This quarterly newsletter of the PCPD provides guidance on good data protection practices to organizations.

Subscribe Now!!

PRIVATE THOUGHTS (on-line version)
(Newsletter of the Office of the Privacy Commissioner for Personal Data, Hong Kong)
February 2001 Issue No.6

Higher degree of personal data privacy protection for employees

Taking a look at the recruitment advertisement below, would you send your CV to the PO box listed to apply for the job if it interests you? Have you ever given consent to a job interviewer to make a copy of your ID card? Are you aware of your right to access your personal data held by your former employer?

You may not have given enough thoughts to the above questions, but chances are your personal data privacy may have already been intruded under these circumstances. With "blind" recruitment advertisements, when you send your CV to the anonymous company, you indeed wouldn't have a clue of who would be handling your personal data and how they would be used, or how you could exercise your right to access your personal data being held by this company. Even worse, the data could fall into the hands of market researchers, burglars or even kidnappers, causing potential dangers of identity thefts, harassing phone calls, or other nuisance. It is PCPD's view that blind advertisements, which directly solicit personal data, involve unfair collection of data.

Employers and human resources practitioners have access to significant amount of personal data relating to job applicants, current and former employees; the information enables them to honour contractual obligations and to manage the affairs of the organization. However, without a clear guideline, it would be difficult to determine, in many circumstances, whether an employer has inadvertently or otherwise intruded an employee's personal data privacy.

In light of this, the PCPD has issued a Code of Practice on Human Resource Management ("the Code") to provide practical guidelines on how to apply the Personal Data (Privacy) Ordinance provisions to human resources management functions and activities.

Under the Code, "blind" advertisements that directly solicit personal data from job applicants are not allowed. That is, a recruitment advertisement that asks job applicants to send their resumes to an unidentified employer's Post Office box number would be in breach of the Code.

Employers may ask: "How could I conceal my identity in a recruitment advertisement to avoid causing anxiety among my existing staff or to keep my recruitment intention from competitors?" The solution is: An employer may instead ask the interested individuals to telephone or invite for details and make available information related to the vacancy that identifies the employer. Alternatively, the employer may use a recruitment agency identified in the advertisement to receive the resumes.

It is also important for employers to state clearly in the advertisement that the data collected would be used only for recruitment purpose. Employers must also beware that they should not disclose a former employee's ID card number together with his or her name in any public announcement notice regarding his/her departure from the company.

The Code requires employers to provide a Personal Information Collection Statement (PICS) when soliciting personal data from job applicants or employees. For reference, PICS examples are provided in the "Compliance Guide for Employers and HRM Practitioners." Free copies of the Code and the Compliance Guide are available from the PCPD or can be downloaded from the PCPD website (www.pcpd.org.hk).

For larger organizations, the Code offers clear guidance materials for incorporation into existing procedures for the collection, use and storage of employment-related personal data. While for small or medium- sized organizations with no human resources unit, the Code provides a relevant handbook in handling personal data.

The Code, which was announced in September 2000, will take effect from 1 April 2001, to allow employers sufficient time to revise their existing practices for consistency with the Code and to provide training to staff.

In the mean time, apart from offering public seminars on the Code (please refer to P.9 for details), the Office will conduct random checks on "blind advertisements" in the local newspapers and send reminders to relevant organizations to be in compliance with the Code.

PCPD angles advise safeguards of your privacy rights

Frontline work is never easy. But for Bess, Vicky, and Kam, the PCPD's front office customer service representatives, juggling multiple tasks and greeting walk-in customers with a bright smile are all in a day's work.

The trio, who are referred to by their colleagues as the "PCPD Angels" possess an extraordinary quality not unlike the three crime fighting beauties featured in the hit action movie, Charlie's Angels. They too, seem to know a thing about working hard and maintaining one's cool.

"We have to work under a lot of pressure in this job because we are the first contact point for everyone," Vicky, in her fourth year with PCPD, said. "We have to project an open and helpful image to everyone who calls or walks in with a question."

Headphones in place, manning their positions at the front desk counter, the PCPD Angels bear the responsibility for screening all incoming calls and answering general queries. It is a job that requires good knowledge of the Personal Data (Privacy) Ordinance ("the Ordinance"), excellent communication skills and most importantly, patience.

Bess, a bright and bubbly graduate of the Polytechnic University, has been with the PCPD for three years. It is her first permanent job and Bess believes the excitement of constant interaction with members of the public truly makes her position very demanding. "I find my work to be very interesting and challenging," she said. "We don't face a computer all day. We deal with people from all walks of life and we want to help them." Vicky agrees, "I don't consider myself an ordinary public servant, I am an educator as well, informing people of their rights regarding personal data privacy. The world is changing and I want to do my part to make a government financed organization better, so people will have a good perception of us."

