Enquiry Case Notes

編號: 0565/C/2011

標題: Retention of applicant information


    Institution A consulted the GPDP if could, after recruitment, continue to retain the information of failed job applicants, and what is the longest retention period of such information.


    In the absence of detailed case information, the GPDP could only provide general comments based on general personal data processing:
  In accordance with Articles 4(1)(1) and 3(1) of the Personal Data Protection Act, the data processing found in the current case is governed by the Personal Data Protection Act.
  Under Article 5(1)(5) of the same Law, personal data can be kept for no longer than is necessary for the purposes for which they are collected or for which they are further processed.
  An institution, for recruitment purpose, could collect applicants’ information for a period of time. For instance, an institution foresees that in the short future it is likely to select someone suitable from the recent applicants to fill up certain positions, as such keeping the data appropriately accords with the interests of both parties.
  As for the longest retention period, an institution should determine the length of the period based on the purposes of data collection, for example, xx months or years after the recruitment. The GPDP recommends that, in general, it keep applicants’ personal data for no more than two years.

Please refer to "Personal Data Protection Act", articles 3,4,5 .