Whether an employee could request his employer to provide record of service by relying on the Ordinance
An enquirer would like to know the conditions for applying for the PCPD’s legal assistance and the forms of legal assistance provided by the PCPD.
The Enquiry
An enquirer’s employer refused to issue a Record of Service to him. The enquirer would like to know if he could make a data access request (DAR) to request for a Record of Service from his employer.
Relevant Provisions of the Ordinance
Definitions of “Personal Data” and “Data User”
Under section 2(1) of the Ordinance, “Personal Data” means any data relating directly or indirectly to a living individual; from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and in a form in which access to or processing of the data is practicable. “Data User” means a person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data.
DAR
Under section 18 of the Ordinance, a data subject may make a DAR to a data user to ascertain whether the data user holds his personal data, and if the data user holds such data, to request for a copy of such data. Section 19(1) of the Ordinance stipulates that a data user must comply with a DAR within 40 days after receiving the request.
Section 20 of the Ordinance stated the circumstances in which data user shall or may refuse to comply with DAR, including the request is not made in the form specified under section 67 by the Privacy Commissioner (i.e. DAR Form). A data user who pursuant to section 20 refuses to comply with a DAR shall, as soon as practicable but, in any case, not later than 40 days after receiving the request, by notice in writing inform the requestor of the reasons for the refusal.
Our Response
An employee, as a data subject, can make a DAR to his employer under section 18 of the Ordinance. Unless the circumstances specified in section 20 of the Ordinance apply, the employer must supply a copy of the employee’s personal data to the employee within 40 days after receiving the DAR.
Please note that under the Ordinance, the employee is entitled to a copy of his personal data, not a copy of the document. Moreover, the employer does not need to create any personal data it does not hold for compliance with the DAR. In this regard, if the employer did not hold the employee’s Record of Service at the time of receiving the DAR, the employer did not need to create such document for compliance with the DAR.
Employees can send the completed DAR Form to their employers directly. For details of making a DAR, please refer to the PCPD’s leaflet, “Exercising Your Data Access Rights under the Personal Data (Privacy) Ordinance (Frequently Asked Questions and Answers)”.
(Uploaded in September 2020)