Employee resignation notice containing excessive data

A company sent fax messages to its customers to inform them of the resignation of an employee. Included in the messages were the name of the employee as well as his identity card number. This was done without the employee's knowledge or consent.

Upon enquiry by the PCPD, the company explained that the act was intended to prevent the ex-employee soliciting business from its clients.

The Commissioner's views on the matter

The PCPD found that the company had acted in breach of DPP4, in that it had not taken reasonably practicable steps to ensure that personal data (namely, the identity card number) of the ex-employee were protected from accidental or unauthorized use. The company agreed to delete the identity card number from the messages and a warning notice was issued to it.

Personal data collected in the course of employment should only be used for purposes related to the employment. When an employee resigns, the use of his personal data for the purpose of notifying customers is regarded as being a use of the data for a directly related purpose. However, the personal data used for such a purpose should be limited to those data which are sufficient to fulfill the purpose of notification. The disclosure of the employee's name and position in the company should be sufficient to identify the employee in the notification. Disclosing the employee's identity card number is unnecessary and may lead to possible misuse of that number for fraudulent or other improper purposes.