An employee made a data access request to his employer with an intention to find out whether he was considered as potential staff for promotion – Data Protection Principle 6
The Complaint
An organisation has conducted an exercise to identify potential staff for promotion to its management level, so that appropriate training will be provided to them to facilitate their development. A classified list of potential staff was therefore compiled and passed to the organisation’s management for consideration.
The complainant submitted a data access request to the organisation requesting it to confirm “whether his name was on the list of the potential staff”. As the list was a classified document of the organisation, no reply was given to the complainant. The complainant then complained against the organisation for failing to comply with his data access request.
Outcome
In the judicial review case of Wu Kit Ping v. Administrative Appeals Board HCAL 60/2007, the Judge held that the purpose of the PDPO is to protect the personal data privacy of an individual, and to enable an individual to access, and correct the incorrect personal data held by a data user.
In this case, the complainant’s purpose for making the data access request was not to access his employment related data held by the organisation (e.g. his resume, performance appraisals, training records or applications for leave/staff benefits records, etc.), but to dig out whether he was considered as a potential staff member for promotion. PCPD considered that the complainant’s request was not related to his personal data. Under the PDPO, the complainant has the right to access his personal data held by the organisation to ascertain if it was accurate, and if it is inaccurate, he can request his employer to correct. The company has no duty to confirm to the complainant “whether his name was on the list of potential staff” under the PDPO.
Lesson learnt
The PDPO provides an important right to employees to access their personal data, and employers as data users are obligated to handle data access requests in accordance with the PDPO. However, employees may misunderstand the right given to them under the PDPO, thinking that it is an absolute right to information, and using it to fish for answers in employment-related matters, or to obtain reports or letters in specified format (e.g. requesting employer to provide reference letters). In fact, the legislative intent of data access request is to provide a channel to a data subject to access his or her personal data held by a data user, and to request for correction when inaccuracy is noted. Employees should not expect to obtain information for checking employer’s administrative arrangement or management decision, or for resolving employment disputes by exercising his right of data access request.
(Uploaded in September 2020)