CATHAY PACIFIC AIRWAYS LTD v. ADMINISTRATIVE APPEALS BOARD AND ANOTHER

HCAL 50/2008

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

CONSTITUTIONAL AND ADMINISTRATIVE LAW LIST

NO. 50 OF 2008

---------------------

Dates of Hearing : 11 and 12 July 2008

-------------------------

J U D G M E N T

-------------------------

Introduction

1. The Personal Data (Privacy) Ordinance, Cap. 486, seeks to protect the privacy of all persons in relation to information which is personal to them.  If an employer (a data user) wishes to collect in a recorded form personal data of its employees (data subjects), it may only do so to the extent provided for, and in a manner specified, in the Ordinance.

2. In this regard, s.4 of the Ordinance directs that an employer, in collecting and using its employees personal data, must do so in accordance with a body of principles known as ‘data protection principles’.  S.4 reads :

“A data user shall not do an act, or engage in a practice, that contravenes a data protection principle unless the act or practice, as the case may be, is required or permitted under this Ordinance.”

3. The data protection principles are to be found in Schedule 1 of the Ordinance.  By way of broad categorisation, six principles are listed.  The first principle – which is the subject of this application for judicial review – concerns the purpose for which personal data may be collected and the manner in which that collection is permissible.

4. S.s.(1) of the first principle states that personal data shall not be collected unless —

“(a)     the data are collected for a lawful purpose directly related to a function or activity of the data user who is to use the data;

(b) … the collection of the data is necessary for or directly related to that purpose; and

(c) the data are adequate but not excessive in relation to that purpose.”

5. As to the permissible manner in which personal data may be collected, s.s.(2) directs that it shall be collected by means which are —

“(a)     lawful; and

(b) fair in the circumstances of the case.”

6. Cathay Pacific Airways Limited (“Cathay”), the applicant in this matter, is Hong Kong’s largest airline, operating a fleet of passenger aircraft.  As such, Cathay employs several thousand men and women as cabin crew, their duties being to ensure the safety and comfort of passengers.  Cabin crew are trained for their specific role.

7. In order to maintain its air operator’s certificate, Cathay is under an obligation to ensure that all cabin crew, when they are flying on duty, are medically fit.  In this regard, Directive 360 of the Civil Aviation Directives requires that :

“A cabin crew member should be at least 18 years of age and have passed an initial medical examination or assessment and been found medically fit to discharge the duties specified in the operations manual.  An operator must ensure that cabin crew members remain medically fit to discharge such duties.”  [our emphasis]

8. In addition, of course, as a commercial enterprise, Cathay seeks to ensure that all cabin crew are able to attend to their duties on a consistent basis and are not prevented from doing so by any medical condition.

9. For these reasons Cathay has a direct interest in the health and well-being of its cabin crew and a direct interest, should the need arise in respect of any individual cabin crew member, in monitoring that member’s health.

10. In November 2005, Cathay instituted a revised programme known as the Attendance Monitoring Programme (‘AMP’).  The purpose of the AMP is to investigate why a small minority of cabin crew members had levels or patterns of absence from work, purportedly due to illness, which were a cause for concern.  Identification of the cause has two principal purposes.  First, it is to assist individual cabin crew staff to get back to work on a regular basis, if necessary by providing a range of remedial measures to that staff member.  Second, it is to identify those who are simply no longer fit for full time flying duties and therefore unable to meet the inherent requirements of their job.  Although not a principle purpose, obviously one of the purposes is also to identify malingerers.

11. The AMP makes it clear that any cabin crew member who does not co-operate in the programme will be liable to be disciplined.  Co-operation includes agreeing to make available to Cathay’s management team relevant medical records.  To this end, the programme states —

“Any Cabin Crew member who refuses to co-operate and participate in the attendance monitoring progress stated in this programme may be subject to disciplinary action under the Company’s Disciplinary and Grievance Policy.”  [our emphasis]

12. However, a newsletter issued at the time of the launch of the revised AMP is less equivocal.  In this regard, in a ‘question and answer’ format, the newsletter states :

“Q. What are the consequences for not giving consent [to release medical records] to the company?

