An employer required employees to download an application on their personal mobile phones, which was mandated to have face recognition and global positioning system (GPS) functions enabled for the purpose of attendance recording.
The Enquiry
An enquirer stated that he was required to attend outside work or work from home on an irregular basis. The enquirer asked whether the employer could mandate the download of the application on employees’ personal mobile phones for the purpose of attendance recording, and whether the activation of facial recognition and GPS functions could also be mandated.
Our Response
The Ordinance is principle-based and technology-neutral, and does not prohibit the use of particular applications/GPS systems for attendance recording purposes by employers. However, employers, as data users, should comply with the requirements under the Data Protection Principles of Schedule 1 to the Ordinance and the “Code of Practice on Human Resource Management” when collecting and handling personal data. Generally speaking, an employer who intends to collect specific personal data of employees for attendance recording purposes must first consider the necessity of the collection.
Concerning the collection of biometric data, an employer should carefully consider whether it is necessary and serves a specific purpose. Employers should also assess whether such collection is appropriate, necessary and proportionate under the circumstances, and whether the purposes may be achieved by other less privacy-intrusive methods. Employers must have overriding reasons to justify the collection of biometric data instead of adopting less intrusive measures, otherwise such collection may be considered excessive.
Should employees be concerned about the collection of such data, they should inquire with their employers directly about the relevant policies, including the management method of the personal data and the purpose of use, etc.
(Uploaded in August 2024)