How Can a Enterprise in China Lawfully Obtain Employee Personal Details?

With the Data Protection Law of the PRC and the Own Info Security Legislation of the PRC (the PIPL) coming into impact, several companies have began to have out compliance audit within just their entities to make positive the assortment, use, and processing of their employees’ individual info is compliant with the regulations. This short article will look at how providers can collect employees’ particular details even though being lawfully compliant.

Frequent situations in which a firm collects personalized data from its worker

When enterprises perform HR administration as part of the day by day enterprise procedure, they have to have to collect a lot of individual information and facts from their workforce. Below we introduce some common eventualities.

When selecting an staff

Candidates who apply for a occupation to the firm or new workforce who have just joined the business are typically needed to fill in a composed Applicant Data Registration Form or Entry Info Registration Type.

The personalized information and facts normally collected in these types of kinds features:

• Simple particular info, these types of as peak, excess weight, ethnicity, political position, marital position, well being status, instructional background, house handle, get in touch with info, ID card range, and so forth.
• Academic facts, this kind of as college, significant, certificates, and so forth.
• Operate encounter information and facts, this sort of as previous employer(s), placement, career obligations, time, usual job, crucial achievements, factors for leaving, reference, and so forth.
• Faith, particular pursuits, and so on.

Unique work in distinct industries with large community well being and safety requirements may possibly additional need personnel to present a record of an infection and heal of infectious health conditions, such as:

• Positions in foods manufacturing and distribution industries that deal with foods right
• Work opportunities that require in ingesting drinking water production, management, and offer
• Careers that entail in serving prospects in general public destinations directly
• Work opportunities that require in supplying the treatment and schooling operate in nursery and childcare establishments
• Beauty and plastic medical procedures get the job done
• Employment that instantly contain in cosmetics creation

When businesses conduct labor-linked obligations

For performing its labor-relevant obligations as stipulated in the labor deal and the Labor Contract Legislation of the PRC, the corporation requirements to accumulate the employees’ personal details, these as lender account info and social insurance policies account information and facts, for payment of workers salaries and contributing to social insurance plan and housing fund.

In addition, the organization calls for the staff to provide their medical record, ailment diagnostic report, or doctor’s suggestions when the personnel applies for sick leaves relationship certificate for marital leave child’s beginning certificate for nursing leaves, etc. Underneath this kind of situation, the employee’s particular data, this kind of as employee’s sick ailment, employee’s relationship time and their spousal data, employee’s child’s birthday, name, gender, and so on. will be collected by the business.

When the enterprise features distinctive advantages to its workers

Some businesses may well give certain distinctive advantages for their employees, these kinds of as commercial coverage for staff and their people, group vacation, employee’ bodily evaluation, housing subsidies, transportation subsidies, etc. For making the most of this kind of positive aspects, workforce typically need to have to supply extra personalized details to the firm.

For paying for the commercial insurance policies, these kinds of as daily life insurance coverage, professional medical insurance plan, accident insurance plan, significant disorder insurance plan, etc., the business shall gather sensitive private data from the staff and their spouse and children associates, such as illness facts, earlier medical history, restoration position, and health disorders to evaluate whether or not the staff or their family member could participate in these kinds of industrial insurance coverage and how a lot the high quality shall be paid out. Commonly, this kind of delicate personal info is gathered by the enterprise to be forwarded to the coverage corporation.

For paying out the housing subsidy or transportation subsidy to workers, the corporation may have to have employees to present paperwork this sort of as lease agreement, motor vehicle refueling bill, taxi receipt, and many others. to confirm the points. For that reason, employee’s private info, such as residence info, journey time, and payment information and facts recorded on the ticket, will be gathered by the enterprise.