A.   We will treat failure to provide consent as a D&G [Disciplinary and Grievance] matter.”

13. At all material times, in respect of cabin crew, Cathay has operated a programme – the D&G programme – for dealing with disciplinary matters and for considering staff grievances.  One of the circumstances in which disciplinary proceedings may be commenced is to determine whether there has been any misconduct on the part of cabin crew in “failing to perform their terms and conditions of service”.

14. The conditions of employment of cabin crew members make it clear that they must comply with, and co-operate in, all policies and programmes governing their employment.  In our judgment, this includes the AMP.

15. As to the forms of discipline that may be visited on cabin crew members who fail to perform their terms and conditions of service, these include a verbal (sic) and written warning, suspension and, for a serious breach, termination of employment.

16. In January 2007, as a result of anonymous complaints, the Privacy Commissioner for Personal Data issued a report setting out his findings in respect of the requirement imposed on cabin crew under the AMP to consent to disclose relevant private medical records.

17. In his report, the Commissioner recognised the highly sensitive nature of private medical records.  He accepted, however, that Cathay had not breached any of the data protection principles set out in s.s.(1) of the first principle.  He accepted that :

(i) Cathay was under a duty to monitor the health of its cabin crew and that the collection of medical data in terms of the AMP was directly related to the discharge of Cathay’s obligations as a passenger-carrying airline and, as such, was necessary.

(ii) Cathay only sought to collect medical data related to a cabin crew member’s absence from work and, as such, the data that was sought was not excessive.

18. Having come to that finding, the Commissioner went on to consider the principles contained in s.s.(2) as to the manner in which Cathay had set about collecting relevant medical records.  To repeat, s.s.(2) directs that the collection of personal data must be —

“(a) lawful; and

(c) fair in the circumstances of the case.”

19. The Commissioner found that the means of collection under the AMP were lawful but he concluded that they were not fair.  In the result, the Commissioner issued an enforcement notice pursuant to s.50 of the Ordinance directing Cathay within 21 days to :

“1.  cease the practice of collecting past medical data of cabin crew under the arrangement of the current AMP whereby cabin crew are required to give consent to the release of their personal medical history under the threat of a disciplinary process;

2. destroy all the medical records of the cabin crew so collected under the AMP …”

20. Cathay appealed to the Administrative Appeals Board which, in a judgment dated 2 May 2008, dismissed the appeal. 

21. In late May 2008, Cathay instituted these judicial review proceedings, seeking orders to certiorari to bring up and quash :

(i) the results of the Commissioner’s investigation;

(ii) the enforcement notice issued by him, and

(iii) the decision of the Administrative Appeals Board dismissing Cathay’s appeal.

The AMP

22. By way of introduction, before looking to the AMP itself, something briefly should be said of Cathay’s sick leave policy.  The terms and conditions of service specify that cabin crew are entitled to sick leave “in accordance with company policies”.

23. The sick leave policy contemplates that a cabin crew member who becomes unable to meet the inherent requirements of his or her job because of illness may have to have their employment terminated.  In this regard, it reads :

“8.3     Termination of Employment

When a Cabin Crew member is incapacitated from performing his/her contractual duties due to illness or injury, the Company will consider providing support and assistance to help him/her return to work.

Ultimately, in the event of any Cabin Crew member being unable, through illness or injury, to perform the inherent requirements of his/her job within a reasonable period after support options have been provided, the Company may consider terminating his/her employment.”

24. In terms of the sick leave policy, a cabin crew member who is unfit for work for a limited period must obtain a medical certificate.  This certificate is not burdened with detail.  It gives a brief description of the ailment and the treatment prescribed and states the number of days of sick leave awarded. 

25. However, the sick leave policy does reserve to Cathay —

“... the right to require such Cabin Crew to provide and/or sign consent to the release of details relating to his/her medical conditions, and/or to be periodically examined by a Company Designated Doctor.”

