various schools notifying them of its blacklisting of the complainant, a former
employee; the email included the complainant’s name and national identification
number. The Commission held that while there can be “valid business or legal
reasons” for blacklisting a former employee, even if it requires disclosing his/her
personal data, the organisation should at least have notified the former employee of
such disclosure; such disclosure should also be “only for purposes that a reasonable
person would consider appropriate in the circumstances”.
194 In this case, not only
was consent not obtained, but there was also no business or legal reason justifying
said disclosure, e.g. if the complainant’s post-employment conduct “had put the
[organisation’s] trade reputation or potential clients at risk”.
195
Exceptions An organisation may collect, use or disclose employees’ personal data
without consent if the collection is “reasonable for the purpose of managing or
terminating an employment relationship between the organisation and the individual” (“Managing/Terminating Purposes”),
196 or for evaluative purposes (“Evaluative Purposes”)
197 ; or if the personal data was in a document “produced in the
course, and for the purposes, of the [employee’s] employment” and “collected for
purposes consistent with the purposes for which the document was produced”.
198
Managing/Terminating Purposes include: “[u]sing the employee’s bank account
details to issue salaries”; “[m]onitoring how the employee uses company computer
network resources”; “[p]osting employees’ photographs on the staff directory page
on the company intranet”; and “[m]anaging staff benefit schemes like training or
educational subsidies”.
199 Evaluative Purposes include obtaining performance
records or other evaluative information to determine an employee’s performance.
200
The difference between the two purposes lies in the requirement to notify
employees regarding actions for Managing/Terminating Purposes but not Evaluative
Purposes.
201 An organisation shall, on or before collecting, using or disclosing
personal data about an employee for Managing/Terminating Purposes, inform
him/her of such purpose and (on request) provide the business contact information
of a person who is able to answer the employee’s questions about such collection,
use or disclosure.
202 The manner of notification is not prescribed, but it may be
appropriate to notify employees through avenues like “employment contracts,
employee handbooks, or notices in the company intranet”.
203 Organisations should
194 [2016] SGPDPC 21 at [10].
195 [2016] SGPDPC 21 at [12].
196 PDPA Second Schedule s 1(o), Third Schedule s 1( j ), Fourth Schedule s 1(s).
197 PDPA Second Schedule s 1( f ), Third Schedule s 1( f ), Fourth Schedule s 1(h).
198 PDPA Second Schedule s 1(n), Third Schedule s 1( j), Fourth Schedule s 1(s).
199 PDPC Advisory Guidelines for Selected Topics para 5.21.
200 PDPC Advisory Guidelines for Selected Topics para 5.18.
201 PDPC Advisory Guidelines for Selected Topics para 5.24.
202 PDPA s 20(4).
203 PDPC Advisory Guidelines for Selected Topics para 5.20.
328
E.-I. Ong
employee; the email included the complainant’s name and national identification
number. The Commission held that while there can be “valid business or legal
reasons” for blacklisting a former employee, even if it requires disclosing his/her
personal data, the organisation should at least have notified the former employee of
such disclosure; such disclosure should also be “only for purposes that a reasonable
person would consider appropriate in the circumstances”.
194 In this case, not only
was consent not obtained, but there was also no business or legal reason justifying
said disclosure, e.g. if the complainant’s post-employment conduct “had put the
[organisation’s] trade reputation or potential clients at risk”.
195
Exceptions An organisation may collect, use or disclose employees’ personal data
without consent if the collection is “reasonable for the purpose of managing or
terminating an employment relationship between the organisation and the individual” (“Managing/Terminating Purposes”),
196 or for evaluative purposes (“Evaluative Purposes”)
197 ; or if the personal data was in a document “produced in the
course, and for the purposes, of the [employee’s] employment” and “collected for
purposes consistent with the purposes for which the document was produced”.
198
Managing/Terminating Purposes include: “[u]sing the employee’s bank account
details to issue salaries”; “[m]onitoring how the employee uses company computer
network resources”; “[p]osting employees’ photographs on the staff directory page
on the company intranet”; and “[m]anaging staff benefit schemes like training or
educational subsidies”.
199 Evaluative Purposes include obtaining performance
records or other evaluative information to determine an employee’s performance.
200
The difference between the two purposes lies in the requirement to notify
employees regarding actions for Managing/Terminating Purposes but not Evaluative
Purposes.
201 An organisation shall, on or before collecting, using or disclosing
personal data about an employee for Managing/Terminating Purposes, inform
him/her of such purpose and (on request) provide the business contact information
of a person who is able to answer the employee’s questions about such collection,
use or disclosure.
202 The manner of notification is not prescribed, but it may be
appropriate to notify employees through avenues like “employment contracts,
employee handbooks, or notices in the company intranet”.
203 Organisations should
194 [2016] SGPDPC 21 at [10].
195 [2016] SGPDPC 21 at [12].
196 PDPA Second Schedule s 1(o), Third Schedule s 1( j ), Fourth Schedule s 1(s).
197 PDPA Second Schedule s 1( f ), Third Schedule s 1( f ), Fourth Schedule s 1(h).
198 PDPA Second Schedule s 1(n), Third Schedule s 1( j), Fourth Schedule s 1(s).
199 PDPC Advisory Guidelines for Selected Topics para 5.21.
200 PDPC Advisory Guidelines for Selected Topics para 5.18.
201 PDPC Advisory Guidelines for Selected Topics para 5.24.
202 PDPA s 20(4).
203 PDPC Advisory Guidelines for Selected Topics para 5.20.
328
E.-I. Ong