Employment Relationships

Question 1

Article 88 of the general data protection regulation recognizes that member states may provide for more specific rules around processing employees‘ personal data. What are these rules?

Answer 1

These rules must include suitable and specific measures to safeguard the data subject’s human dignity, legitimate interest and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in the joint economic activity and monitoring systems at the workplace.

Question 2

Which grounds do employers usually rely on to process employees personal data?

Answer 2

• The employee has given consent
• processing is necessary to fulfill the employment contract between the employer and employee
• processing is necessary for compliance with a legal obligation to which the employer is subject
• Processing is necessary for the employer’s legitimate interest

Question 3

Are public authorities able to rely on the legitimate interest ground for processing employees data?

Answer 3

No

Question 4

What is an example of the legitimate interest ground to process personal data about employees?

Answer 4

For example, when an employee carries out a structural systems change to migrate employee data from an old payroll system to a new one.

Question 5

Under the general data protection regulation, what does the notification to employees need to provide in terms of the level of detail?

Answer 5

The purpose for the processing, the legal basis, what the legitimate interest are, when that ground is relied upon, the recipients of their data, where the data will be transferred to and for how long the employer will retain their data

Question 6

When is a data protection impact assessment required for monitoring of an individual employee?

Answer 6

A DPIA is required if the monitoring results or amounts to a systematic and extensive evaluation of personal aspects of individuals that is based on automated processing and on which decisions are based that produce legal effects or similarly significantly affect the individuals

Question 7

Which was one of the first DPAs to consider the lawfulness of whistleblowing schemes under EU data protection?

Answer 7

French DPA

Question 8

What aspects do you need to consider for a whistleblowing policy taking into account the guidance provided by the French DPA and the WP 29?

Answer 8

• individuals reporting
• Individuals incriminated
• confidentiality vs anonymity
• scope of reports
• management of reports
• data retention
• information provision
• rights of incriminated person
• security of reports
• transfers outside the EEA