26. The policy continues by saying that :

“Whenever Cabin Crew are required to be examined by the Company Designated Doctor, the Cabin Crew member concerned will be required to consent to the disclosure of any medical results that relate to such an examination that may reasonably be required by the Company to determine the Cabin Crew’s members’ medical condition, timeframe of recovery, his/her fitness to carry out flying duties, compliance with safety standards or ability to carry out the inherent requirements of the job.”

27. As for the AMP, as we have said, it targets a small minority of cabin crew with unusually high levels of absence from work due to illness.  The AMP provides that :

“Cabin Crew whose levels or patterns of absence from the workplace are a cause for concern to the Company [Cathay] will be advised that their attendance will be monitored.”

28. As to the monitoring process, in the early stages at least, the programme provides for an initial interview, or series of interviews, with medically qualified members of Cathay’s Inflight Services Department and thereafter a possible medical evaluation by a private medical practitioner designated by Cathay.  In respect of the interview process, the programme provides that :

“The Cabin Crew concerned may be asked to attend an interview with a designated member of the Inflight Services Department management team.  The purpose of the interview is to enable the Company [Cathay] to understand the circumstances or reasons behind the Cabin Crew’s absences in order to be able to provide care and support where appropriate for the Cabin Crew concerned and to help him or her return to regular flying duties.

The Cabin Crew’s attendance record or pattern of absences will be discussed at the meeting.  Examples of pattern of absences from work include, but are not limited to, repeated failure to attend duty during weekends, Sundays or festive seasons, high absence on specific flights, absences connected to days off or any type of leave, repeated outport and homeport sickness.”

29. The fundamental purpose of the programme is, of course, as a first step at least, to try and discover what, if any, medical reasons have caused a crew member’s unusually high absence from duty.  In this respect, the programme provides that :

“The Cabin Crew concerned will be required to make available all medical and other information that has been used to support his or her absences which the Company considers necessary.  He or she may be asked to attend a medical evaluation with a Company Designated Doctor and to consent to the disclosure of any medical results that relate to such an examination, and/or any other medical records as seemed relevant by the Company for the purpose of ascertaining whether there is any underlying medical condition preventing regular attendance and whether he or she is receiving appropriate treatment.”  [our emphasis]

30. If there is a failure to attend a medical examination or to provide relevant medical records, the programme recognises that this will put Cathay, and therefore a crew member too, in an invidious position, in that Cathay —

“… will not be able to provide further rehabilitative support and can only review the Cabin Crew member’s case on the basis of any medical and other information provided by the Crew Member to date.”

31. As we have said earlier, the programme and supporting literature make it clear that a failure to provide medical records will almost invariably lead to some form of disciplinary investigation.  While the AMP says only that a failure to co-operate may result in disciplinary proceedings, the special edition of the newsletter issued by Cathay is more direct.

32. As to the delivery up of relevant medical records, the newsletter said :

“In order to help us provide appropriate support, crew may be asked to consent to provide medical information to the company.”

33. But, as we have said earlier, in a ‘question and answer’ format, the newsletter is unambiguous :

“Q. What are the consequences for not giving consent [to release medical records] to the company?

A.   We will treat failure to provide consent as a D&G [Disciplinary and Grievance] matter.”

The Commissioner’s reasoning

34. As we have said earlier, in his report the Commissioner recognised the highly sensitive nature of private medical reports.  He accepted, however, that Cathay had not breached any of the data protection principles contained in s.s.(1) of the Schedule.  Having come to that finding, the Commissioner went on to consider the data protection principles listed in s.s.(2) of the Schedule; that is, the principles going to the manner of collection of the data.  The Commissioner found that the means were lawful.  However, he concluded that – in the circumstances of the case – they were not fair.

