Background Checks – What Employers Need to Know [ENG/CHI]
By Charles Mo, Partner in Morgan, Lewis & Bockius’s Hong Kong office
  • Employers may seek to conduct background checks on applicants as part of the pre-employment process or conduct updated checks where an employment contract is considered for renewal.

  • Background checks may include checks on education, past employment, criminal records, and social media/internet search. In some cases, the applicant may also be required to satisfy a health check.

While employee background checks are generally allowed in Hong Kong, employers should be aware of the risks related to discrimination and data privacy legislation. Regardless of whether an employer is conducting its own background checks or hiring a third party to do the task, or if the background check is completed before or after an offer of employment has been made, the check should not be conducted in a manner amounting to unlawful discrimination. Information collected and processed must also comply with requirements as set out in the Personal Data (Privacy) Ordinance (the PDPO).


Hong Kong protects several personal attributes from discrimination through the Sex Discrimination Ordinance, Disability Discrimination Ordinance, Family Status Discrimination Ordinance, and Race Discrimination Ordinance. These Ordinances prohibit discrimination on the grounds of sex, pregnancy, breastfeeding, disability, family and marital status, and race. They also prohibit certain forms of harassment and vilification. The Employment Ordinance protects against discrimination on the basis of union membership. Information obtained from background checks on applicants should not be used in a discriminatory manner in an employer’s decision making process.

Data privacy

Personal data is defined as any data that relates directly or indirectly to a living individual, from which it is practicable for the identity of the individual to be directly or indirectly ascertained and is in a form in which access to or processing of the data is practicable. Examples include names, date of birth, addresses, passport/ID number, employment records, and mobile phone numbers.

The Six Data Protection Principles

Collection of information for background checks should comply with the six Data Protection Principles as set out in the PDPO. Broadly speaking, the principles relate to:

DDP 1: Purpose and manner of collection

Data must be collected in a fair, reasonable, and lawful means. Only data necessary for the purposes of assessing an applicant’s suitability should be collected.

DPP 2: Accuracy and duration of retention

Data collected should be, as far as practicably possible, ensured to be accurate for the purpose of collection and retained only for as long as necessary to fulfil the purpose of recruitment.

DPP 3: Use of personal data

Data collected should only be used for the legitimate purpose of assessing an applicant’s suitability. Where a new purpose for the use of the data arises, employers should seek consent from the applicant.

DPP 4: Security over personal data

Data collected should be protected against unauthorised or accidental access, processing, erasure, loss, or use – particularly in instances where a third party is engaged to conduct the background search.

DPP 5: Availability of information 

Data policies should be made available by employers.

DPP 6: Data access and correction 

Applicants should be able to access their data and correct it upon review if it is inaccurate.

Personal Information Collection Statement 

Prior to the collection of any personal data, an employer should provide an applicant with a Personal Information Collection Statement (PICS). The PICS should include, inter alia, information on the purpose of collecting the relevant data, the length of retention, whether the provision of the requested data is voluntary or obligatory, and the classes of persons who may receive the data. Employers should ensure that the purpose of collection stated in the Statement is not too broad in scope.

Social media or internet searches on the applicant 

Although background checks by way of social media or internet searches are legally permissible, given that information on public domains are typically not made publicly available by individuals for the purpose of background checks, it would be prudent of employers to inform the applicant and/or seek his/her consent before collecting such data, and the data collected should be processed/stored in accordance with the PDPO. Employers should also be cautious against unlawful discrimination arising from information gathered from social media or internet searches.

Medical or health checks 

Information collected about an applicant’s health should only be collected where (1) the data relates directly to the job’s inherent requirements, (2) where the employment is conditional upon the fulfilment of the medical examination, and (3) the means of data collection are fair in relation to the purpose. Any information arising from the health check must not be used in a discriminatory manner.

Reference letters 

An employer may obtain references from a potential candidate’s current or former employers in the recruitment process to assess the candidate’s suitability, but the employer should seek prior consent from the candidate before approaching the persons designated by him/her for a reference. As a practical tip, when establishing contact with the candidate’s current or former employers, the employers may inform the contact that consent has been given by the candidate.

Criminal background checks 

Can an applicant be compelled to disclose any criminal history? With the exception of employers in industries with frequent contact with children or mentally incapacitated persons, an applicant cannot be compelled to disclose convictions. This may pose a problem for employers as such information is not readily available from the police or the judicial system in Hong Kong. The Hong Kong Police Force normally does not issue any Certificates of No Criminal Conviction for the purpose of employment background check.

