In February 2024, the Office of the Privacy Commissioner for Personal Data (PCPD) issued, in Case No. 2024C01, a warning to a company for violating the Code of Practice on the Identity Card Number and other Personal Identifiers and the Code of Practice on Human Resource Management, following a complaint.

Background to the case

The PCPD noted that the complainant had applied for and interviewed for a job at a company. After the interview, the staff of the company collected copies of the complainant's Hong Kong Identity Card (HKID Card) and bank card but thereafter never contacted the complainant on the outcome of their job application.

Findings of the PCPD

The PCPD found that the company had collected a copy of the HKID Card of the complainant during the recruitment process before the complainant had accepted an offer of employment. In this regard, the PCPD determined that the company had violated the Code of Practice on the Identity Card Number and other Personal Identifiers and the Code of Practice on Human Resource Management. Further, the PCPD explained that it is not necessary to collect the bank account information of an applicant for payroll purposes if the applicant has not accepted an offer of employment.

Outcomes

In light of the above, with the PCPD's intervention, the company revised its guidelines on the collection of personal data from job applicants to require the collection of copies of documents only at the time the selected job applicant signs the contract or during the onboarding process. Furthermore, the PCPD issued a warning to the company, requesting it to recirculate the revised guideline regularly to ensure that its staff adhered to the relevant requirements for the collection of personal data from job applicants.

You can read the press release here.