1. Process of employment

1. Process of employment

The Code of Practice on Human Resource Management came into force on 1 April 2001 and was revised in April 2016. The Code provides practical guidance to employers and Human Resource Management on the application of the Personal Data (Privacy) Ordinance when handling personal data acquired from the process of employment. The Data Protection Principles to Schedule 1 of the Ordinance apply to the following 3 main areas of employment:

Recruitment

• Recruitment advertisements that ask for personal data should include a statement stating the purposes for which the personal data will be used, e.g. “Personal data collected will be used for recruitment purposes only”, or alternatively include the statement to the following effect: “Personal data provided will be used strictly in accordance with the employer’s personal data policies.”
• Personal data collected from job applications should not be excessive and should only be relevant in identifying the suitable candidates
• Employers should not ask for a copy of the HKID unless and until the applicant has accepted the job offer
• Personal data of unsuccessful applications may be retained for a period of up to 2 years from the date of rejecting the applicants and should then be destroyed

Current employment

• Employers may collect additional personal data from an employee for the purpose of employment or any lawful requirement in regulating the affairs of the employer
• Employers have to provide a Personal Information Collection Statement to the employee before collecting any personal data
• Any personal data of the employee should not be disclosed to any third party unless with the employee’s express and voluntary consent or the disclosure is required by law (e.g. for tax assessment/collection purposes or criminal investigation)

Former employees’ matters

• Personal data of a former employee may be retained for a period of up to 7 years from the date the employee ceased to be employed
• Employers have to make sure that only the relevant and necessary information is retained after the employee ceased to be employed

Any breach of the Code may be used as evidence in any legal proceedings relating to the Ordinance against the relevant data users. Both employers and employees should therefore read the Code to understand more about their respective legal rights concerning personal data protection.