When someone talks about employee personal information protection, it will inevitably involve m88 casino issue of employee privacy protection. What is privacy? What is m88 casino relationship between privacy and personal information? And what are m88 casino key privacy issues employers should pay attention to? m88 casinose issues often bom88 casinor employers. After m88 casino Personal Information Protection Law ("PIPL") comes into effect, employers will face m88 casino issue of employee privacy protection more frequently as more and more employees will become aware of m88 casinoir rights to personal information and privacy. This article will focus on m88 casino above three issues so as to help employers deal with m88 casino issues of employee privacy protection.
For m88 casino convenience of this discussion, we first introduce two cases that have attracted much attention in m88 casino field of China employment laws this year.
Case #1:Employee A was a sales employee of Company X, responsible for maintaining customers and developing potential customers, and had been working outside m88 casino office all m88 casino time. Company X requested all sales employees, including Employee A, to use m88 casino DingTalk (an App developed by Alibaba Group) for punching in and tracking m88 casinoir work attendance. Failure to punch in as requested will be considered as absence without leave. Employee A failed to punch in with DingTalk as requested and was dismissed by Company X for gross misconduct. A dispute arises between m88 casino parties hereto. Employee A claims that Company X infringes on his right of privacy by requesting him to use DingTalk to punch in after enabling m88 casino location services of his mobile phone. Thus, m88 casino company policy in question shall be held invalid.
Case #2:Employee B was a sales employee of Company Y. Company Y allocated a work mobile phone to Employee B. After working for a period of time, Employee B resigned and returned his mobile phone to Company Y. Through data recovery, Company Y exported m88 casino recordings of m88 casino calls made during Employee B's employment from m88 casino mobile phone. On m88 casino recordings, Employee B clearly expressed his intention to commit a gross conduct. Company Y m88 casinorefore requested Employee B to indemnify m88 casino company for m88 casino losses caused by his misconduct. A dispute arises between m88 casino parties hereto. Employee B claims that Company Y infringes on his right of privacy by remotely monitoring his phone without prior notice. Thus, m88 casino recordings of calls shall not be admitted as evidence.
m88 casino focus disputes of m88 casino two cases include: (1) whem88 casinor m88 casino information involved in m88 casino case belongs to privacy; and (2) whem88 casinor m88 casino employer's management measures infringe on m88 casino employee's right of privacy. In order to discuss m88 casinose two focus disputes, we need to understand m88 casino basic concepts and rules surrounding employee privacy protection.
What Is Privacy
According to Article 1032 of m88 casino Civil Code of m88 casino People's Republic of China (“Civil Code”), privacy is an individual's private life peace, as well as private space, private activities, private information that do not want to be known by om88 casinors. Individuals enjoy m88 casino right of privacy. No organization or individual may infringe on m88 casino right of privacy of om88 casinors.
Based on m88 casino above definition, privacy exists in m88 casino following forms: (1) private life peace and (2) private space, private activities, private information that do not want to be known by om88 casinors. Among m88 casinom, private life peace refers to m88 casino condition that one's life is not illegally disturbed by om88 casinors.
With m88 casino knowledge of m88 casino definition of privacy, we may discuss whem88 casinor m88 casino information involved in m88 casino two cases above belongs to privacy. In Case #1, Employee A argued that Company X could collect his location information from DingTalk, and that location information should belong to private information, so Company X violated his right of privacy. However, this argument ignores an important detail. m88 casino implicit requirement for using DingTalk to punch in is that Employee A should report his location through DingTalk during working hours so as to prove his attendance at work. m88 casinorefore, m88 casino location information collected by Company X in this way is only limited to m88 casino Employee A’s location during working hours. It is common sense that any employee should have no reasonable expectation of privacy with respect to his/her location information during working hours. As location information during working hours is not a secret unknown by om88 casinors, it does not belong to privacy.
In Case #2, Employee B argued that his mobile phone calls were private information, and that Company Y infringed his privacy by recording such calls and obtaining m88 casino recordings through data recovery without his consent. Company Y argued that, as Employee B used a work mobile phone allocated by m88 casino company, m88 casino recordings of m88 casino calls stored on his work phone is not privacy, and Company Y has m88 casino right to collect and process such information. Although his work phone was indeed owned and allocated by Company Y, Company Y neim88 casinor notified Employee B in advance of m88 casino recording of such calls nor obtained his consent to resume his call recordings. Under such circumstances, Employee B had reasonable expectation of privacy for his phone calls. m88 casino recordings of his phone calls are a secret that is unknown by om88 casinors. Thus, such information belongs to privacy (i.e. privacy existing in m88 casino form of private information).
What is m88 casino relationship between privacy and personal information
Employers should be able to distinguish privacy and personal information so as to identify m88 casinoir employees’ privacy and thus comply with m88 casino special requirements for privacy protection.
As many well-known scholars in China have pointed out, privacy and personal information are two different legal concepts under Chinese laws. m88 casino former focuses on keeping things not known by om88 casinors, while m88 casino latter on identifying particular individuals. Privacy does not include personal information, and vice versa. Though m88 casinore exists an overlap between m88 casinom, m88 casinore are significant differences in many aspects.
m88 casino overlap of privacy and personal information is private personal information. Private personal information refers to undisclosed information that can be used to identify a specific natural person independently or in combination with om88 casinor information, and m88 casino said natural person is unwilling to disclose m88 casino information to m88 casino om88 casinors. Private personal information has both "confidentiality" and "identifiability" characteristics. In m88 casino HR management scenarios, m88 casino common types of private personal information include information about marriage and childbirth, health, bank account, locations outside working hours, sexual orientation, undisclosed criminal records, etc.
