In the ever-evolving intersection of employee privacy and business operations, a recent decision from the Hong Kong District Court provides much-needed clarity. Chan Long Ning Christine v. Dragon Guard Security Ltd¹ is not a ground-breaking reversal of principles but rather a significant and practical reinforcement of how the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO) is applied in an employment context. The judgment is instructive for employers balancing the fine line between lawful monitoring and intrusive oversight.

Background

The defendant company provided security and concierge services and was contracted by MTR to manage security at the Southside Shopping Mall. The plaintiff was employed by the defendant as a concierge supervisor. Following the plaintiff's termination of employment, she brought a claim against the defendant for alleged breach of her employment contract, including: (i) claims of privacy violations; (ii) unreasonable termination; and (iii) constructive dismissal, seeking approximately HK$240,000 in compensation.

There were two points central to her privacy claim: (i) the defendant's use of CCTV cameras and audio recorders installed near the concierge desk (an area accessible to the public) was allegedly unlawful; and (ii) the surveillance measures in question were implemented without her explicit consent, which constituted an unfair and excessive collection of personal data under the PDPO, causing her distress.

The court swiftly dismissed her claims, finding that the surveillance was lawful, fair and proportionate. The court reiterated the long-established principle that there is no overarching cause of action for "invasion of privacy" in Hong Kong and any privacy claims must be premised on a breach of the PDPO.

Lawful purposes and fair means

Under Data Protection Principle (DPP) 1 of the PDPO, personal data may be collected if it serves a lawful purpose directly related to the data user's function or activity. DPP 2 of the PDPO further provides that personal data shall only be collected by lawful and fair means in the circumstances of the case.

The court found that the defendant's use of CCTV and audio recording to monitor the plaintiff, a concierge supervisor, was for a lawful purpose directly related to her employment, especially given the public-facing nature of the role.

As regards the means of collection, the monitoring was conducted in a public area where anyone could see and hear the plaintiff while on duty, meaning she could have no reasonable expectation of privacy in that space. Furthermore, the plaintiff had been informed of the audio recorder's installation for this specific purpose. Therefore, the collection of her personal data via these means was not unfair.

No consent required

The court further clarified that consent is not a prerequisite for data collection under the PDPO given that there is no reasonable expectation of privacy for an employee performing duties in a public area in the first place.

DPP 1(3) of the PDPO only requires that all practicable steps shall be taken to ensure that the data subject is explicitly informed, on or before collecting the data, of the purpose. Further, if compliance with DPP 1(3) would likely prejudice the data collection purpose and that the purpose falls within the exemption specified in Part 8 of the PDPO, the data user is exempted. Therefore, what matters is whether the data subject was informed of the purpose and means of collection. In this case, the plaintiff had been notified of the audio recording via internal communications, thus there was no contravention of DPP 1(3). Insofar as CCTV recording is concerned, advance notice of CCTV monitoring could undermine its effectiveness, thereby qualifying for the exemption under the PDPO.

Key takeaways

The judgment underscores the contextual nature of privacy rights in employment. Employees working in public areas, such as concierge counters, have a lower expectation of privacy. The court emphasised that surveillance conducted in visible, accessible spaces – where conversations and actions are naturally exposed – is unlikely to breach the PDPO, provided it is done transparently and for legitimate purposes.

The court also distinguished between surveillance that is covert and potentially abusive, and monitoring that is routine and operationally necessary. In doing so, it reinforced the principle that an individual's expectation of privacy must be balanced against an employer's duty to ensure service quality, safety and accountability.

The key takeaway for employers is the emphasis on purpose and context over blanket consent. The ruling aligns with a trend of Hong Kong courts interpreting data privacy principles within their statutory boundaries, avoiding an expansive creation of new torts. The decision reinforces the principle that the PDPO is a shield against genuine privacy intrusions, not a sword to challenge employer policies. There must be a balance between an individual's privacy rights and the public interest of ensuring security, service quality and proper business operations, especially in roles where employees are the public face of an organisation.

Whilst this ruling provides clarity to employers, organisations should take this decision as a cue to review their data collection practices. Surveillance policies should be clearly documented, communicated to staff and aligned with PDPO requirements. While the court upheld the employer's actions in this case, it also signalled that procedural fairness and transparency are critical. Employers must therefore ensure that employees are informed of monitoring practices and that such practices are proportionate to their business needs.

Acknowledgements to Legal Assistant Charmaine Chan for research and contribution to this article.

1. [2025] HKDC 449