Case Notes

(AAB APPEAL NO. 14/2020)

Report relating to employment check – whether disclosure of the Report constituted a new purpose requiring prescribed consent – whether all practicable steps taken to ensure accuracy of personal data

Coram:
Mr Derek Chan Ching-lung, SC (Presiding Chairman)
Mr Chan Kam-man (Member)
Mr Tsang Mo-chau (Member)

Date of Decision: 11 August 2021

The Complaint

The Appellant applied for a new permanent role at the Bank (“New Role”) while contracted out to work there by his then employer (“Employer”). The Appellant signed an acknowledgment relating to a notice for collection of data for the purpose of considering and processing the Appellant’s employment applications, including pre-employment checks and background screening or vetting and managing the provisions of services to the Bank (“Notice”). A third party (“Third Party”), upon Appellant’s authorization to conduct a background check, prepared a report (“Report”) which displayed discrepancies between the reasons for leaving provided by the Appellant and the Appellant’s previous employers (“Previous Employers”). The Bank then disclosed an extract of the Report to the Employer on the discrepancies (“Bank’s Disclosure”) and the Employer requested references of past employments from the Appellant, which the Appellant duly provided. The Appellant also submitted documents to the Bank and the Employer in support of his version of the reasons for leaving.

The Appellant then submitted a Data Correction Request to the Bank for references in the Report, but the Bank refused on the ground that it was the recipient of the Report. The Third Party subsequently updated the Bank that the Previous Employers had amended the references and reasons for leaving provided to the Third Party previously. The Bank then confirmed that the Appellant’s background check status was clean.

The Appellant complained to the Privacy Commissioner that he had never authorized the Employer to handle his application for the New Role, hence the Bank had no reason to disclose any information in the Report to the Employer without his consent. Also, the Bank did not attempt to ascertain the correct information directly from the Appellant, who was the data subject.

The Privacy Commissioner’s Decision

The Privacy Commissioner terminated the investigation based on the reasons that:

1. The Bank’s Disclosure to the Employer was directly related to the original purpose of collection and therefore it was not necessary to obtain the Appellant’s consent;
2. The Bank had taken a practical step in verifying with the Employer the discrepancies between the Report and the reasons for leaving the previous employments as provided by the Appellant.

The Privacy Commissioner also considered that the Bank was at its own discretion as to whether to contact the Appellant or the Employer as to the discrepancies and that fell outside the jurisdiction of PCPD.

The Appeal

The AAB confirmed the Privacy Commissioner’s decision to terminate the investigation and dismissed the appeal on the following grounds:

1. The Disclosure of the Appellant’s personal data to the Employer was done for purposes which came directly within the Notice, a document provided to and signed by the Appellant prior to collection of his personal data. No prescribed consent was thus required from the Appellant before the Bank disclosed extracts of the Report to the Employer;
2. The Bank took all practical steps to ensure that the Appellant’s personal data was accurate since there was no inaccuracy in the first place. The data held by the Bank was accurate on both the Appellant’s and the Previous Employers’ versions. The Bank was in no position to adjudicate the accuracy or credibility of the differing descriptions as to the Appellant’s reasons for leaving the previous employments; and
3. Even if there was an issue on accuracy, the Bank had taken all practical steps to ensure the data’s accuracy. The Bank had also updated its system to the effect that the Report should be read together with the update from the Third Party.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in March 2024)