Each assistant answers at least 30 calls a day, ranging from simple inquiries made by students, to specific questions about the Code of Practice on Human Resource Management by practitioners. Unfortunately, a few callers lose their temper and become irate. In this instance the biggest challenge of the job is to remain polite and professional. This demands a combination of tact, patience and good listening skills.

"I would say about 50% of our callers are quite upset on the phone," said Kam, the third and most senior member of the group. "Some people are looking for us to give them an instant solution, and to tell them what they want to hear. If we don't fulfil their expectations, they snap at us."

The Angels are well versed in the principles of the Ordinance and their application. They are able to answer questions regarding the data protection principles and their relevance to specific situations. They can also recommend further action, such as asking a client to file a formal complaint, or refer them to relevant personnel, if necessary.

However, that often isn't enough to satisfy the demands of some clients. A common misconception people have of the PCPD is that the Ordinance is all-powerful. In point of fact the Ordinance does not provide the PCPD with power to prosecute. "People think that if they make a complaint, their problems will be immediately rectified,. In reality, it takes time and effort to resolve a matter," Bess said. "We then have to explain very carefully our position, what we can do for them and hope they will understand."

As professional and courteous as they may sound on the phone, the PCPD Angels feel that sometimes, the pressure is too much. "We often get looked down upon by callers, because they think that receptionists are not capable of giving sound advice," Vicky said. "They always want to speak with our superiors."

In preparation for their work, the PCPD Angels work diligently at understanding the application of what is a complex Ordinance. Only by so doing can they answer queries correctly. All of them have counselling from social workers, who enabled them to deal with different types of people and how to handle stress calls tactfully. "We were taught not to further aggravate the client," Kam said. "And to listen to people thoroughly before speaking. That way, the caller knows we are on their side."

Vicky can recall a particularly memorable experience. An HR practitioner called in and asked about the application of the Ordinance in the workplace. In the middle of the call the client started to complain about other sections of the government. Sensing that he was clearly irate, Vicky attempted to give a full explanation of the Ordinance, to which the client responded with further harassment. "He basically started yelling and calling me a human tape recorder," she recalled, visibly upset. "He said I was useless, and I should change jobs since I couldn't help people anyway. I told him calmly that I would look into his query and call him back with more information, and I told myself to remain as calm as possible."

She followed through, and the client was apologetic. "He clearly felt very bad about the things he said, and actually apologized to me," she said. "I felt much better, because I was able to make him understand our work and the limitations of the Ordinance."

"We have to control our emotions," Kam added. "With each call we get more practical experience and I would say I am quite proficient now."

Although the job makes some tough demands, the PCPD Angels seem to take everything in their stride. Part of the reason they are so content is that there is a strong team spirit in the office.

"All of us are buddies, we are supportive of each other, and that counts for a lot," Kam said. Vicky, who is fluent in Putonghua, handles most of the Putonghua calls because of her language skills while Bess, with her soothing voice, irons out some pretty tough situations. Kam, a mother of a baby daughter, is mature and most patient. "Some clients just want us to hear them out, and I am glad to lend my ear."

All three of the angels vowed to stay with the job as long as they can. "I love being able to help people," Bess mused. "Each call is a new challenge, it's different. I can't imagine another job that will give me the same satisfaction, and most importantly, the friendships I have built."

Big Brother Awards 2000 (U.S.)

Few organizations would want to be the recipient of the Big Brother Award. In contrast to normal awards, which are given to the best performers, the Big Brother Award, which is presented by Privacy International, a US based privacy advocate group, is given to government or private sector organizations which have done the most to invade personal privacy in the United States. The award judges are lawyers, academics, consultants, journalists and civil rights activists and the nominees are put forward by experts and members of the public.

In this second award in the year 2000, the winner of the award for Greatest Corporate Invader was Double-Click which was found to have monitored the surfing of 50 million net-users. The most Invasive Proposal award was given to the Federal Aviation Administration for the body scanners being placed in US airports. The Lifetime Menace award was given to a US credit reporting agency for selling credit reports to marketers and retaining inaccurate reports for years.

Disclosure of personal data

The complainant made an insurance claim for the loss of her mobile phone. In pursuing the claim, an employee of the insurance company made an enquiry through the customer hotline of the mobile phone company to verify some information regarding the complainant's subscription account. The employee that made the call was male, but the account details belonged to the complainant who was female. In spite of this obvious difference in the identity of the caller, the hotline staff of the mobile phone company disclosed account information to the caller without asking for further information so that authentication checks could be made. In this case the mobile phone company was in breach of the Data Protection Principle 3 in terms of the way it handled the customers' data.

