds and how the data is used; and
• DPP6 Data Access & Correction
  • A data subject must be given access to his/her personal data and allowed to make corrections if it is inaccurate.

Contravention of the PDPO may result in civil claim by data subject or offence which could lead to a maximum fine of HK$50,000 and imprisonment for 2 years.

It should also be noted that a company or organisation may also be subject to the General Data Protection Regulation (EU) 2016/679 (GDPR) under EU laws if it has an establishment in the EU, where personal data is processed in the context of the activities of the establishment, regardless of whether the data is actually processed in the EU; or it does not have an establishment in the EU, but offers goods or services to or monitor the behaviour of individuals in the EU.

Confidentiality and Data Privacy Risks in Work-from-home Arrangements

Whilst being cognizant of the confidentiality and data privacy obligations expected to be strictly adhered to at all times by such companies and professionals, what sort of hidden risks are those workers working from home peculiarly exposed to in this regard?

Professionals and workers working from home inevitably rely on their home networks during their work. Home or public networks and WIFIs are often less secure than that of an intuitional setup with proper VPNs, firewalls and antivirus software. Confidential information is therefore more vulnerable to hacking and leakage.

Second, a home worker may also utilize what is termed cloud-based service, a popular off-site Internet access data storage tool to store and access client’s information and data. Example of such cloud-based application includes the emerging use of Robotic Process Automation (RPA) in auditing. While basic protection such as use of account name and password is in place for such cloud-based service, without the aforesaid IT protection, risk to data leakage and accidental loss of data by reason of using one’s own personal computer cannot be overlooked.

Third, if a home worker takes a physical file or documents from office to work on remotely, be it in a coffee shop or at home, it may be difficult to keep wandering eyes of those around you off your computer screen or the documents.

All these situations could pose great risks to the workers, for which the company may be liable by reason of vicarious liability.

Measures to Minimize Risks

In light of the danger of confidential information and private data loss that may arise from work-from-home arrangements and the adverse consequences which may result in as discussed, stringent safety measures are advised to be implemented to mitigate loss in this regard.

Enhancing IT Securities	Assessment over areas of risk associated with Flexi-working/ Work from Home arrangementPre-vetting and authorization on employees’ devices used during Flexi-working/ Work from HomeInstallation of properly configured firewall on such devicesGuidance over teleconferencing/ video-conferencing systemPronouncing internal control policy over e.g. employees’ access right, password complexity,means of data transmission, encryption of clients’ personal data or business confidential information, data back-up etc.
Putting in Place Privacy Policy	Developing a Comprehensive Privacy Management ProgramDesignating privacy officer within organizdionClear guidance on PDPO compliance such as duraion of data up-keep; maters or scenario requiring report; handling of data user enquiriesStaff training on privacy regulations and awarenessoversight and review plan to track data collection, usage, storage etc. – effective controls to periodically audit data handling by staff
Contractual Protection – with IT suppliers	inclusion of Representations and Warranties from the service/product providersinclusion of Indemnification clause to ensure risk allocation in case of defaultexample – “Party A (i.e. IT Service Providers) agrees to indemnify and hold the Company harmless for any and all claims (including third party daims), causes of action, suits, debts, losses, costs or expenses (including reasonable legal fees), judgments, liabilities and demands relating to or arising from any negligence, fault, error or omission of Party A or any fraud, misrepresentation or breach by Party A of this Agreement.”
Contractual Protection – with clients	inclusion of Exclusion or Limitation of liabilities clause by for example, putting a cap on professional liabilityinclusion of Disclaimers in contracts/ websites to disclaim risk associated with IT securities in the contract

In closing, this article has shown that companies can indeed be vulnerable to confidentiality and data privacy risks arising from work-from-home arrangements. Without proper safety measures against the risks of loss of confidential information and private data, the issue can be “epidemic” for the company. Through traversing the confidentiality and data privacy obligations on the part of the companies, especially those in the professional fields, this article argues that proper safeguards should be implemented, and suggests the “cure” to eradicate such risks and issues. As every company is unique and faces different confidentiality and data privacy risks at different times, companies are strongly advised to seek legal advice on how to properly set up an adequate and effective framework to tackle such issues in accordance with their needs.

OLN provides a range of advisory services in the confidentiality and data privacy context. If you have any questions on the above, please contact anna.chan@oln-law.com, and we will be pleased to answer and assist.

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.