Employee Data Privacy

Do individuals have the right to access their personal information?

Data protective jurisdictions tend to guarantee the right of individuals to contact an organization directly and find out whether personal data is being tracked. Access procedures and acceptable exceptions (such as business secrecy) are determined by law and may be subject to the control of data protection authorities. In the context of HR, personal data access requests can include information tracked by the company as well as data tracked by third-party solutions, such as background check vendors.

The Implementing Rules and Regulations of the Data Privacy Act of 2012 outlines how data subjects can access personal data that is being collected and processed (Rule VIII. Rights of Data Subjects, Sec. 34).

Employees should be informed in advance (or, at the next reasonable opportunity) when personal data is collected. Notice should include:

• the content of the personal data that will be collected;
• the reasons the data is being processed;
• the allowable basis of processing (if not based on consent);
• how the data will be processed (scope and method);
• the possible data recipients (or classes of recipients);
• details and potential significance of any automated processing decisions (for example, using a system to automatically weed-out candidates based on their level of education);
• the contact information of the Personal Information Controller (i.e. the employer) or representatives;
• how long the data will be stored; and,
• their rights as data subjects (rights to access, correction, objection and right to lodge a complaint to the National Privacy Commission).

Data subjects should also be notified and given an opportunity to withhold consent in case where there are changes or any amendments to the information supplied or declared to the employee.
 

While data subjects have the right to object to their personal information being collected, this right is limited in the context of employment. An individual’s personal data can continue to be processed for “obvious purposes,” such as when it’s necessary “in relation to a contract or service to which the data subject is a party, or when necessary or desirable in the context of an employer-employee relationship.”

Individuals also have the right to dispute the accuracy of their data and have it corrected unless the request is unreasonable. They can also request that data be deleted in certain circumstances, such as when:

• the data is incorrect, incomplete, illegally obtained or illegally processed;
• the data is being used for a purpose not authorized by the employee;
• personal information is no longer necessary for the original purpose(s) the information was collected; and,
• the individual withdraws consent and there is no other legal ground or overriding interest by the employer.

Generally, data subjects in the Philippines have the right to reasonably request and access:

• the content of their personal information;
• how their personal information was obtained;
• the names and addresses of the data recipients;
• information relating to how the data was processed;
• the reasons the data was shared with data recipients;
• information relating to automated processes that are used to make decisions that may significantly impact the data subject;
• date the individual’s personal data was last accessed/modified; and,
• information relating to the personal information controller (designation, name or identity and address). 

  

 

---

Led by PeopleDoc’s Chief Legal & Compliance Officer, the HR Compliance Assist team relies on a network of internal and external compliance experts and lawyers, including the global law firm Morgan Lewis, to provide clients with best practices and recommendations on topics such as HR document retention, employee data privacy, and HR electronic records. HR Compliance Assist also provides local compliance monitoring and alert services in select countries where PeopleDoc’s customers have employees. HR Compliance Assist is a service exclusively available to PeopleDoc customers.