With the Data Security Law of the PRC and the Personal Information Protection Law of the PRC (the PIPL) coming into effect, many companies have started to carry out compliance audit within their entities to make sure the collection, use, and processing of their employees’ personal information is compliant with the laws. This article will examine how companies can collect employees’ personal information while being legally compliant.
When enterprises conduct HR management as part of the daily business operation, they need to collect a lot of personal information from their employees. Below we introduce some common scenarios.
Candidates who apply for a job to the company or new employees who have just joined the company are usually required to fill in a written Applicant Information Registration Form or Entry Information Registration Form.
The personal information commonly collected in such forms includes:
Specific jobs in specific industries with high public health and safety requirements may further require employees to provide a history of infection and cure of infectious diseases, such as:
For performing its labor-related obligations as stipulated in the labor contract and the Labor Contract Law of the PRC, the company needs to collect the employees’ personal information, such as bank account information and social insurance account information, for payment of staff salaries and contributing to social insurance and housing fund.
In addition, the company requires the employee to provide their medical record, disease diagnostic report, or doctor’s suggestions when the employee applies for sick leaves; marriage certificate for marital leave; child’s birth certificate for nursing leaves, etc. Under such circumstances, the employee’s personal information, such as employee’s sick condition, employee’s marriage time and their spousal information, employee’s child’s birthday, name, gender, etc. will be collected by the company.
Some companies may provide certain special benefits for their employees, such as commercial insurance for employees and their families, group travel, employee’ physical examination, housing subsidies, transportation subsidies, etc. For enjoying such benefits, employees usually need to provide more personal information to the company.
For purchasing the commercial insurance, such as life insurance, medical insurance, accident insurance, serious disease insurance, etc., the company shall collect sensitive personal information from the employee and their family members, such as illness information, past medical history, recovery status, and health conditions to evaluate whether the employee or their family member could participate in such commercial insurance and how much the premium shall be paid. Normally, such sensitive personal information is collected by the company to be forwarded to the insurance company.
For paying the housing subsidy or transportation subsidy to employees, the company may require employees to provide documents such as lease contract, car refueling invoice, taxi receipt, etc. to verify the facts. Consequently, employee’s personal information, such as residence information, travel time, and payment information recorded on the ticket, will be collected by the company.
When the company conducts some special management, employees may provide personal information to the company knowingly or unknowingly in the following scenarios:
According to the PIPL, this law applies to all activities involving the processing of personal information of natural persons. Consequently, companies must fully comply with the PIPL when collecting personal information from their employees. As per the PIPL’s basic principles, the collection of personal information by the company will include the following considerations:
When collecting employees’ personal information, except for employees’ consent, the company must have adequate legal basis for the collection. Under the current laws and regulations, the below five legal bases are frequently cited.
Article 8 of the Labor Contract Law of the PRC stipulates that the “employer has the right to know the basic information directly related to the labor contract, and the employee shall truthfully make an explanation.” Local regulations, such as Article 10 of Beijing Labor Contract Regulation, stipulates that “the employee has the right to know employer’s conditions and shall truthfully provide information such as his/her ID copy, education background, employment situation, working experience, and professional skills, etc.”
Therefore, based on the abovementioned law and local regulations, the employer has the legal ground to collect employee’s basic information, health condition, knowledge level, and work experience, etc.
Article 45 of Food Safety Law stipulates that “persons suffering from diseases affecting food safety as stipulated by the administrative department of public health under the State Council shall not engage in any work involving contact with ready-to-eat food”. Article 7 of Regulations on the Administration of Public Health stipulates that “persons suffering from dysentery, typhoid fever, viral hepatitis, active pulmonary tuberculosis, suppurative or exudative skin disease, or any other disease affecting public health shall not engage in direct customer service until cured”. Article 33 of the Regulations on Supervision and Administration of Cosmetics also stipulates that person suffering from specific diseases may not directly engage in cosmetic production activities.
Therefore, if a company involves in the aforementioned work, it has the right to request its employee to provide sensitive personal information related to the illness.
The Occupational Disease Prevention and Control Law provides the special protections on employees who engaging in works exposed to toxic and harmful factors. Female Employee Labor Protection Provisions provides specific protections for female employees.
For example, the company must establish an archive to record employees’ personal information related to the occupational hazards, including but not limited to working history, contact history on occupational hazards, occupational health examination results, and personal health information such as occupational disease diagnosis and treatment, etc. For the female employees, the company cannot arrange them to do certain type of works during periods of menstruation, pregnancy, postpartum, breastfeeding, etc.
