Increasingly, companies will consider reviewing the social media accounts and other publicly available information of job applicants as part of the hiring process. Despite a common perception that data which is in the public domain can be used freely, using data from job applicant's social media accounts may not be consistent with data protection laws and the manner in which any such information is used may increase the risk of allegations of unlawful discrimination. We consider the key risks and considerations for organisations who do adopt this practice in Hong Kong.

Is social media screening permitted under data privacy and protection laws?

In Hong Kong the protections afforded by data protection laws apply to personal data obtained from the public domain without exception. The Personal Data Protection Ordinance ("PDPO") requires a data subject to consent where their personal data is to be collected and used for a purpose which differs from the original purpose for which their personal data is in the public domain.

The Hong Kong Privacy Commissioner for Personal Data cautions against using publicly available data for "profiling" an individual. This involves combining data from different public sources, the result of which is likely to mean data is used for a purpose beyond the original purpose of the unique components of the data and may result in inaccurate inferences being made against the data subject. There have been a number of reported complaints to the Privacy Commissioner on the use of publicly available data without the data subject's consent. The safest approach is always to obtain the consent of a candidate before collecting any data in relation to them including from publicly available sources such as social media accounts.

Are there unlawful discrimination risks?

Whether this process presents unlawful discrimination risks will depend on how data obtained about a candidate is used. In Hong Kong, it may be unlawful to discriminate against a job applicant based upon a protected attributes such as their gender, disability and race. Data collected from social media sites will often contain details which reveal a candidate's protected attributes. Companies must be therefore be extremely cautious not to treat an applicant less favourably, directly or indirectly, on the ground of any protected attribute. If an individual with a protected attribute is not successful and the role is given to a candidate with similar experience but without the protected attribute, a court or tribunal may infer that the information collected was in some way relied on in making the hiring decision as it would not have otherwise been collected. It may be difficult for companies to disprove that the hiring decision did not take into account a protected attributes gleaned from social media and therefore the decision wasn't discriminatory.

Is it worth it?

Companies should ask why they consider social media screening necessary: what gaps in their formal hiring process are they seeking to fill? Many companies have sophisticated processes which include written applications, interviews, criminal record and bankruptcy checks and verification of a candidates qualifications and experience through references and referees. Generally, organisations take great care that their questions are directly related to the requirements of the role and do not collect irrelevant information about protected attributes. Where the role itself does not require any specific public or social media profile or branding, these processes generally provide more valuable information to an organisation about a candidate's suitability for the role. Using these processes is more transparent and allows a candidate to respond to any concerns the company has regarding their suitability for the role as well as preventing companies from profiling candidates based on a selection of information removed from its original context.

Similar issues will arise in relation to existing employees. Whilst employees are entitled to choose how to spend their time outside of work, their conduct outside work may impact their ability to fulfil the requirements of their role or negatively impact the employer. If so, such conduct may justify disciplinary action including termination of employment. However, expectations around social media use and the consequences of certain behaviours online or outside work should be made clear to employees and any response should be proportionate and justified in the particular circumstances.

Key takeaways

As we can see, organisations will need to walk a fine line if they do undertake social media screening of candidates and employees. Employers and potential employers should, at a minimum, have in place;

1. a Personal Information Collection statement which is provided to job candidates and employees and from which it is clear that the organisation collects data relating to them including from publicly available sources and how such data is used;

2. guidelines for any individuals involved in the hiring process which set out what information can be taken into account in making any decision in relation to hiring as well as records of any hiring decisions which are consistent with these guidelines and which demonstrate that the decision was made based upon clear objective criteria and not any protected attribute; and

3. policies which make clear the organisation's expectations around social media use and online conduct and which ensure that employees understand how their personal views and actions may impact their professional profile and employment.