JobsDB's 'Quick Apply' feature for Private Advertisers leads to unfair collection of personal data
Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) has issued an enforcement notice against JobsDB for publishing "blind ads" on its platform.
Blind ads refer to a job posting that does not identify the recruiting organisation, such as the employer or recruitment agency, and does not have sufficient information to identify the organisation.
These job postings also do not provide avenues for job applicants to inquire or ask for sufficient information to identify the recruiting firm.
Instead, these ads directly invite job applicants to submit their personal data, such as their Hong Kong ID Card numbers, contact details, or resumes.
Ada Chung Lai-Ling, Hong Kong's privacy commissioner, found that JobsDB's publication of blind ads from eight recruiting firms constituted contraventions of the Data Protection Principle (DPP) and the Personal Data (Privacy) Ordinance (PDPO).
"The Privacy Commissioner has therefore served enforcement notices on JobsDB and three recruiting organisations, directing them to take measures to remedy the contraventions and prevent recurrence of similar contraventions in future, and issued an advisory letter to each of the remaining five organisations," the PCPD said in a statement.
According to the PCPD, JobsDB and the eight recruiting firms are "data users" that should be compliant with the PDPO and the DPP because they are able to collect job applicants' data.
In JobsDB's case, the PCPD's investigation revealed that its "Private Advertiser" feature for employers can lead to unfair collection of jobseekers' personal data when paired with their "Quick Apply" function, which enables jobseekers to apply for advertised jobs, with their information to be stored in the platform's management system.
"In the circumstances, JobsDB controls the collection, holding, processing (which includes deletion), and use of the applicants' personal data," the PCPD said. "In this regard, JobsDB is a 'data user' under the PDPO and must comply with the relevant requirements under the PDPO and the DPPs."
In a statement, JobsDB said it recognises the PCPD's concerns on how personal data is connected and used in ads posted by Private Advertisers.
"We accept the PCPD's findings and are committed to continuing close collaboration with the PCPD in the future to improve our processes to ensure the privacy and security of our candidates' and hirers' data," JobsDB said.
Among the measures that the platform took include pausing the posting of Private Advertiser job ads on JobsDB.
"All employers are required to disclose their company's name along with verified contact information in their advertisements for the benefit of applicants," it said.
It announced that it will bring back Private Advertisers' abilities to post job ads on December 12, but without the "Quick Apply" feature.
"We will remove the 'Quick Apply' feature for these ads to prevent employers from directly accessing applicants' personal information without revealing their identity," JobsDB said.
The platform added that it introduced a multi-factor authentication for hirers in the past year, as well as carried out detailed checks and procedures to ensure that job ads are genuine.
"JobsDB is committed to being transparent about how we collect, use, and manage personal data and ensuring compliance with all relevant privacy laws," it said. "We regret any inconvenience or impact this situation may have caused and will continue to prioritise our customers' data privacy and trust as we move forward with these changes."
Meanwhile, the PCPD urged other operators of online recruitment platforms to:
"The PCPD reiterated that blind ads may be used as an unscrupulous means to collect personal data and may be misused by swindlers to collect personal data for fraudulent activities," it said.