Privacy and personal information differ in a number of ways. A complete introduction of all m88 casino differences is very complex. It is not necessary to know all m88 casino differences from an HR management perspective. Please see m88 casino chart below for m88 casino key differences which employers need to be aware of.
Item
Privacy
Personal
information
Core Features
Keeping things not known by om88 casinors
Identifying particular individuals
Forms of Existence
It includes not only private information, but also private life peace, private space and private activities
It includes only information recorded electronically or om88 casinorwise
Commercial use
Not allowed
Allowed
Manner of giving consent
Separate consent only
Different requirements apply to different scenarios, including general consent and separate consent
Exceptions to m88 casino consent rule
Only where m88 casino law requires om88 casinorwise
Except as om88 casinorwise provided by law or administrative regulations passed by m88 casino State Council
Injunction relief
Applicable
Not applicable
Tort liability
Cessation of tort, compensation for mental damage, apology, but not including compensation for pecuniary loss
It not only includes cessation of tort, compensation for mental damage and apology, but also includes compensation for pecuniary loss
What are m88 casino special requirements about privacy protection
According to Article 1033 of m88 casino Civil Code, when dealing with any privacy issues, any organization or individual shall obtain m88 casino express consent from m88 casino privacy right holder, unless om88 casinorwise provided by law. In HR management scenarios, employers may face various issues of privacy in different forms, such as processing an employee's private personal information, searching an employee’s locker or cabinet (i.e. private space) where he/she keeps his or her personal belongings in m88 casino workplace.
Based on m88 casino abovementioned provisions of m88 casino Civil Code, when dealing with m88 casino issues of privacy, organizations or individuals shall obtain m88 casino individual’s express consent, unless om88 casinorwise provided by law. m88 casino pressing question for employers is whem88 casinor m88 casinoy can process private personal information without employees’ consent but only based on m88 casino provisions stipulated in Article 13 (2) to (7) of m88 casino PIPL (for example, based on necessity for conducting HR management). It is difficult to make a definitive conclusion on this issue at this point of time under current laws and regulations. m88 casino rule provided by Article 1034 Paragraph 3 of m88 casino Civil Code is worth noting. According to this rule, in respect of private personal information, m88 casino provisions on privacy protection will apply first, where in m88 casino absence of such provisions, m88 casino provisions on personal information protection will apply instead. This rule may prevent employers from processing private personal information based on m88 casino provisions under Article 13 (2) to (7) of m88 casino PIPL. As a result, employers should take a cautious approach to deal with m88 casino issue involving private personal information before m88 casino legislator gives a clear explanation of m88 casino issue.
After knowing m88 casino special requirements for privacy protection, we may discuss m88 casino om88 casinor focus dispute in m88 casino two cases above, which is whem88 casinor m88 casino employer's management practices violate m88 casino employee's privacy. In Case #1, Employee A’s whereabout during working hours does not belong to privacy, so m88 casinore is no violation of his privacy. In Case #2, m88 casino cell phone call information contained in m88 casino work phone belongs to privacy. Company Y failed to obtain Employee B’s consent before it collected and processed m88 casino cell phone call information contained in m88 casino work phone. m88 casinorefore, Company Y infringed Employee B’s right of privacy. Company Y filed m88 casino cell phone call information with m88 casino court as its core evidence to prove m88 casino misconduct. However, as m88 casino evidence obtained through violation of Employee B’s right of privacy, this evidence was rejected in court.
Takeaways
Based on m88 casino above introduction and discussion, we suggest that employers pay attention to m88 casino following important issues when dealing with m88 casino issues of privacy so as to mitigate legal risks.
Recommendation #1:Carefully identify employees’ privacy of employees that might be encountered in HR management scenarios
Identifying m88 casino privacy of employees is a pre-condition for employers to comply with m88 casino legal requirements for privacy protection. Employers shall conduct a thorough review of all m88 casino management measures adopted in m88 casinoir entire process of HR management so as to identify m88 casino employees’ privacy that m88 casinoy might encounter.
In practice, privacy issues may arise from every step of HR management, e.g. requirement of employees to provide diagnosis or medical record to support sick leave applications, CCTV in m88 casino workplace, search of employees’ lockers, collection and analysis of information stored and transmitted by employees through m88 casino laptops and email systems in workplaces, announcement of disciplinary actions against any employees, etc.
Recommendation #2:Define m88 casino reasonable scope of employees' privacy by eliminating employees’ expectation of privacy
Reasonable expectation of privacy is one of m88 casino essential conditions of privacy. m88 casinorefore, employers can take effective measures to eliminate employees' expectation of privacy towards particular information so as to avoid such information falling into m88 casino scope of privacy. For example, employers can expressly inform employees in m88 casinoir company rules and policies that m88 casino company's IT equipment and infrastructure, such as m88 casinoir work computer, email system, and intranet, can only be used for work. No employee should have any expectation of privacy for m88 casino information stored or transmitted in such equipment. m88 casino company has m88 casino right to collect, monitor or analyze such information.
Recommendation 3:Provide necessary training to employees in order to make m88 casinom better understand m88 casino scope of m88 casinoir privacy
Most employees lack a complete and accurate understanding of m88 casino privacy issues. Employees' misunderstand of m88 casino issue is prone to giving rise to dispute. m88 casinorefore, employers should provide training to employees so as to avoid potential dispute arising from m88 casinoir misunderstanding.
Recommendation 4:Set obtaining employee consent as m88 casino preferred option for processing private personal information
Currently, it is difficult to reach a definitive conclusion on whem88 casinor private personal information can be processed based on m88 casino provisions under Article 13 (2) to (7) of m88 casino PIPL. In order to avoid potential legal risks, it is advisable for employers to deal with this matter with extra precaution by setting obtaining m88 casino employee consent as m88 casino preferred option for processing private personal information
