Chapter 3A: Employment relationship

Question 1

What mix makes compliance in the context of employment difficult?

Answer 1

Local employment law and EU data protection law.

Question 2

Under Article 88 of the GDPR, member states may, by law or collective agreements…

Answer 2

Provide more specific rules around processing employees’ personal data.

Question 3

Local employment law varies considerably across the EU; true or false?

Answer 3

True

Question 4

An employer may be obligated to communicate with a trade union or works council. Considerations…

Answer 4

Work councils can have considerable power over the processing of employees’ personal data

Compliance may require notifying, consulting with, and seeking approval from them.

Question 5

Compliant legal bases for processing employee data can include…

Answer 5

Fulfilment of an employee contract

Legal obligation

Legitimate interests

Consent(?)

Question 6

Fulfilment of an employee contract - example for relying on this basis…

Answer 6

Collecting and using bank account information to process salaries

Question 7

Legal obligation - example for relying on this basis…

Answer 7

sharing salary information with tax authorities (this must be an obligation under EU/member state law to count)

Question 8

Legitimate interests - example for relying on this basis…

Answer 8

Migrating employee information from one data management system to another

this cannot be adverse to employees’ rights and freedoms, used as grounds for processing special categories of data or relied upon by public authorities

Question 9

Why is consent problematic as a legal basis for employer <> employee relationships?

Answer 9

It’s difficult to prove due to the imbalance of power between the roles.

Processing of employee data may be unlawful or unfair under local law even if the employee has consented.

However, under some local labour laws, employers are obligated to obtain consent to process employee personal data.

Question 10

Where sensitive personal data on employees is collected and processed, employers must comply with one of the exceptions specified in Article 9 of the GDPR.

Answer 10

To establish, exercise or defend legal claims;

To carrying out obligations and exercise specific rights under employment, social security and social protection law;

Consent is not likely to be legal grounds for processing sensitive employee data.

Question 11

When might “to establish, exercise or defend legal claims” apply as an exception to processing employee special category data?

Answer 11

It may be necessary, such as to defend an employee’s claim of unfair dismissal.

Question 12

Considerations of “carrying out obligations and exercise specific rights under employment, social security and social protection law apply as an exception to processing employee special category data?

Answer 12

Where authorised by the EU or member state law/collective agreement

In a number of jurisdictions, employment and labour laws restrict the extent to which sensitive employee data can be processed

Local data protection authorities may issue authorisations for specific processing activities

Question 13

Local laws may affect retention obligations, requiring an employer to retain employee data - for example…

Answer 13

Records relating to health and safety checks under health and safety laws.

If obligated, these records should be archived and access limited.

Question 14

What would be effective management of a bring your own device (BYOD) programme?

Answer 14

Provide notices to employees explaining consequences of signing up to BYOD and outlining the info the org will be able to access

Must have a lawful basis for processing personal data

Implement a BYOD policy

Know where data processed via the device is stored and measures required to keep secure

Ensure transfer to company’s server is secure

Know how to manage data held on device once the employee leaves the company or the device is lost or stolen

Question 15

What should a BYOD policy include?

Answer 15

Explanation of how they can use their BYOD and responsibilities

Should align with employment law and GDPR

Protects personal data of individuals such as employees, customers

Protects organisational data such as intellectual property

Enables employee productivity

Mitigates network risks

Question 16

What are the legal requirements for employee monitoring?

Answer 16

Member state data protection law and local employee law must be considered

An employees’ rights and freedoms must be balances against rights of employer; alternatives to monitoring should always be considered

Prevention methods should be invoked rather than detection, e.g. blocking websites an employer does not want the employee to visit

Question 17

What types of employee monitoring may be necessary?

Answer 17

Background checks

Data loss prevention (DLP) technology (i.e. tools used to protect IT infrastructure from external or internal threats) or tools that inevitably involve processing personal data

Whistle blowing schemes - U.S. Sarbanes-Oxley Act (2002) - US companies must have system in place to receive anonymous complaints about potential wrong-doing;
there are conflicting obligations between US and EU - US is set up to protect identity of whistleblower, versus protecting the personal data of the accused (EU)

Question 18

To monitor employees lawfully, employers must make sure that monitoring is…

Answer 18

Necessary (demonstrate why)

Legitimate (is it fair? are there lawful grounds?)

Proportionate (is monitoring proportionate to the issue?)

Transparent (have employees been informed of monitoring?)