Staff name list is a kind of data of identifiable persons, and as such is under the protection of the Personal Data Protection Act. If necessary, such names list with photos may be uploaded onto the intranet for access only by those authorized staff. However, adequate security measures must be taken when putting personal data online, and access from the outside must be barred, to prevent personal data leaks. Besides, institutions must obtain prior consent of the persons whose photos are going to be put online.