SINGAPORE Law and Practice Contributed by: Kelvin Tan, Benjamin Gaw and Lim Chong Kin, Drew & Napier LLC
employees covered under the Employment Act, which includes the employees’ identity card number or for - eign identification number, residential address, date of birth, gender, and other relevant information as speci - fied under the Employment (Employment Records, Key Employment Terms and Pay Slips) Regulations 2016. Thus, to the extent that the collection of per - sonal data is authorised or required under these laws, employers may collect such employee personal data without employees’ consent. For example, under Section 17 of the PDPA, read with Part 3 of the First Schedule to the PDPA, employers may collect, use and disclose employee personal data without consent where: • the collection, use or disclosure of the employee’s personal data is for the purpose of or in relation to – (a) entering into an employment relationship with the individual or appointing the individual to any office, or (b) managing or terminating an employment rela - tionship; or • the collection, use or disclosure of personal data is necessary for evaluative purposes (ie, for the purpose of determining the suitability, eligibility or qualifications of the individual for employment, appointment to office, promotion, removal, etc). For job applicants, deemed consent may also apply when they voluntarily provide their personal data to the organisation during the application process, pro - vided it was reasonable for them to have been asked to provide such data. Need to Notify Employees of Collection However, while consent may not be required in cer - tain scenarios, the employer is still required to notify the individual of the purpose of such collection, use or disclosure, and, on request by the individual, the business contact information of a person who is able to answer the individual’s questions relating to such processing. For new and existing employees, organisations may choose to provide them with notice of such collec - tion, use or disclosure in the employment contract,
employee privacy policy, employee data protection handbook, or data protection notices on the company intranet. For job applicants, organisations may include a data protection notice in the job application form. Other Obligations Under the PDPA Employers must also comply with several other data protection obligations under the PDPA, as set out below. Purpose limitation obligation Employers must only collect, use or disclose employ - ee personal data for purposes that a reasonable per - son would consider appropriate in the circumstances. Access and correction obligation While there is a general requirement for organisations to provide individuals with the right to access and cor - rect their personal data, there are some exceptions to this requirement. For example, employers do not need to provide job applicants with the opinions formed in the course of determining the applicant’s suitabil - ity and eligibility as this would be considered opinion data kept solely for evaluative purposes. Retention limitation obligation While employers can retain the personal data of former employees and job applicants for future job opportu - nities, they should not retain such personal data if it no longer serves the purpose for which it was collected and if it is no longer necessary for legal or business purposes. This includes the minimum statutory reten - tion period under the Employment Act. Accuracy obligation Employers must make reasonable efforts to ensure the accuracy and completeness of employee personal data. Protection obligation Employers must protect the employee personal data that they possess or control by making reason - able security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modifi - cation, disposal or similar risks, as well as the loss of storage mediums or devices on which personal data is stored.
523 CHAMBERS.COM
Powered by FlippingBook