Companies Requesting Sensitive Personal Information During Hiring
Personal Data Management Is Practically 'In the Dark'
On the 29th, job seekers are attending recruitment interviews at the '2022 Tourism Company Mini Job Fair in Seoul' held at Tmark Grand Hotel Myeongdong in Jung-gu, Seoul. Photo by Hyunmin Kim kimhyun81@
[Asia Economy Intern Reporter Seohee Lee] New employee Yumi Lee (28, pseudonym) recently had a baffling experience. She received a belated contact from a startup she had applied to eight months ago but was rejected during the interview stage. A man who identified himself as an HR manager said, “We regret having rejected you last time, but there is a position suitable for you, so I’m reaching out,” and suggested meeting in person for an interview. Although Ms. Lee, who was already employed at another company, declined the offer, she felt an inexplicable unease.
Job seeker Jihee Choi (25, pseudonym) had a similar experience. Two months ago, after submitting her resume through a job site, she received a personal message from an HR staff member of a small-to-medium enterprise instead of a job acceptance notice. The man asked Choi, “You have a good impression, so I want to get to know you personally. May I keep in touch?” Startled, Choi blocked the number. She said, “It seems the HR staff sent the message after seeing the photo and contact information included in my resume,” adding, “I felt uncomfortable, thinking my personal information had been leaked.”
Cases where sensitive personal information submitted by job seekers during the hiring process is used for purposes other than recruitment continue to occur. Application forms required by companies include many sensitive personal details such as date of birth, contact information, education, and work history, but job seekers have virtually no way to know how companies manage this information. As a result, there are voices claiming that corporate-level personal information management is practically a ‘black box.’
In particular, there are many concerns that startups and small-to-medium enterprises are exposed to blind spots in personal information leakage. Companies with a workforce above a certain size usually have a dedicated department responsible for recruitment, and systems for managing application documents and supporting materials are relatively well established. However, in small-scale companies, recruitment is often handled by operational departments on an ad hoc basis, and there are no separate internal guidelines for managing applicants’ personal information, raising concerns about relatively poor management of job seekers’ personal data.
On the 29th, a job seeker is waiting for a recruitment interview at the '2022 Tourism Company Mini Job Fair in Seoul' held at Tmark Grand Hotel Myeongdong in Jung-gu, Seoul. Photo by Hyunmin Kim kimhyun81@
The current Personal Information Protection Act strictly prohibits the use of personal information for purposes other than the original intent. According to Article 18, Paragraph 1 of the Personal Information Protection Act, if a personal information handler (company) abuses personal information for purposes other than the original intent, they may face imprisonment of up to five years or a fine of up to 50 million KRW. Additionally, companies must typically destroy the recruitment documents submitted by job seekers within five days after the final selection, or within a range of 14 to 180 days if requested. If a company needs to retain and use the personal information of rejected candidates for ongoing talent recruitment, it must obtain separate consent from the individuals concerned.
However, despite these existing laws, job seekers have no effective way to prevent companies from failing to destroy applicants’ information on time or using it for other purposes. This is because job seekers have virtually no means to know how companies manage and process personal information.
A person in charge of HR at an AI-based medical device startup, referred to as Mr. A, said in response to questions about personal information management, “Startups and small-to-medium enterprises inevitably have relatively lax management of submitted documents. First, there is no separate HR department, so there is a shortage of personnel to manage documents, and many responsible staff are not well aware of the current Personal Information Protection Act, such as how long personal information can be retained.”
Experts advise that to prevent ongoing personal information leaks, companies need to firmly establish internal guidelines. Junhyuk Park (37), who provides HR-related consulting to domestic companies, said, “Personal information collected during recruitment must be strictly managed according to current laws, but in practice, many staff are not well informed about this,” adding, “To prevent personal information leaks, companies should establish clear internal policies and systems and expand in-house training so that responsible personnel can fully understand them.”
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