When the corporation conducts unique management

When the enterprise conducts some special administration, employees may perhaps supply particular details to the corporation knowingly or unknowingly in the following situations:

• Working with worker illustrations or photos in company promotion: Organizations generally need to have to use their employees’ pictures and profiles in their promotional movies or brochures. Such instances will include the selection of employees’ portraits.
• Attendance management: Most businesses adopt the modern attendance management method, such as fingerprint punch or encounter identification. In this situation, the enterprise collects its employee’s fingerprint facts or encounter details, which are categorised as personal sensitive information and facts.
• Collecting employee’s personal facts by using digital gadgets: Based on the needs of company administration, the firm may possibly put in some checking software program on the employee’s function computer or mobile telephone to keep an eye on the employee’s computer system usage time, web-site search background, get in touch with period, dial-in or dial-out quantities, etc. Some businesses call for their workforce to report their whereabouts by using the distant punch software when workforce are out of office environment to visit buyers, on enterprise trips, or in field operate. When colleting the employee’s personalized information and facts through electronic gadgets, the business obtains various varieties of personnel individual details and permissions, these as location information and facts, components camera permissions, components storage permissions, hardware machine data, and so forth.
• Collecting employee’s personalized info in the course of the COVID-19 outbreak time period: For the purpose of COVID-19 avoidance and management, the enterprise shall collect employee’s individual information and facts, this kind of as system temperature, touring record, home lockdown info, employee’s sickness infectious and recovery condition, employee’s health circumstances, and many others.

Simple needs for amassing particular facts from staff

According to the PIPL, this legislation applies to all pursuits involving the processing of personalized information of normal folks. Therefore, providers ought to thoroughly comply with the PIPL when amassing particular information and facts from their staff members. As for each the PIPL’s primary principles, the collection of individual information by the company will include things like the pursuing criteria:

• Businesses need to advise their workforce about the goal, scope, and methods of personalized information collection, and receive employees’ consent.
• The assortment of employees’ personalized information and facts shall be lawful, justified, and needed, and shall be limited to the least scope to obtain the reason of collection.
• When collecting employees’ sensitive individual data, organizations need to receive separate consent of staff and can only accumulate these kinds of delicate particular info for precise needs and underneath ample necessity.

Legal foundation for the enterprise to acquire private details from its workforce

When amassing employees’ individual details, except for employees’ consent, the enterprise need to have satisfactory authorized foundation for the collection. Less than the present rules and regulations, the beneath 5 lawful bases are regularly cited.

Labor-related legal guidelines and regulations

Article 8 of the Labor Deal Law of the PRC stipulates that the “employer has the ideal to know the essential information specifically similar to the labor deal, and the staff shall truthfully make an clarification.” Nearby restrictions, these kinds of as Report 10 of Beijing Labor Contract Regulation, stipulates that “the worker has the suitable to know employer’s conditions and shall honestly supply details these types of as his/her ID copy, instruction background, work predicament, performing working experience, and professional techniques, etcetera.”

Thus, based on the abovementioned legislation and area laws, the employer has the lawful floor to obtain employee’s fundamental details, health and fitness affliction, information amount, and work encounter, and so on.

Public health and fitness safety requirements

Short article 45 of Food stuff Safety Regulation stipulates that “persons struggling from conditions impacting foods basic safety as stipulated by the administrative division of public health and fitness under the Condition Council shall not engage in any do the job involving get hold of with prepared-to-take in food”. Short article 7 of Polices on the Administration of Public Health and fitness stipulates that “persons suffering from dysentery, typhoid fever, viral hepatitis, lively pulmonary tuberculosis, suppurative or exudative pores and skin illness, or any other condition affecting public health shall not engage in direct consumer support right until cured”. Post 33 of the Restrictions on Supervision and Administration of Cosmetics also stipulates that human being struggling from precise ailments could not right have interaction in beauty output routines.

Hence, if a business involves in the aforementioned operate, it has the appropriate to ask for its worker to supply sensitive own facts associated to the disease.

Work security guidelines and rules

The Occupational Ailment Prevention and Control Legislation presents the particular protections on staff who engaging in operates exposed to poisonous and hazardous things. Female Employee Labor Security Provisions gives particular protections for feminine employees.

For example, the firm should establish an archive to file employees’ own details linked to the occupational dangers, such as but not limited to doing the job heritage, speak to background on occupational hazards, occupational wellness examination results, and individual overall health information and facts these types of as occupational disorder diagnosis and therapy, and so forth. For the female employees, the corporation cannot arrange them to do specified variety of will work in the course of periods of menstruation, pregnancy, postpartum, breastfeeding, etc.

Specified this, to protect the employees’ overall health, the company has the authorized ground to accumulate employees’ particular information connected to occupational heritage, occupational disorder get hold of background, overall health evaluation outcomes, occupational disease diagnosis, being pregnant status, and birth standing, and many others.

