THE CHINESE UNIVERSITY OF HONG KONG



General Security Guidelines in Handling Employment-related Data

1. Security in handling employment-related data is the personal responsibility of every staff member. It is essential that confidentiality is fully observed in handling all employment-related matters so that official information and personal data may be passed from one Department/Unit or person to another with confidence that all such information will receive the proper degree of protection wherever it may be handled.

2. The “Need to Know” principle should be applied in handling of all personnel-related business. The circulation of confidential information and personal data including personal files should be no wider than is required for the efficient performance of duties and restricted to those who are authorised to have access i.e. persons who are responsible for handling or processing such data.

3. Security classification should be used for documents of a confidential nature which require certain degree of security. To decide which classification to apply, staff members should consider carefully how much damage unauthorised disclosure of the material or its source may cause.

4. Staff members must not make private copies of or communicate to unauthorised persons or discuss in public areas any confidential information and personal data obtained in their official capacity.

5. Confidential documents and personal files must be kept either in a locked filing cabinet or in an office which is locked up after office hours and to which members of the public do not have access. The filing rooms should be checked at the end of the working day to ensure that all personal files and classified documents, including waste papers, have been appropriately secured and the containers have been properly locked.

6. Personal files and classified documents in use or taken to official meetings must never be left unattended. When being carried to another office or building, they should be enveloped or filed to prevent them being seen by unauthorised persons.

7. Classified documents for transmission other than by hand of an authorised staff member must be sealed in envelope and opened by the addressee or the authorised person only.

8. Persons entering an office where classified documents are being dealt with will not be allowed sight of such documents unless they are entitled to see them and have a definite “Need to Know”. Particular care should be taken when visitors and others who may regularly enter an office but are normally unauthorized to see such documents such as office assistants, cleaners, etc. enter the room. Arrangements should also be made to ensure that these people and others do not overhear classified speech.

9. Confidential documents no longer required and the materials used in the production of such documents should be disposed of in a proper way.

10. Extra care should be exercised in handling telephone enquiries which may involve disclosure of personal data or confidential information. Normally, only written requests or enquiries made by authorized persons with justifiable reason(s) may be entertained.

****************************

................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download