The necessity principle for employers requesting personal data

According to the Office of the Privacy Commissioner for Personal Data (PCPD)‘s Human Resources Management Practice Code, when employers request personal data from job seekers during the recruitment process, they must comply with the data collection principle — namely that the data collected must be directly related to the recruitment purpose, and must be adequate but not excessive.

When attending interviews or filling in recruitment forms, job seekers should check whether the personal data requested by the employer falls within the following necessary categories:

  • Data identifying the applicant, such as name, contact telephone number and address
  • Data for assessing the applicant’s suitability for the position, such as academic qualifications, professional qualifications, work history and experience
  • Where necessary, referee details or confirmation from previous employers may be requested

Employers should not request personal data unrelated to the selection decision, such as marital status, number of children, or religious beliefs, unless there is a reasonable basis to show that such data is directly relevant to the position.

How job seekers should check the necessity of data

When an employer requests personal data, job seekers may proactively ask the employer the following questions to verify the necessity of the data:

  • What is the purpose of collecting this data?
  • Is this data necessary for assessing work capability?
  • Would failing to provide it affect the application?

If the employer cannot provide a reasonable explanation, or the data is clearly unrelated to the position (for example, requiring a copy of the identity card number for preliminary screening), the job seeker should carefully consider whether to provide it.

Retention arrangements for personal data

The PCPD’s guidance also requires employers to clearly inform job seekers of the purpose for collecting the data, the persons or organisations to whom it may be transferred, and the rights to access and correct the data. In addition, employers are responsible for ensuring that the data collected is not retained longer than necessary to achieve the original purpose.

Retention period for unsuccessful applicants

  • Counting from the date the job seeker is unsuccessful, the retention period should not exceed two years, unless there is a specific reason for retaining it longer (for example, retaining the data for consideration for future vacancies).

Handling of data for successful applicants

  • The job application data of a successful applicant may be converted into part of the employment record, and handled in accordance with the retention rules for employment records.

Job seekers have the right to enquire with the employer about the retention arrangements for their personal data, and may request that the employer destroy their data after the selection process is completed.