Given this, to protect the employees’ health, the company has the legal ground to collect employees’ personal information related to occupational history, occupational disease contact history, health examination results, occupational disease diagnosis, pregnancy status, and birth status, etc.
According to the Notice on the Protection of Personal Information and the Use of Big Data to Support Joint Prevention and Control issued in February 2020, when collecting personal information for COVID-19 prevention and control, the subjects shall be confined to the confirmed cases, suspected cases, close contacts, and other key groups, shall not expand to all people in a given area; without personal information owner’s consent, no party or individual has the right to disclose other person’s name, age, ID number, telephone number, address, except for personal information went through the desensitization treatment and is necessary for the COVID-19 prevention and control.
As required by the local policies on COVID prevention and control, the company may examine the employees’ body temperature when they arrive at the company office every day, collect employee’s travelling information and their home address, ask the employee to give a prior notice to the company when they travel to other cities, etc. When colleting employees’ personal information, the company must abide by the principle of minimizing the scope of data required and securely storing the employees’ personal information collected.
According to the PIPL, the company can collect its employees’ personal information for the purpose of HR management in accordance with its collective labor contract with employees and its internal rules and policies formulated in accordance with applicable laws and regulations. As to the personal information necessary for company’s HR management, it could be employee’s ID number, fingerprint information, telephone number, address, social insurance number, bank account information, etc. The company shall include collection of such personal information in its collective labor contract or company’s internal rules and policies as a legal ground for collecting employee’s personal information.
Where it is necessary to collect personal information from employees, we suggest companies follow the below best practices.
The scope of personal information collected from employees should be limited to the information directly related to the conclusion and performance of employee’s labor contract, such as ID information, communication information, education and employment qualification information, work experience information, etc. Personal sensitive information, such as health information, infectious disease information and special information of female employee, etc., could be collected for special positions or for labor protection or female employee labor protection. The separate consent of the employee is required for the collection of sensitive information.
Female employees’ marriage and birth information, menstrual period information, breastfeeding information, etc. should not be collected without a reasonable ground, except for the purpose of protection of female employees’ rights under the Female Employee Labor Protection Provisions. The company should not directly dismiss the employee or refuse to employ the employee if he/she refuses to provide such personal information to company.
Where a company intends to collect its employee’s personal information through working equipment, it should clearly stipulate in its company rules and regulations that:
In addition, the purpose of collecting of personal information and the personal information processing method should also be clearly stipulated in the company’s collective labor contract or company rules and regulations.
When the company purchase life insurance, health insurance, and accident insurance for employees and their families, the third party, i.e., the insurance company can directly collect personal information and sensitive information from employees. The company can perform its personal information protection obligation through a relevant contract with the third party in which the third party is required to fulfill the personal information protection obligation to the same level as the company.
Fulfill the obligation to inform the employee and obtain the employee’s consent
When collecting personal information from its employees, the company must clearly inform the employees about the purpose of collection, usage of the personal information to be collected, how the information will be stored, etc. For sensitive personal information collected, a separate consent from the employee must be taken.
China Briefing is written and produced by Dezan Shira & Associates. The practice assists foreign investors into China and has done so since 1992 through offices in Beijing, Tianjin, Dalian, Qingdao, Shanghai, Hangzhou, Ningbo, Suzhou, Guangzhou, Dongguan, Zhongshan, Shenzhen, and Hong Kong. Please contact the firm for assistance in China at china@dezshira.com. Dezan Shira & Associates has offices in Vietnam, Indonesia, Singapore, United States, Germany, Italy, India, and Russia, in addition to our trade research facilities along the Belt & Road Initiative. We also have partner firms assisting foreign investors in The Philippines, Malaysia, Thailand, Bangladesh.
Previous Article « The Spillover Effects of a US Recession: How Businesses in Asia Can Prepare
Next Article How to Define a Business Scope in China and the UK? »
Dezan Shira & Associates´ brochure offers a comprehensive overview of the services provided by the firm. With...
A firm understanding of China’s laws and regulations related to human resources and payroll management is ab...
Doing Business in China 2022 is designed to introduce the fundamentals of investing in China. Compiled by the ...
With the scope and penalties of China’s social credit system being further clarified in 2021, legal and regu...
As a legitimate tool for reasonable tax planning and cost saving, tax incentives play an important role. Compa...
Over the last few months, China has been quickly expanding the pilot program on electronic special value-added...
Dezan Shira & Associates helps businesses establish, maintain, and grow their operations.
Stay Ahead of the curve in Emerging Asia. Our subscription service offers regular regulatory updates, including the most recent legal, tax and accounting changes that affect your business.