人事記錄外洩的法律責任.

Under HK Laws. Chap 486 個人資料(私隱)條例 Sec. 65 僱主及主事人的法律責任 (1) 任何人在其受僱用中所作出的任何作為或所從事的任何行為，就本條例而言須視為亦是由其僱主所作出或從事的，不論其僱主是否知悉或批准他作出該作為或從事該行為。
根據 個人資料私隱專員公署 <<人力資源管理實務守則>>, there is no specific prohibition from a staff of your company making photocopies of the data so long he/she can demonstrate he/she needed the information and you've given the agreement for the collection of information.
You should notify your boss as he/she is legally liable for any complaint made by you to the PCPD (個人資料私隱專員公署). If that can't be resolved, then you can make a formal complaint to PCPD to stop such practice.