Where applicants choose to comply with a disclosure request, the Rehabilitation of Offenders Ordinance enables them to treat certain convictions as ‘spent’, subject to certain exceptions. Convictions are deemed to be spent where:

  • The conviction did not result in a sentence of imprisonment exceeding three months or a fine exceeding HK$10,000; and

  • The individual has not previously been convicted in Hong Kong of any offence; and

  • Three years has lapsed without another conviction for an offence in Hong Kong.

The spent conviction and its non-disclosure cannot be used by the employer as grounds for dismissal, exclusion from employment, or prejudice.

Sexual conviction record check 

Where the relevant field of work involves frequent contact with children or mentally incapacitated persons, employers may require applicants to undergo a Sexual Conviction Record Check (SCRC) through the Hong Kong Police Force. Employers will be able to verify whether the applicant has criminal conviction records against a specified list of sexual offences (e.g., rape, indecent assault, or offences relating to child pornography). An employer who demands an applicant to apply for the SCRC in the absence of frequent work relating to children or mentally incapacitated persons, may be liable for breach of the PDPO. Furthermore, the records obtained by the employer – whether the results involve a conviction record or not – must not be used for any purpose outside of the recruitment process, or transferred to classes of persons not set out in the relevant PICS.

Unlawfully conducted background checks 

Breaches of Data Protection Principles under the PDPO are not immediately subject to punishment. The Privacy Commissioner for Personal Data may issue an enforcement notice upon completion of its investigation, to require the employer to take steps to remedy the relevant breach. An employer who contravenes the enforcement notice commits an offence. On first conviction, the employer will be liable to a maximum fine of HK$50,000 (with a HK$1,000 daily penalty for a continuing offence) and 2 years of imprisonment. Subsequent convictions face a maximum penalty of HK$100,000 (with HK$2,000 daily penalty for a continuing offence) and 2 years of imprisonment. An employer may have a defence where it can show that it exercised all due diligence to comply with the enforcement notice.

Discriminatory breaches

The Equal Opportunities Commission may conduct a formal investigation into complaints made by an applicant on discriminatory grounds. The Commission may serve an enforcement notice on the employer requiring changes to be made to its practice. Further legal action may be taken by the Commission where the enforcement notice is not complied with. 

In conclusion, every hire offers a new opportunity for the organisation while presenting a potential business risk. Conducting a thorough background check to obtain the correct information about a candidate before hiring, ensures the organisation chooses suitable candidates and safeguards its reputation.


背景審查 – 僱主應知事項

  • 僱主在招聘過程中,可能對應徵者進行背景審查,又或者在考慮與某員工續簽僱傭合約時,再次對該員工進行審查,以更新資料。

  • 背景審查可能包括應徵者的學歷、受聘記錄、犯罪記錄,以及在社交媒體或互聯網搜尋得到的資料。在某些情況下,僱主可能要求應徵者通過健康檢查。








原則1: 收集目的及方式


原則2 :準確性及保留期限


原則3: 個人資料的使用


原則4 :個人資料的保安


原則5 :收集資料途徑


原則6 :查閲及改正







僱主只可在以下情況收集有關應徵者健康狀況的資料:(1) 該等資料與工作本身的要求存在直接關係、(2) 通過體檢為聘用條件之一,以及 (3) 收集資料的方法和目的應是公平的。僱主不應對健康檢查所得的任何資料存有歧視或偏見。






  • 因曾在香港被定罪,但並未因此被判處監禁超過三個月或罰款超過10,000元;以及

  • 在此以前該人不曾在香港被定罪,以及

  • 此後經過三年時間該人並未在香港再被定罪。




若應徵者不需要經常與兒童或精神上無行為能力的人接觸而被僱主要求申請 「性罪行定罪紀錄查核」,則該僱主可能違反《私隱條例》。此外,無論僱主所取得的記錄是否屬於定罪個案,也不得用作招聘以外的目的,或轉發給未列於「收集個人資料聲明」 中的人員類別。


違反《私隱條例》所訂明的「保障資料原則」不會立即受到懲處。「個人資料私隱專員公署」或會在調查完成後發出強制執行通知,要求僱主採取措施糾正相關違規行為。僱主違反執行通知即屬犯罪。首次定罪,僱主最高可被判罰款港幣 50,000 元(持續違規每日罰款港幣 1,000 元)及監禁兩年。其後再次定罪,最高可被判罰款港幣 100,000 元(持續違規每日罰款港幣 2,000 元)及監禁兩年。僱主可以提出抗辯,證明已盡一切努力遵守執行通知。




Background Checks – What Employers Need to Know [ENG/CHI]
PR 22 April, 2022