IV. Privacy in Recruitment, human resources management and at work
The Privacy Commissioner's Office has issued a Code of Practice on Human Resource Management which came into force on 1 April 2001. The Code is designed to give practical guidance to data users who handle personal data in performing human resource management actives (such as recruitment, management of personal data of current and former employees, etc.). Any breach of the Code may be used as evidence in any legal proceedings relating to the Ordinance against the relevant data users. In that case, individuals (employees) will also benefit from reading the Code in order to understand more about their legal rights concerning personal data protection.
To provide more information about this topic, the PCPD issued the Privacy Guidelines: Monitoring and Personal Data Privacy at Work in December 2004. Although these guidelines are not legally binding, they are made with reference to the Six Data Protection Principles of the Ordinance and therefore have substantial reference value. The guidelines list out some recommended steps that should be taken by employers when they monitor employees using the following means:
- Telephone Monitoring (telephone calls and voice mail made or received by employees);
- E-mail Monitoring (employees' incoming and outgoing e-mail messages);
- Internet Monitoring (employees' web browsing activities);
- Video Monitoring (using video cameras or closed circuit TV system ("CCTV") to monitor or record employees' work activities and behaviours).
With regard to the employment of domestic helpers, the PCPD also issued the document Monitoring and Personal Data Privacy at Work: Points to Note for Employers of Domestic Helpers in December 2004. It contains points that are related to video monitoring of activities of domestic helpers working at home.
It is pertinent to note that employers must not disclose their employees' employment-related data to a third party without first obtaining the employees' consent, unless the disclosure is for purposes directly related to their employment, or such disclosure is required by law or by statutory authorities (e.g. for tax assessment/collection purposes or criminal investigation).
- What is a "blind" recruitment advertisement? Does the Code of Practice on Human Resource Management apply to all recruitment advertisements?
- Why is an employer required to identify itself in recruitment advertisements that solicit personal data from job applicants?
- Can an employer directly solicit personal data from job applicants if it merely uses its company email address, telephone number or fax number as a means of identifying itself in a recruitment advertisement?
- Some employers only provide their fax numbers, postal addresses or e-mail addresses in recruitment advertisements without explicitly asking job applicants to submit their personal data. Is this practice acceptable under the Code?
- Should an employer provide, within a recruitment advertisement, a statement regarding the purpose for which the personal data submitted by job applicants will be used?
- Can an employer ask job applicants whether they have any criminal record?
- On a company's job application form, there is a column requesting personal data concerning the applicant's spouse/children's occupations. The purpose of this is to ascertain whether the relatives work for one of its competitors. Is this acceptable?
- Can an employer collect copies of the identity cards of job applicants? How long is an employer allowed to keep the personal data of unsuccessful job applicants?
- Are there any situations in which employers holding personal data may be exempt from the Ordinance or the data protection principles?
- How long is an employer allowed to keep the personal data of former employees?
- An employer wants to announce the resignation of a former employee in a newspaper. What should the employer be aware of?
- Do employees have the right to obtain a copy of their personal records including appraisal reports?
- Who is liable for a contravention of the Ordinance in relation to employment-related personal data – the employer or the human resources manager?
- Complaint Case Notes from the PCPD – Can employment agents, for the purpose of guaranteeing their commission payments, collect ID card copies from job applicants?
- Complaint Case Notes from the PCPD – Is the posting of an employee's complaint letter on a notice board an intrusion of personal data privacy?
- What are the things that employers should consider before conducting work monitoring measures (e.g. telephone, video, e-mail or internet monitoring)? Can covert/secret monitoring of employees be adopted?
- Should employers notify their employees before commencing the above-mentioned work monitoring measures? How should employers manage the data collected?
- Can I install a video camera at home to monitor my domestic helper?
Human Resources Management
Privacy at work
You should contact the PCPD or consult a lawyer if you have any queries about these Codes or Guidelines.