35. Looking to the circumstances of the case would, of course, have required the Commissioner to look to his own findings already made.  He must therefore have taken into account that Cathay was under a duty in law to monitor the health of its cabin crew, that the collection of medical data sprung directly from that duty and that the data sought was not excessive.  More than that, he would also have taken into account that the means employed were lawful.  How then was it, in the light of such circumstances, that the Commissioner came to the conclusion that the means of collection were unfair?

36. As we best understand it, the core of the Commissioner’s reasoning is explained in the following extract of his report :

“In the present case, the data subjects (cabin crew) are the employees of the data user (Cathay) who seeks to collect the employees’ past medical data from their own private or treating doctors.  Cathay purports to do this with the consent of the employees.  However, Cathay failed to provide to the crew all necessary information which could enable them to exercise his or her free will in determining whether to give the consent.  On the contrary, the crew were made to give consent under the threat or for fear of a disciplinary process for failure to co-operate.”

37. The Commissioner, in his statement made for the purposes of the appeal, appears to have expanded this finding of fact into a principle that a ‘fair’ means of collection of personal data cannot be a compulsory means.  He has expressed this principle in the following terms :

“As required by DPP1(2)(b) of the Ordinance, the means of collecting personal data by a data user has to be fair in the circumstances of the case.  While ‘fairness’ is not specifically defined in the Ordinance, its ordinary meaning connotes that a data subject shall be provided with all information necessary for exercising his or her free will in deciding whether to permit collection of his/her personal data, in particular when the data is of such sensitive nature as medical information.  In other words, if a data subject gives his consent without complete freedom and does so under undue pressure or influence such as threat, the means of collecting personal data in the circumstances will be in contravention of DPP1(2)(b) for being unfair.”

38. The perceived ‘undue pressure’ or ‘influence’ or ‘threat’ employed by Cathay consists of advising cabin crew members that a consideration of relevant medical records is fundamental to the AMP and that, accordingly, if a cabin crew member refuses to give his or her consent to disclose such records, that will leave him or her open to disciplinary proceedings and may, depending on the circumstances of the case, result in a termination of employment.  As the Commissioner put it in his statement :

“CX requested its crew to consent to the release of data under the threat that disciplinary actions would follow should they refuse to give the consent.  That is not a reasonable direction that an employee should follow.”

39. The Administrative Appeals Board appears to have followed the same reasoning.  In so doing, the Board said :

“… the message conveyed to the cabin crew is clearly that a crew member who fails or refuses to comply with the request for consent to disclose his or her previous medical information would face disciplinary proceedings that could jeopardize their continued employment with the Appellant.  The Disciplinary and Grievance Policy has made it clear that disciplinary proceedings may result in actions against the cabin crew.  These actions include termination of employment or summary dismissal.  This message, call it threat or information about serious consequences, puts pressure on the cabin crew to consent to release his/her personal data which he/she would not otherwise agree to release.  In these circumstances, an employee would not be in a position to refuse the request that is dictated by his employer.  That cannot be said to be fair.”

40. The Board made the observation that in any event relevant medical materials could be obtained under Cathay’s sick leave policy.  We do not agree.  The sick leave policy concerns (in the main) contemporary issues; that is, requests for absence from work because of a current ailment and illness.  As we have said earlier, fairly limited information is required in the standard medical certificate in support of a sick leave application.  In short the sick leave policy, by its very nature, is not a suitable vehicle for the building up of an archive of the detailed medical records of cabin crew.  In any event, if it was to be used in that way, it seems to us that it could be criticised for seeking to obtain excessive medical records and in that respect alone would offend the Ordinance. 

41. Moving back to the central reasoning of the Commissioner and the Board, while we accept that a data subject must be provided with all necessary information in order to make an informed choice, we are unable to accept that, in terms of the Ordinance, a data subject must have “complete freedom” of choice whether to consent or not; that is, a freedom unburdened by any possible adverse consequences and that, if “complete freedom” is in any way compromised, then the collection of private data is made unfair.

