The Law of the PRC on Safeguarding National Security in the HKSAR (the National Security Law) was promulgated by the Standing Committee of the National People’s Congress of the PRC on 30 June 2020 and took effect as of 11 p.m. on 30 June 2020.

The National Security Law introduced a range of expansive but rather vaguely defined new offences. The new law also introduces unprecedented and wide-ranging powers granted to law enforcement officers tasked with investigating and enforcing the law under Article 43, including the carrying out of searches of premises (in urgent situations, without a warrant), the freezing and confiscation of assets, requiring service providers to provide assistance and the carrying out of covert surveillance on suspects.

The Implementation Rules for Article 43 of the new law (Implementation Rules) detail a police officer’s¹ power to enter and search places for evidence with and without a magistrate’s warrant. The powers include the power to (a) enter (with reasonable force if necessary); (b) inspect, examine, search, seize, remove and detain anything in the place that the officer reasonably believes to be specified evidence and (c) detain any person found in the place until it has been searched. We have already seen such powers being invoked on 10 August 2020, when police officers executed a search warrant issued under Article 43 to raid the headquarters of Next Digital Limited, which owns the popular tabloid newspaper Apple Daily, in Tseung Kwan O.

All employers in Hong Kong collect and retain personal data in respect of members of their workforce. The collection, use and disclosure of such personal data is subject to the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO). Under the PDPO, an exception already exists under section 58 for an employer to disclose employees’ personal data to law enforcement authorities, including the police, if the disclosure is for the purpose of the prevention or detection of crime, provided that the employer has reasonable grounds for believing that the data disclosed will be used for such purposes. Typically, such reasonable grounds are satisfied if a warrant is produced but, in the absence of a warrant, an employer would need to decide (and seek legal advice) as to whether it should hand over the data as requested.

The National Security Law overrides the PDPO (by its Article 62). What this probably means² is that, if an employee is the subject of an investigation under the National Security Law and enforcement officers make a request for the employer to hand over that employee’s personal data to assist with their investigation then, even in the absence of a warrant, an employer may have no choice but to co-operate and accede to such request. This means important and sensitive data, such as bank account information, residential addresses and passport details which are commonly held by employers in respect of their employees, may need to be disclosed to law enforcement officers upon request under the new law.

Enforcement authorities may also seek disclosure by an employer of other information concerning an employee under investigation, such as emails, text messages and other documents, which may not comprise personal data concerning the employee, but which the employer or employee regards as being confidential. It would seem that, unless such confidential information is protected by legal professional privilege, an employer may be required to disclose it to enforcement officers as requested. Under the Implementation Rules, a court’s order for a person to furnish information and produce material must not require that person to furnish any information or produce any material relating to items which are subject to legal professional privilege. Employers are therefore well advised to seek professional advice about how to safeguard confidential information with the protection of legal professional privilege.

The new law makes no mention as to whether employers are allowed to inform the employee of the fact that they have been requested to disclose information to law enforcement officers, or whether such disclosure should be kept a secret.

Further, whether an employee has a cause for complaint against his/her employer as a result of such co-operation with law enforcement officers is unclear (for example, in cases where he/she is in due course exonerated). Much will turn on how the new law will be implemented in practice.

In the meantime, employers are well advised to communicate with their workforce and have an open and honest dialogue about their obligation to comply with the new law. Employment manuals and handbooks regarding the collection, use and disclosure of employees’ personal data and other confidential information should be updated accordingly to reflect the changes implemented by the new law.

1. A police officer not below the rank of Assistant Commissioner of Police can exercise, or authorise another police officer to exercise, the same powers if he or she is satisfied with one of the three conditions, one of which is that there is reasonable ground for suspecting that any specified evidence, i.e. anything that is or contains, or is likely to be or contain, evidence of an offence endangering national security, is in a place.↩
2. Article 65 of the National Security Law makes it clear that the power of its interpretation shall be vested in the Standing Committee of the National People’s Congress.↩