Use of Personal Data for Employment Purposes

To collect, use and disclose personal data about a job applicant for the purposes of assessing his application for employment, which is the correct ground that the agency should rely on first?

• Public Sector Governance Act (PSGA): To uphold and promote the values of the Singapore public sector

• Employment exclusion clause (i.e. for the purpose of entering into, managing or terminating an employment relationship) : list of use cases in the revised IM2R established for this

• Consent given in the declaration of the Public Service Application Form (PSAF)

Answer explanation

If the job applicant has submitted his application via the PSAF, the collection, use, and disclosure of personal data for assessing his application are already covered under the declaration in PSAF.

Zac has submitted a job application through the PSAF for the position of a Senior Executive (OFN) with RP. Select the correct set of use cases that RP can use or share his personal data for. [You can select multiple answers]

• Sharing Zac’s psychometric test completed with RP, his CV, and pre-employment medical check with the senior management of RP

• Sharing Zac’s psychometric test completed with RP, security screening results, and RP’s evaluation of Zac with MOE which may be interested in hiring him

• Using Zac’s psychometric test results, contacting his previous agency for reference check, conducting verification checks of his professional qualification

Answer explanation

• Zac has given his consent to collect, use and disclose his personal data for assessing his suitability for the position in the RP's OFN and for any application for employment with other Government agencies

• However, this does not apply to data that the agency subsequently formed of him. RP should not influence MOE based on their own opinions formed of Zac. 

Is the agency required to seek consent from and notify the job applicant before using or sharing his personal data for the use cases above?

• Yes

• No

Answer explanation

The use cases above are already covered under the declaration in PSAF which the job applicant has given his consent for.

A job applicant applies for the post of a project manager. Her responsibilities are to:

•        take the lead in planning and implementing IT projects,

•        liaise with the various stakeholders on projects.

Which of the following should not be asked during the interview? [You can select multiple answers]

• Can you describe how you handled your past IT projects and what was your role in it?

• Are you planning to have children soon?

• Are you married?

• How did you contribute to the outcomes of the projects and what could you have done better?

Which principle governing the collection, use and disclosure of personal data should be applied here?

• Purpose

• Data Minimisation

Answer explanation

• The agency should only be asking the relevant questions to assess his suitability for the job during the interview.

• Marital status and family plans are not relevant.

An agency wants to implement an internal structured job rotation for the middle management. This involves identifying eligible officers and informing them of the details of the programme. Which principle should the agency apply to find out whether they need to seek consent and notify the officers before using their personal data?

• Purpose: Define the purpose of data use

• Basis: Establish the ground for data use

• Data minimisation: Identify what are the necessary data required for the purpose

Answer explanation

• This purpose falls under the list of use cases in the revised IM2R: Career development. The list of use cases are established to guide whether it is for the purpose of entering into, managing or terminating an employment relationship.

• As such, there is no need to seek consent from the employee, but it is required to notify him. Notification can be effected through IM2R which public officers are expected to read.

What is the main ground that public agencies should rely on for the collection, use and disclosure of the personal data of employees?

• Contract signed between the agency and the employee

• Employment exclusion clause (i.e. for the purpose of entering into, managing or terminating an employment relationship)

• PDPA

Answer explanation

• The IM on ICT & SS Management governs how the Government manages and protects personal data in its possession or control, while PDPA governs the collection, use and disclosure of personal data by private organisations.

• The employment exclusion clause in the IM on ICT & SS Management should be the main ground to justify the collection, use or management of personal data for employment purposes within the Government.

Which of the following option should the agency explore if it needs to use the personal data of an employee for a use case that does not fall under the list of use cases in the revised IM2R established under the employment exclusion clause (i.e. for the purpose of entering into, managing or terminating an employment relationship)? [You can select multiple answers]

• Inform PSD if the agency’s preliminary assessment is that the new use case should fall under the employment exclusion clause so that PSD can assess if it is indeed for an employment purpose.

• Assess if the use of personal data is authorised by any law.

• Seek explicit consent from and notify the employee of the purpose.

• Determine if the new use case falls under other exclusion clauses.

Answer explanation

• All of the above can be used to determine the ground for the use of the personal data, in addition to the following grounds:

o Within the 7 purposes in Section 4 of the PSGA

o Authorised by any law or required by order of court

o Necessary in the public interest

• However, the agency should adopt (a) first. If the agency is confident that the new case or PSD assesses that it does not fall under the employment exclusion clause, the agency can then use the other grounds to assess.

Andy from SHL suffered a workplace injury. RP needs to use and disclose his personal data to the relevant parties for the reporting of the incident and to assist him in receiving the work injury compensation. Identify the correct ground that RP can rely on to use and disclose personal data of Andy.

• Public interest: Provide direct assistance to specific individuals or classes of individuals

• Employment exclusion clause : Revised IM2R use case: Managing health and safety

• Exclusion clause: The collection, use or disclosure (as the case may be) of personal data about an individual is necessary to respond to an emergency that threatens the life, health or safety of the individual or another individual.

Answer explanation

For the use of personal data for employment purposes, the employment exclusion clause should be the main policy to rely on. Unless the use case does not fall under this, agencies should then assess if it falls under other grounds.

What should the agency do before using Andy's personal data?

• Seek consent from and notify Andy

• No need to seek consent from, but required to notify Andy

• No need to seek consent from nor notify Andy

Answer explanation

Under the employment exclusion clause: no need consent, but needs notification.

The latter can be effected through IM2R which officers are expected to read.