Data Principle Protection 3:
Personal data shall not, without the prescribed consent of the data subject, be used for any purpose other than-
(a) the purpose for which the data were to be used at the time of the collection of the data; or
(b) a purpose directly relate to the purpose referred to in paragraph (a).

Failure to comply with data access request

An individual applied for a job with a company but was found to be unsuitable for appointment after he had taken a skill test. He made a data access request for a copy of the result of his skill test, but he was denied access by the company on grounds that the recruitment exercise was regarded as a staff planning proposal, and hence an exemption was available under the Personal Data (Privacy) Ordinance ("the Ordinance"). However, the individual had never been an employee of the company and the staff planning exemption only applies to processes that relate to current employee -related data. The claim of the exemption by the company was invalid and it was held to be in breach of section 19(1) of the Ordinance.

Privacy Week Promotes Protection of Personal Data in Hong Kong

The Office of the Privacy Commissioner for Personal Data (PCPD) will stage a Privacy Week from the 26 March to 1 April, 2001 to help raise public awareness of personal data privacy.

The Privacy Week will be officially launched at a E-Privacy conference on 26 March (Monday) at the Hong Kong Convention and Exhibition Centre. The Privacy Commissioner for Personal Data, Mr Stephen Lau, has invited guest speakers from Hong Kong and around the world to speak at the conference, "E-Privacy in the New Economy". Topics include Consumers and E-Privacy, transborder data flows, workplace surveillance, legal issues in E-commerce and privacy impact assessment.

The PCPD will also unveil its revamped website at the conference. The new website is designed to be more informative, user-friendly and will cater to the specific needs of the visually impaired. In addition, a new series of booklets on personal data privacy protection on the Internet will be announced. The first of the series, the handbook on the Management of E-Privacy, will be available during the Privacy Week.

Another major event of the Privacy Week will be the Asian Data Privacy Forum on Tuesday 27 March. Representatives of Asian countries and territories have been invited to exchange views and experiences on the data privacy arena.

In an effort to highlight the issue of personal data privacy on the Internet among youngsters, a Website Design Competition for Secondary School Students (www.youngprivacy.com) will be launched. The competition is a joint effort between the PCPD and the Education Department. Training will be provided to teachers who will receive promotional kits as teaching tools. Students are invited to design a website aimed at raising awareness of the importance of the protection of personal data privacy among their peers.

Two open seminars discussing the Code of Practice on Human Resource Management will be held at the Theatre 1, HKCEC on 29 and 30 March. The Code was issued by the Privacy Commissioner last September and will become effective from 1 April, 2001. The Seminars are free to the public.

On 1 April, TVB Jade will broadcast live a special Privacy Night variety show from 9:00 - 10:30pm. The show aims to illustrate everyday situations in which personal data privacy can be violated, the possible consequences, and ways to help prevent the abuse of privacy. Readers who are interested in getting tickets for this live show may contact us at 2827 2827.

A travelling roadshow will also be held at the Shatin New Town Plaza for two days from 31 March to 1 April. The Privacy Week will conclude with a spectacular two-hour live show featuring top DJs and Canto-pop stars on 1 April.

Drama Shows

The PCPD and Hong Kong Baptist University (HKBU) Drama Club have jointly organized a series of shows to promote public awareness of personal data protection.

The event was officially inaugurated on 30 December, 2000 by Mr Stephen Lau, Privacy Commissioner for Personal Data, Mr Tony Lam, Deputy Privacy Commissioner for Personal Data; Mr Ng Hon-wah, Principal Assistant Secretary for Home Affairs; and Dr Eddie Ho, Director of Student Affairs at Hong Kong Baptist University.

The lively comedy is designed to illustrate how people's personal data can be misused in everyday situations. The show also offered insights into ways of preventing the abuse and misuse of personal information.

The shows, held in various community centres throughout Hong Kong, were well received by the public with audiences of over 2,000 people in January. The performances brought home the message of personal data privacy protection in a way that was easily understood by the general public. Members of the audience were also invited to pose questions at an informal talk on personal data privacy conducted by PCPD staff following the show.

The success of the shows will allow the PCPD to organize similar events in the future as a away of conveying the importance of personal data privacy protection to the general public.

PCPD's new website: more efficient and user-friendly

The PCPD recently revamped its official website with a number of enhancements. The original website was launched in December 1996 and featured comprehensive information on the Personal Data (Privacy) Ordinance, PCPD news and activities. The new website will be launched in March 2001.

The new website features, apart from being more efficient and user-friendly, allows easier search for information about personal data privacy in Hong Kong by using a powerful search engine.

The new website is fully bilingual, in Chinese and English, and users can easily switch between the two languages at anytime. Enhancements include interactive fun games for educational purposes as well as on-line reservations for upcoming PCPD events. In addition, the website will also cater to the specific needs of visually impaired people.