Is your startup going to recruit and prepare for launch? Let’s go through the seven common questions below and learn about the points to note when you are hiring and handling personal data. 1. How to ensure that the job seeker is lawfully employable? The law requires an employer to take all practical steps to ensure that the job seeker is lawfully employable. If the job seeker is not holding a Hong Kong permanent identity card, the law requires an employer to inspect the job seeker's valid travel document. 2. Can an employer collect copies of the identity cards of job applicants? Generally speaking, an employer must not collect a copy of the identity card of a job applicant during the recruitment process unless and until the individual has accepted an offer of employment. 3. Under what circumstances can job applicants be asked in a recruitment advertisement to submit personal data? An employer or recruitment agency who clearly indicates its identity may ask job applicants to submit personal data in a recruitment advertisement, provided that the data is adequate but not excessive in relation to the purpose of recruitment and is to be used lawfully. 4. Can an employer directly solicit personal data from job applicants if it merely uses its company email address, telephone number or fax number as a means of identifying itself in a recruitment advertisement? No. A company email address, telephone number or fax number by itself is generally not considered to be sufficient identification of the employer. If the employer does not wish to disclose its identity, it may simply provide a telephone number in the advertisement and indicate that the applicants can make further enquiries before submitting any personal data. 5. Should an employer provide, within a recruitment advertisement, a statement regarding the purpose for which the personal data submitted by job applicants will be used? Recruitment advertisements that directly ask job applicants to provide their personal data should include a statement, as an integral part of the advertisement, informing applicants about the purposes for which their personal data are to be used. Here is an example of such statement: "Personal data collected will be used for recruitment purposes only". 6. How long is an employer allowed to keep the personal data of unsuccessful job applicants? Personal data of unsuccessful applicants (for future recruitment purposes) can be retained for a period of up to two years from the date of rejecting the applicants, and must then be destroyed. 7. Must we obtain consent from an employee or ex-employee before giving an employment reference to another employer? Yes, you should obtain the prescribed consent from an employee or ex-employee (preferably in writing) as disclosure of the employee’s records (including performance assessment) to another person would constitute to a change in the purpose of use of the data. Source: The Office of the Privacy Commissioner for Personal Data, Hong Kong - Understanding the Code of Practice on Human Resource Management Frequently Asked Questions About Recruitment Advertisements , Immigration Department “Startup How-tos” is an introductory guidebook written for entrepreneurship newbies, providing startup tips and related public services information.