42. First, the data protection principles themselves recognise that there may be circumstances in which the disclosure of data may properly be compulsory.  In this regard, s.s.(3) of the Schedule provides that, when personal data is to be collected from a person, “all practicable steps shall be taken to ensure that the person is” —

“… explicitly or implicitly informed, on or before collecting the data, of —

(i) whether it is obligatory or voluntary for him to supply the data; and

(ii) where it is obligatory for him to supply the data, the consequences for him if he fails to supply the data; and”

43. As the Schedule makes plain, if the collection of data is obligatory, the person from the data is to be collected must be informed of the consequences of a refusal to supply the data.  Cathay, therefore, in informing all cabin crew members of the possible consequence of a failure to disclose relevant medical records, was doing no more than meeting the requirements of the Schedule.

44. As we said during the course of the hearing, there must be many cases in which the disclosure of medical records is quite properly and fairly made mandatory.  By way of example, employees in a nuclear power station may be asked to attend regular medical checks and to disclose the results of those checks to ensure that they do not become contaminated by radiation and, if they are found to be so, that the cause of the contamination can be identified and stopped.

45. If the disclosure of medical records may quite properly and fairly be mandatory it is, in our view, highly unlikely that a failure nevertheless to make such disclosure will be free of adverse consequence.  To extend the example above, it would seem almost inevitable to us that, if a nuclear power station employee refused to disclose the results of his medical examination, it would be too risky – in the interests of the employee himself and the broader public – to continue employing him.  In such circumstances, therefore, it would be necessary to advise the employee of the consequences of his failure to make disclosure; namely, the possible loss of his employment.

46. In our view, therefore, if, in circumstances when disclosure of personal data is properly rendered mandatory, it is necessary to advise the data subject of the adverse consequence of failing to make disclosure, that advice does not thereby; that is, of itself, constitute a threat or the exertion of undue influence.

47. In his statement, the Commissioner said that :

“While Cathay is permitted to collect the past medical data by means of fair collection, the first remedial steps to take must be to stop any collection based on a threat of disciplinary process.”

48. But, if disciplinary action would be the invariable consequence of a failure to make disclosure, and if Cathay is under an obligation to inform all cabin crew of the likely consequence of a failure to make disclosure, we have difficulty in understanding, in accordance with the Commissioner’s reasoning, how Cathay could meet its obligation to supply all necessary information, including information as to the consequences of failure, while at the same time not appearing to make a threat or exert undue influence.

49. In this regard, it is to be remembered that Cathay’s disciplinary procedures ensure not only the protection of Cathay’s interests but ensure also that a member of the cabin crew staff is not in any way prejudiced in his or her employment without a full and fair investigation.

50. In our judgment, therefore, both the decision of the Commissioner and the judgment of the Board were based on an incorrect construction of the true meaning and intent of s.s.(2) of the Schedule.  Both decisions must therefore, to that extent, be set aside.

51. However, it appears to us that the disquiet expressed by both the Commissioner and the Board was, to a material degree, based on the blunt and brusque manner in which certain of the information concerning the failure to consent to deliver up medical records under the AMP was conveyed to cabin crew members.  The disquiet was based therefore, in part, on the threatening or oppressive tone of the relevant literature.

52. Fairness is a broad principle and, as to the manner in which personal data is to be collected, is capable of encompassing the form in which relevant information is conveyed as well as the substance of that information.  In this regard, it may be compared with principles of procedural unfairness.  Information given to data subjects that is nuanced and clearly reasoned, expressed in modest terms, may not reasonably be perceived to be threatening or oppressive while information that lacks those qualities of expression may well be perceived, and reasonably perceived, as constituting an abuse of power by a data user.

Conclusions

53. For the reasons given therefore we allow the application for judicial review, quash the decisions of the Commissioner and the Board and remit the matter to the Commissioner for fresh consideration.

54. We are aware that the Commissioner is given the power under the Ordinance to work with data users, such as Cathay, to fashion appropriate codes.  In our view, this is an entirely appropriate occasion for such remedial co-operation.

55. As to costs, we invite the parties to make written submissions within 14 days.