An employer requires employees to submit credit reports
The Enquiry
Whether the employer can require employees to submit credit reports.
Our Response
The employer, as a data user, is required to comply with Data Protection Principle (DPP) 1 of Schedule 1 to the Ordinance and the “Code of Practice on Human Resource Management” (the Code) upon collecting personal data of employees. DPP1 requires that a data user should only collect personal data where it is adequate but not excessive for a lawful purpose directly related to its function or activity, and that the data must be collected in a fair and lawful manner. All practicable steps shall be taken to ensure that the employee is informed, on or before collecting the data, of whether it is obligatory or voluntary for him to supply the data and the consequences of not supplying the data, and the purpose for which the data is to be used and the classes of persons to whom the data may be transferred.
Pursuant to paragraph 3.2.1 of the Code, an employer may collect personal data from an employee provided that the collection of the data is necessary for or directly related to a human resource function of the employer; or pursuant to a lawful requirement that regulates the affairs of the employer; and by means that are fair in the circumstances and the data is not excessive in relation to the purpose.
Furthermore, paragraph 3.2.3 of the Code provides that an employer may collect personal data of an employee to facilitate integrity checking or to determine any conflict of interest by the employee, provided that the requirements mentioned in paragraph 3.2.1 are complied with; the data is important to the employer in relation to the inherent nature of the job for which the employee is appointed; and the employer has a policy covering such practices, prior notice of which has been brought to the attention of the employee concerned.
If employees have concerns about the data collection, they may contact the employer directly regarding its purpose and necessity before providing the data.
(Uploaded in August 2026)