**********************************
Following is a question by the Hon Ip Kwok-him and a written reply by the Secretary for Labour and Welfare, Mr Matthew Cheung Kin-chung, in the Legislative Council today (July 13):
Question:
I have recently received complaints from members of the public that on the same day after they submitted their resumes to employers via electronic mails when seeking jobs by using the Interactive Employment Service of the Labour Department (LD), they received calls from a number of telemarketing companies promoting their products, which caused much disturbance to them. In this connection, will the Government inform this Council:
(a) whether LD has, in respect of the various employment and recruitment services it provides, taken any measure to ensure that employers will use the personal data of job seekers collected through posting of recruitment advertisements at LD only for recruitment purpose; whether LD had received complaints about the misuse of personal data of job seekers in the past three years; if it had, of the details of the complaints; the numbers of such complaint cases received in each of the years; and among them, the number of substantiated cases;
(b) given that some of the recruitment information or advertisements released through LD's various employment and recruitment services are on job vacancies of private employment agencies, whether LD had received, in the past three years, complaints from job seekers alleging that those employment agencies did not have actual business operation, or the vacancies listed in the recruitment information or advertisements did not even exist; if it had, of the respective numbers of such complaints it had received in each of the years and the investigation results; and
(c) of the provisions in the existing Personal Data (Privacy) Ordinance (Cap. 486) which are applicable to restricting enterprises, employers or any other persons from the improper keeping and use of personal data of job seekers collected through recruitment channels; the respective numbers of cases in which prosecutions were instituted for breaching the relevant legislation in each of the past three years; among them, the percentage of convicted cases; the respective maximum and minimum penalties imposed for such cases?
Reply:
President,
My reply to the question raised by the Hon Ip Kwok-him is as follows:
(a) In providing employment and recruitment services, the Labour Department (LD) has the following measures in place to ensure that personal data provided by job-seekers to employers should be used for recruitment purpose only:
(i) Employer making use of recruitment service of LD have to declare in writing for compliance with the Personal Data (Privacy) Ordinance (Cap.486), and that use of any information collected from job-seekers should be restricted for recruitment purpose only.
(ii) Employers can submit vacancy orders to LD by facsimile or via the Interactive Employment Service (iES) website. The vetted-in vacancy orders are then posted at job centres and the iES website. The iES system does not provide employers with any access to the personal contact information of job-seekers.
(iii) In browsing vacancy information of iES, job-seekers are reminded under the "Points-to-note" session to take heed of employment traps, including careful handling of personal data in making job applications. In case of doubts, job-seekers should contact LD officers as soon as possible so that immediate follow-up action can be taken.
(iv) If a complaint against an employer is made on the suspected use of information collected through the registered vacancies of LD other than for the purpose of recruitment, LD will take immediate follow-up action and conduct investigation. LD will approach both the complainant and the employer concerned to better understand the situation, and investigate whether the employer has breached the terms and conditions for using the recruitment service of LD. In the course of investigation, vacancy orders concerned may be removed from display if the situation warrants. Employers of substantiated complaints would not be offered further recruitment service and the job-seekers concerned would be advised to approach the Office of the Privacy Commissioner for Personal Data for further assistance.
In the past three years, LD received two complaints involving suspected improper use of personal data provided by job-seekers. Both complaints were received in the first half of this year. After investigation, the complaints were not substantiated.
The concerned complainants alleged that after their submission of resumes by emails to the employers with vacancies posted on iES, they received more telephone calls from marketing companies. They suspected that their personal data had been leaked to outsiders. Since both cases involved job vacancies offered by employment agencies, the complainants were also concerned whether there were measures in place to ensure that employment agencies were using the recruitment service of LD properly.
As regards the two complaints, LD immediately contacted the complainants to obtain further information for investigation. LD also provided them with detailed information on the points to be noted by employment agencies using LD's recruitment service and the requirements concerned to enable the complainants to better understand their rights in this respect. After investigation, both cases were not substantiated owing to a lack of sufficient evidence to prove that their personal data had been leaked by the agencies.
