The privacy watchdog cautioned yesterday that collection of employees' data must be done lawfully and fairly, and said it did not become lawful just because an employment contract made provision for it. The Office of the Privacy Commissioner for Personal Data gave the warning in commenting on a court ruling last month that overturned the watchdog's earlier ban on Cathay Pacific collecting some flight attendants' medical records. In a statement, the watchdog, which is considering an appeal against the Court of First Instance judgment, said data protection principles applied even if the contract created an obligation on the part of the employee to disclose personal data. The collection did not become lawful and fair merely because it was in the contract - the means of collection must be both lawful and fair. The court on August 28 allowed an appeal by Cathay against the commissioner's ruling in January last year that the airline's practice of asking for the medical records of flight attendants who often called in sick was unfair. The judgment said there were cases in which the disclosure of medical records was quite properly and fairly made mandatory. The appeal was filed after the commissioner's ruling was upheld by the Administrative Appeal Board. The commissioner is expected to disclose next week whether an appeal would be lodged against the judgment. The watchdog said all necessary information and explanation must be provided to enable the employee to make an informed choice, where consent to the disclosure of personal data was required. And it said the employer should avoid language which might reasonably be perceived to be 'threatening'.