"Blind" recruitment advertisements are frequently deployed by unscrupulous or fake companies as a means of luring unsuspecting jobseekers. But, there may be legitimate reasons for hiding your company’s identity in recruitment advertisements. HR managers should take care when requesting personal information from job applicants.
The Privacy Commissioner for Personal Data (PCPD) has established a Code of Practice on Human Resource Management (The Code) pursuant to the requirements of the Personal Data (Privacy) Ordinance (The Ordinance) concerning employment-related personal data privacy. In relation to recruitment advertisements, the Code requires that parties placing recruitment advertisements must identify themselves and state the purpose for which the data are to be used if they directly solicit personal data from job applicants in a recruitment advertisement.
The following Q&As, provided by the PCPD, examine the particular requirements of the Code in respect of recruitment advertisements.
What is a “blind” recruitment advertisement in the context of the Code?
Generally speaking, a “blind” recruitment advertisement is one that does not identify either the employer or the employment agency acting on its behalf.
Does the Code apply to all recruitment advertisements?
No. The Code only applies to recruitment advertisements that directly solicit personal data from job applicants. Under the Code, an employer or the employment agency acting on its behalf is not permitted to place a “blind” recruitment advertisement that directly invites job applicants to submit their resumes or CVs. Where there are no direct solicitations of personal data in a recruitment advertisement, such an advertisement would not be subject to the requirements of the Code. For example, if the advertisement merely invites job seekers to write in to obtain an application form or contact a representative person, there is no direct solicitation of personal data.
Under what circumstances can job applicants be asked in a recruitment advertisement to submit personal data?
An employer or recruitment agency who clearly indicates its identity may ask job applicants to submit personal data in a recruitment advertisement, provided that the data is adequate but not excessive in relation to the purpose of recruitment and are to be used lawfully (section 2 of the Code).
Why is an employer required to identify itself in recruitment advertisements that solicit personal data from job applicants?
An employer who collects personal data from job applicants without identifying itself, or an appointed recruitment agency, might have engaged in an act of unfair collection of personal data contrary to the requirement of Data Protection Principle 1(2) of the Ordinance (“DPP1(2)”) (details of the Data Protection Principles are set out at the end of this Fact Sheet). DPP1(2) provides that personal data should be collected by means which are fair in the circumstances of the case.
It would generally not be fair for persons collecting personal data not to identify themselves when collecting personal information.Secondly, personal data collected from job applicants is subject to access and correction by the person concerned. Unless exempted from doing so under the Ordinance, an employer is required to provide a copy of the data no later than 40 days after receiving a data access request. Job applicants would not be able to exercise their data access rights if they are denied the identity of the organization that collects their personal data (section 2.11 of the Code).
What can an employer do if it wants to conceal its identity in a recruitment advertisement without contravening the Code?
If an employer finds it necessary to conceal its identity in a recruitment advertisement, it should not require job applicants to submit their personal data in response to the advertisement. In this circumstance, an employer may provide job applicants, upon request, with an application form that bears the employer’s identity. Alternatively, the employer may use a recruitment agency identified in the advertisement to receive the personal data solicited from applicants (2.3.3 of the Code).
Can an employer directly solicit personal data from job applicants if it merely uses its company email address, telephone number or fax number as a means of identifying itself in a recruitment advertisement?
No. A company email address, telephone number or fax number by itself is generally not considered to be sufficient identification of the employer.
Can an employer display its company logo as a means of identifying itself in a recruitment advertisement if it directly solicits personal data from job applicants?
No. In this case the requirement of the Code is satisfied only if the full name of the company appears in the logo.
Do people who want to hire a driver, gardener or domestic helper, in a personal capacity, have to identify themselves in a recruitment advertisement if they directly solicit personal data from job applicants?
Yes. All employers, whether individuals or organizations, are required to comply with the provisions of the Code. In this respect, individuals must also identify themselves if they directly solicit personal data from job applicants in recruitment advertisements. If the individual does not wish to disclose their identity, they may simply provide a telephone number in the advertisement for further enquiries before any personal data is collected.
Some employers provide their fax number, postal address or e-mail address in a recruitment advertisement without explicitly asking job applicants to submit their personal data. Is this practice acceptable under the Code?
No. The practice of employers providing a fax number, postal address or e-mail address in a recruitment advertisement is perceived as a way of inviting job applicants to submit their personal data and is not permissible under the provisions of the Code.
If an employer engages an agent to undertake recruitment on its behalf, whose identity has to be revealed in the recruitment advertisement?
In the case where an employer engages an agency to undertake recruitment, it would be sufficient for the agency only to be identified in the advertisement (2.2 and 2.3.3 of the Code).
Can a subsidiary company place a recruitment advertisement under the name of the holding company?
No. Unless it is made known in the advertisement that the holding company acts as an agent in administering the recruitment process for the subsidiary company, otherwise the subsidiary company must disclose its identity in a recruitment advertisement.
Should an employer provide a notification statement regarding the purpose of use of the personal data submitted by job applicants in a recruitment advertisement?
Yes. The Code requires an employer to take all practicable steps to ensure that job applicants are informed of certain matters in accordance with the notification requirement of Data Protection Principle 1(3) of the Ordinance (“DPP1(3)”). Generally, the notification can be made in the form of a Personal Information Collection Statement (“PICS”) on or before personal data is collected. In the case of a recruitment advertisement that directly solicits personal data from job applicants for recruitment purposes, a statement: “Personal data collected will be used for recruitment purposes only” should be included as an integral part of the advertisement.
What can an employer do if it does not wish to include a PICS in a recruitment advertisement?
An employer may state in the recruitment advertisement the telephone number and contact person from whom a copy of the PICS pertaining to recruitment may be obtained. Alternatively, employers may invite job applicants to respond by completing a job application form issued by the employer that details the PICS. A statement to the following effect should be included: “Personal data provided by job applicants will be used strictly in accordance with the employer’s personal data policies, a copy of which will be provided immediately upon request.” In this case, contact details of the employer should be stated in the advertisement.
Would an employer be exempted from disclosing its identity by providing a PICS if it wants to directly solicit personal data from job applicants in a recruitment advertisement?
No. An employer needs to provide a PICS only when job applicants are required to provide personal data. If an employer merely asks job applicants to contact the company by telephone or request an application form by mail, a PICS would not be required at this stage. However, if an employer wants to solicit personal data directly from job applicants in a recruitment advertisement, it must identify itself in the first place.
Can an employer invite job applicants in a recruitment advertisement to submit a job application online at the employer’s website?
An employer may do so but must ensure compliance with the requirements of the Code as an application invited online amounts to the collection of personal data from applicants. When an employer requires job applicants to submit personal data in an online format on the company web page, the identity of the employer should be disclosed, and the PICS notification requirement complied with. In this case, the PICS can be displayed as a linked page to the online form or as a “pop-up” screen when a “confirm” button is pressed prior to the transmission of the online form (section 2.2.6 of the Code).
Paul Arkwright
Publisher