Nonetheless, LD advised the agency involved in one of the complaints to observe the requirements for using LD's recruitment service, and that personal data provided by job applicants should be used for recruitment purpose only. For the other case, further investigation could not be made as the complainant was not able to provide details of the agency concerned.
(b) To expedite the dissemination of employment information with a view to helping job-seekers to find suitable jobs as soon as possible, LD also collects vacancies submitted by employment agencies. Vetting criteria and requirements relevant to employers in general are also applicable to employment agencies. In addition, they are only allowed to submit vacancy orders from their clients who hire employees direct, and that the name of the agency concerned must be shown on their vacancy orders posted on iES.
In the past three years, there had not been complaints from job-seekers on employment agencies that are not genuinely in operation, or on bogus vacancies placed which did not lead to placements.
(c) Under the Personal Data (Privacy) Ordinance (PDPO) (Cap. 486), data users are required to comply with data protection principles (DPP) 1, 2 and 3 in connection with the collection, retention and use of personal data. DPP 1 provides that a data user should collect personal data by means which are lawful and fair in the circumstances of the case. If a data user, when collecting personal data from a data subject, misleads the data subject on the purpose of collection (for example using recruitment as a means to mislead the applicant to provide his or her personal data, where the actual purpose of collection is for marketing products), such collection will be considered as unfair collection. DPP 2 provides that a data user shall take all practicable steps to ensure that personal data is accurate and is kept no longer than necessary. Section 26 of the PDPO further provides that a data user shall erase personal data where the data is no longer required for the original purpose of collection, unless any such erasure is prohibited under the law or it is in the public interest for the data not to be erased. DPP 3 provides that unless with the prescribed consent of the data subject, personal data should only be used for the purposes for which it was to be used at the time of collection or a directly related purpose. If an organisation uses the personal data collected during a recruitment exercise for the purpose of marketing products, whether for its own use or transfer to a third party for marketing, such use would constitute a contravention of this principle.
The Privacy Commissioner for Personal Data (PCPD) may serve an enforcement notice on a data user in case of contravention of DPPs and where it is likely that the contravention will continue or be repeated. Under section 64(7) of the PDPO, a data user who fails to comply with an enforcement notice commits an offence and is liable to a fine at Level 5 ($50,000) and imprisonment for two years. As for contravention of section 26 of the PDPO, it is an offence and the data user is liable to a fine at Level 3 ($10,000).
To enhance the protection of personal data privacy, the Administration has suggested, in the Personal Data (Privacy) (Amendment) Bill 2011 presented to the Legislative Council on July 13, 2011, to impose heavier penalty for repeated non-compliance with enforcement notices, as well as making it an offence for a person to intentionally do the same act or make the same omission again that constitutes a contravention of a requirement under the PDPO in respect of which an enforcement notice has been issued before. The Bill also introduces specific requirements on the use of personal data in direct marketing.
On the other hand, the PCPD issued the Code of Practice on Human Resource Management (the Code) in 2000. It provides employers with a practical guide on the application of the provisions of the PDPO to employment-related personal data privacy. In connection with the retention and use of personal data collected in recruitment exercises, Clause 2.10.1 of the Code provides that an employer who has a general policy of retaining personal data of unsuccessful job applicant for future recruitment purposes should not retain such data for a period longer than two years (from the date of rejecting the applicant) unless there is a subsisting reason that obliges the employer to retain the data for a longer period; or the applicant has given prescribed consent for the data to be retained beyond two years. According to Clause 2.5.3.1 of the Code, personal data of an unsuccessful job applicant may only be used in a later recruitment exercise or a directly related purpose, unless the applicant consents to the use in some other purposes. A breach of the Code by a data user will give rise to a presumption against the data user in any legal proceedings under the PDPO, or will weigh unfavourably against the data user in any case before the PCPD.
In the previous three years, the PCPD has not issued any enforcement notices nor referred to the Police for criminal investigation any cases on improper retention and use of personal data collected in recruitment exercise.
Ends/Wednesday, July 13, 2011
Issued at HKT 12:22
NNNN
