Is my boss allowed to spy on me when I’m working?

A person’s right to privacy in respect of their personal data is protected under the Personal Data (Privacy) Ordinance (“PDPO”).

In the case of Chan Long Ning Christine v Dragon Guard Security Ltd [2025] HKDC 449, Ms Chan claimed against Dragon Guard Security Ltd (“DGSL”) for compensation for, amongst other things, alleged violation of her rights of privacy.  She claimed DGSL was not allowed to keep her under surveillance whilst she was on duty, at work.

Case Summary

Ms Chan was employed by DGSL to work as the concierge supervisor at The Southside Shopping Mall (the “Mall”).  Ms Chan claimed DGSL violated her privacy by:

1. Using CCTV to monitor her performance such as standing up to serve the customers and keeping the concierge desk tidy;

2. Installing an audio recorder at the concierge desk to monitor all conversations with customers to assess her performance; and

3. Intending to take photos to record prohibited behaviours such as using smartphone on duty and failure to maintain good gestures.

The Court clarified that “there is no over-arching, all-embracing cause of action for “invasion of privacy” [45]”.  Rather, section 4 of the PDPO does not allow for any act or engagement in practice which contravenes data protection principles unless required or permitted under it.  The data protection principles relevant to Chan are as follows:

(i) Principle 1(1): Personal data shall not be collected unless the data is collected for a lawful purpose directly related to a function or activity of the data user who is to use the data.

(ii) Principle 1(2): Personal data shall be collected by means which are lawful and fair in the circumstances of the case.

(iii) Principle 1(3): Where the person from whom personal data is or is to be collected is the data subject, all practicable steps shall be taken to ensure that he is [informed].

In Chan, the Court held DGSL’s collection of personal data through surveillance was not unfair and there was no violation of Ms Chan’s privacy for the following reasons:

1. Purpose:  CCTV and audio recording were for the “lawful purpose” of monitoring her performance which directly relates to her employment.

2. Expectation of privacy: The concierge desk was in a public area of the Mall, so anyone in close proximity could see and hear her whilst she was on duty.  As such, she cannot reasonably expect for privacy when she was on duty serving the customers.

Ms Chan also complained about her lack of consent in DGSL’s surveillance measures.  However, the Court also rejected this claim for the following reasons:

1. Consent not required: Principle 1(3) only requires Ms Chan to be informed but there is no requirement for consent.  Ms Chan was in fact informed about the audio recording in advance.

2. Exemption for CCTV: Ms Chan was not informed about the CCTV recording in advance.  However, the purpose of CCTV recording falls under the legal exemption of the PDPO, such that the purpose would be prejudiced had Ms Chan been informed on or before the CCTV recording.

Guidance for the Employers

Chan reassures employers that they are allowed to reasonably monitor their employees’ performance through legal and fair means.  They do not need prior consent of the employees and will only be required to inform the employees, unless exempted to do so.

The Privacy Commissions for Personal Data (“PCPD”) confirmed the PDPO is a principle-based legislation.  PCPD issued a guideline specifically for “Monitoring and Personal Data Privacy at Work”.  It outlines the best practices for employee monitoring while respecting personal data privacy with illustrative examples.  It recommends employers consider whether monitoring is necessary and whether less intrusive options are available.  If monitoring measures need to be put in place, it should be done with transparency and with due regard to safeguarding and deletion of such data.  The guideline covers monitoring of telephone, email, internet and video, and emphasises compliance with the data protection principles.  It is a useful and elaborative guide for employers to implement monitoring measures as far as the law permits.

PCPD also issued a publication on “Physical Tracking and Monitoring Through Electronic Devices” which recognises the rise in tracking through electronic devices such as Wi-Fi transmitters and radio frequency identification tags.  Employee monitoring by tracking physical location and behaviour can constitute collection of personal data which should also comply with data protection principles.

For more details about data privacy, please refer to our article on What you need to know about personal data privacy in Hong Kong. For an update on guidance in relation to CCTV, drone, and in-vehicle camera use, please refer to our earlier article – “There’s always someone watching!”.

Russell Bennett

For more information on the above or any other enquiries, please contact:

Russell Bennett
Partner | Email