Community health and fitness unexpected emergency

According to the Detect on the Defense of Own Information and facts and the Use of Major Information to Help Joint Avoidance and Handle issued in February 2020, when collecting personal info for COVID-19 prevention and handle, the topics shall be confined to the verified scenarios, suspected conditions, shut contacts, and other critical teams, shall not expand to all folks in a given space without personal details owner’s consent, no celebration or specific has the right to disclose other person’s identify, age, ID number, phone selection, handle, other than for private details went by the desensitization treatment and is required for the COVID-19 prevention and regulate.

As needed by the local guidelines on COVID avoidance and control,  the enterprise might look at the employees’ system temperature when they arrive at the firm office environment every single working day, acquire employee’s travelling facts and their property handle, question the staff to give a prior detect to the firm when they vacation to other towns, etcetera. When colleting employees’ personal data, the firm should abide by the principle of reducing the scope of information demanded and securely storing the employees’ own information gathered.

Collective labor agreement or company’s procedures and rules

According to the PIPL, the company can acquire its employees’ individual facts for the purpose of HR management in accordance with its collective labor deal with personnel and its internal rules and policies formulated in accordance with relevant guidelines and polices. As to the personal data needed for company’s HR management, it could be employee’s ID quantity, fingerprint information, phone selection, tackle, social coverage amount, financial institution account facts, and so on. The corporation shall contain assortment of these types of private information in its collective labor agreement or company’s internal procedures and procedures as a authorized floor for accumulating employee’s individual facts.

Compliance solutions for companies amassing personalized facts from personnel

Where by it is necessary to acquire particular data from personnel, we recommend businesses follow the under very best procedures.

Lessen the selection scope

The scope of own information collected from staff members should be confined to the information directly similar to the summary and general performance of employee’s labor deal, these kinds of as ID facts, conversation facts, schooling and employment qualification information, function experience facts, and many others. Individual sensitive information and facts, these as wellbeing information and facts, infectious condition facts and special facts of female worker, and so on., could be collected for specific positions or for labor defense or feminine worker labor security. The individual consent of the personnel is needed for the selection of delicate data.

Set up sensible grounds for gathering feminine staff relationship and delivery information and details of employee’s spouse and children associates

Female employees’ marriage and beginning facts, menstrual time period info, breastfeeding facts, etc. should not be gathered with no a affordable ground, apart from for the reason of defense of female employees’ rights less than the Woman Personnel Labor Protection Provisions. The corporation need to not specifically dismiss the employee or refuse to employ the employee if he/she refuses to present these kinds of private data to corporation.

Include things like in company’s collective labor agreement or company’s inner guidelines and regulations of sensible assortment of employee’s personalized details

Where a firm intends to acquire its employee’s own information by means of working products, it really should clearly stipulate in its business procedures and restrictions that:

• Do the job e mail, laptop, cellular phone, and other do the job-relevant digital gadgets and digital accounts utilized by employees slide in the scope of “work equipment”.
• For the objective of company’s administrative and HR managements, organization has legal rights to supervise and look at employees’ performing tools and gather the facts restored in these kinds of doing work tools.
• Through the term of work, the employee shall use the get the job done gear only for the goal of function and shall not use it for particular challenges.
• Staff members are prohibited to use their individual computer systems, gadgets, and email to deal with perform-connected difficulties.

In addition, the goal of amassing of private info and the particular information processing method really should also be obviously stipulated in the company’s collective labor agreement or enterprise rules and polices.

When accumulating personal info of personnel as requested by a 3rd social gathering, the company shall allow the third social gathering to gather the details straight from personnel by alone

When the enterprise invest in life insurance policies, health and fitness coverage, and incident insurance coverage for workers and their people, the third party, i.e., the insurance coverage firm can right obtain private info and sensitive information and facts from staff members. The firm can conduct its private information protection obligation as a result of a pertinent deal with the 3rd bash in which the 3rd social gathering is essential to fulfill the individual details security obligation to the exact level as the corporation.

Satisfy the obligation to advise the personnel and get hold of the employee’s consent

When amassing personalized facts from its staff, the organization should clearly inform the personnel about the reason of assortment, use of the private information and facts to be gathered, how the details will be stored, and so on. For delicate own facts collected, a independent consent from the worker will have to be taken.