Personal Data Privacy and the Internet - A Guide for Data Users

E-mails carrying personal data on the Internet

Organisations may give their employees access to the Internet for sending and receiving e-mails. Some of these e-mails may contain personal data. DPP4 requires that all practicable steps should be taken to put in place measures for ensuring the integrity, prudence and competence of persons having control of and access to personal data. Section 65 of the Ordinance (which is set out at the end of this Guide) places liability on the employer for any act of their employees done in the course of employment that may have contravened a requirement of the Ordinance unless the employer can provide evidence to prove that precautionary measures have been taken to prevent the employee from doing that act. Adequate policies and procedures should therefore be put in place and staff should be regularly reminded to observe compliance with the requirements of the Ordinance. Areas in which guidelines are needed may include the following:

=>Set a policy on Internet e-mail communication. Not all personal data communicated via e-mail requires the same degree of security. The appropriate degree of security will depend on the sensitivity and volume of personal data communicated. Hence, a first step is to categorise the various kinds of personal data held by the organisation and the circumstances under which the staff are allowed to transmit these data via Internet e-mail. Organisations should also consider restricting the sending of sensitive personal data except by authorised personnel and to implement procedures ensuring that only authorised recipients have access to and custody of Internet e-mails containing sensitive personal data.

=>Consider the use of technological safeguards. If sending sensitive personal data by e-mails is permitted, a practical means to prevent unauthorised interception or access is to encrypt the data before sending. In situations where encryption is not possible, or incoming Internet e-mails contain un-encrypted sensitive personal data or encrypted e-mails are decrypted and read, care should be taken to ensure that the data are stored in a secure location. For example, an organisation that operates its own web server can automatically route incoming Internet e-mails to a pre-determined server directory or confidential mailboxes that can only be accessed by authorised persons. An organisation that chooses an Internet Service Provider (ISP) for hosting their web pages will have to depend on the ISP for security protection. In such a situation, the organisation should examine the measures an ISP has implemented to protect personal data, for example, the availability of server software or hardware that provides adequate protection, before making a commitment to that ISP.

=>Promote a privacy-aware culture in the workplace. Every employee should be aware of the importance of respecting others' privacy rights both as a moral obligation and as a legal requirement under the Ordinance. All personnel involved with personal data should be fully aware of and adequately trained in privacy protection procedures.