Date: 29 August 2021
Response to media enquiry on collection and use of employees' personal data
Thank you for your enquiry. Our response to your enquiry is as follows:
-
Generally speaking, according to Data Protection Principle 1 of the Personal Data (Privacy) Ordinance (PDPO), employers being the data users shall collect employees’ personal data by means which are lawful and fair in the circumstances of the case. The collection of the data must be necessary for the purpose(s) of collection and not excessive. On or before the collection of personal data, all practicable steps shall be taken to inform the employees of whether it is obligatory or voluntary to supply the data, the purpose(s) for which the data is to be used and classes of persons to whom the data may be transferred.
-
With regard to the use of personal data, Data Protection Principle 3 under the PDPO provides that personal data shall be used (including the disclosure and transfer of relevant data) for a purpose which is the same as or directly related to the original purpose(s) of collection. Except where voluntary and explicit consent is obtained from the employees, or where employers being the data users can rely on relevant exemptions under the PDPO (e.g. the use of the data is for the prevention or detection of crime), personal data collected shall not be used for a new purpose.
-
The Office of the Privacy Commissioner for Personal Data (PCPD) has issued the “Code of Practice on Human Resource Management” to provide practical guidance to employers and employees on how to properly handle personal data that relate to employment, and assist those responsible for human resource management to comply with the requirements of the PDPO.
-
The PCPD would not comment on individual cases but would keep an eye on development of the matter.