After the employee left the company, the employer published his/her departure information on a webpage
The Enquiry
After the employee left the company, he/she discovered that the employer had published his/her departure information on a webpage, including his/her name, resignation date and last date of employment. The enquirer would like to know whether the employer’s act contravened the requirements of the Ordinance.
Our Response
Before disclosing the personal data of former employees, employers should observe the requirements under Data Protection Principle (DPP) 3. DPP3 prohibits the use of personal data for any new purpose which is not or is unrelated to the original purpose when collecting the data, unless with the data subject’s express and voluntary consent.
Besides, according to paragraph 4.6.1. of the “Code of Practice on Human Resources Management” (the Code), an employer who finds it necessary to announce publicly that a former employee has left employment, and no longer represents it, should include only the minimum information required to identify the employee concerned. Generally, the former employee’s full name, former job title and name of the organisation would be sufficient for fulfilling the purpose of the announcement. An employer should not state the reason of the former employee’s departure in such a public announcement. If it is necessary to disclose the relevant reason, the employer should consider obtaining prior consent of the individual concerned unless the employer has reasonable grounds to believe that such disclosure to a news organisation would be in the public interest.
Irrespective of whether the employer’s disclosure of the enquirer’s personal data complied with the requirements under the Ordinance and the Code, the enquirer may still request the employer to remove his/her relevant information from the webpage.
(Uploaded in February 2026)