Privacy in Recruitment, human resources management and at work

IV. Privacy in Recruitment, human resources management and at work

The Privacy Commissioner's Office has issued a Code of Practice on Human Resource Management which came into force on 1 April 2001 and was revised in April 2016. The Code is designed to give practical guidance to data users who handle personal data in performing human resource management actives (such as recruitment, management of personal data of current and former employees, etc.). Any breach of the Code may be used as evidence in any legal proceedings relating to the Ordinance against the relevant data users. In that case, individuals (employees) will also benefit from reading the Code in order to understand more about their legal rights concerning personal data protection.

To provide more information about this topic, the PCPD issued the Privacy Guidelines: Monitoring and Personal Data Privacy at Work in December 2004 and revised the same in April 2016. Although these guidelines are not legally binding, they are made with reference to the Six Data Protection Principles of the Ordinance and therefore have substantial reference value. The guidelines list out some recommended steps that should be taken by employers when they monitor employees using the following means:

• Telephone Monitoring (telephone calls and voice mail made or received by employees);
• E-mail Monitoring (employees' incoming and outgoing e-mail messages);
• Internet Monitoring (employees' web browsing activities);
• Video Monitoring (using video cameras or closed circuit TV system ("CCTV") to monitor or record employees' work activities and behaviours).

With regard to the employment of domestic helpers, the PCPD also issued the document Monitoring and Personal Data Privacy at Work: Points to Note for Employers of Domestic Helpers in December 2004 and revised it in October 2015. It contains points that are related to video monitoring of activities of domestic helpers working at home.

It is pertinent to note that employers must not disclose their employees' employment-related data to a third party without first obtaining the employees' consent, unless the disclosure is for purposes directly related to their employment, or such disclosure is required by law or by statutory authorities (e.g. for tax assessment/collection purposes or criminal investigation).

NOTE:

You should contact the PCPD or consult a lawyer if you have any queries about these Codes or Guidelines.