Privacy regulators across three jurisdictions released significant guidance within a short window last October. The updates cover employer data practices during recruitment, ethical boundaries for artificial intelligence deployments, and the legal requirements for CCTV surveillance in workplaces. For organizations operating internationally, the overlapping timelines signal that enforcement authorities are moving toward stricter interpretation of data protection obligations.
At a Glance
- CNIL published draft advice clarifying employer obligations when handling candidate data during hiring
- Hong Kong's privacy authority released ethical principles for AI systems, with guidance on data minimization
- Korea's regulator clarified that live CCTV streams qualify as personal information under existing law
- Gibraltar updated its data sharing code to reflect post-Brexit regulatory alignment
Breaking Down the Regulatory Actions
France's CNIL focused on recruitment practices, an area where many organizations remain unclear about their obligations. The guidance emphasizes that employers must establish a clear legal basis before collecting candidate information, conduct impact assessments for high-risk processing activities, respond to access requests promptly, and strictly limit how long they retain candidate data. The draft was open for comments until mid-November 2021.
Hong Kong's privacy commissioner took a different angle, targeting the growing use of AI in hiring and workforce management. The guidance requires organizations to apply ethical principles throughout the AI development lifecycle, minimize the personal data fed into training and operational systems, ensure data quality and accuracy, and maintain documentation of all processing activities. This framework aligns with the broader shift toward explainable AI in regulated industries.
Korea's Personal Information Protection Commission addressed a practical question many employers face: does live CCTV streaming count as personal data processing? The answer was yes, whenever subjects remain identifiable. The regulator confirmed that CCTV can serve multiple legitimate purposes—training, auditing, fleet monitoring—but only when organizations meet core obligations around consent or legitimate interest, adequate safeguards, on-site notice, and minimal retention periods.
Why This Matters for Your Organization
The simultaneity of these updates is notable. Regulators in different jurisdictions rarely coordinate announcements, yet all three focused on closing gaps in how organizations collect and process personal data in operational contexts. Recruitment, AI-powered tools, and workplace surveillance represent areas where data collection expanded rapidly without corresponding policy updates.
For organizations with cross-border operations, the combined effect means that compliance approaches developed for one jurisdiction may not transfer cleanly. A recruitment process compliant with CNIL guidance might still violate Korean CCTV requirements if operations expand. The burden falls on organizations to map their data flows against each applicable framework rather than assuming a single policy covers all activities.
Practical Steps to Consider
Before your next hiring campaign or AI deployment, review whether your data collection goes beyond what each jurisdiction considers necessary. Verify that notice is provided at physical locations where surveillance occurs and that retention schedules align with the shortest defensible period under each applicable law.
Key takeaways
- Privacy regulators are scrutinizing high-volume data collection in recruitment, AI systems, and workplace surveillance
- Each jurisdiction requires specific documentation, notice, and retention limits even where activities overlap
- Organizations operating internationally should map compliance obligations per jurisdiction rather than applying a single standard
Frequently asked questions
Do the Hong Kong AI principles apply to AI vendors or only to organizations deploying AI internally?
The guidance applies to organizations that develop or implement AI systems, which can include vendors building AI products for other businesses.
If my company uses CCTV only for physical security and never reviews footage, does the Korean guidance still apply?
Yes, if subjects are identifiable through the live stream or recordings, the processing falls under personal information protection requirements regardless of whether footage is actively reviewed.
How should organizations handle the conflict between different jurisdictions' requirements when collecting the same type of data?
The practical approach is to apply the strictest standard across all operations, documenting the rationale and ensuring that any additional requirements are technically and operationally feasible.