Privacy & Information Security Law Blog

The Article 29 Working Party (“Working Party”) recently issued its Opinion on data processing at work (the “Opinion”). The Opinion, which complements the Working Party’s previous Opinion 08/2001 on the processing of personal data in the employment context and Working document on the surveillance of electronic communications in the workplace, seeks to provide guidance on balancing employee privacy expectations in the workplace with employers’ legitimate interests in processing employee data. The Opinion is applicable to all types of employees and not just those under an employment contract (e.g., freelancers).

The Working Party notes that the availability and rapid adoption of new workplace technologies, the lower costs of implementing such technologies and new forms of data processing have contributed to increased, systematic and potentially invasive employee data processing. In light of such developments, the Working Party emphasizes the importance of taking into account the fundamental data protection principles of the EU Data Protection Directive when processing data in the employment context.

The Working Party states that the Opinion also looks toward the additional obligations placed on employers by the upcoming EU General Data Protection Regulation (“GDPR”). The Opinion considers data protection by design, data protection impact assessments and Article 88 with respect to processing employee data.

The Opinion highlights the risks of unfettered monitoring technologies used to process employee personal data, including: chilling effects on confidential communications between employees, incompatible further processing of employee data, unjustifiable and intrusive employee surveillance, and obstructing an employee’s ability to report colleagues’ and superiors’ illegal actions.

The Opinion identifies nine different data processing at work scenarios where new technologies have, or may have, the potential to result in high risks to employees’ privacy. These include processing operations (1) during the recruitment process, (2) resulting from in-employment screening, (3) resulting from monitoring ICT usage at the workplace, (4) resulting from monitoring ICT usage outside the workplace, (5) relating to time and attendance, (6) using video monitoring systems, (7) involving vehicles used by employees, (8) involving disclosure of employee data to third parties, and (9) involving international transfers of HR and other employee data.

Key takeaways from the Opinion include:

• For the majority of data processing at work, consent cannot form a valid legal basis because of the imbalance of power between employers and employees. Valid grounds may include: processing necessary for the performance of the employment contract (e.g., to pay the employee) or processing data in connection with obligations imposed by employment law (e.g., processing for tax calculation and salary administration).
• To rely on the legitimate interest ground to process employee data, the processing must be strictly necessary for a legitimate purpose and must be proportionate to the business need. A proportionality test should be carried out prior to the deployment of any monitoring tool to consider whether all data are necessary, whether the processing outweighs the general privacy rights that employees have in the workplace, and whether appropriate measures have been put in place to ensure a balance with the rights and freedoms of employees.
• In the context of recruiting, employers are allowed to collect job applicants’ personal data only to the extent that such collection is necessary and relevant to the performance of the job. Employers also must be able to justify a legitimate interest to inspect applicants’ social media profiles, taking into account whether it is related to business or private purposes.
• Employees must be informed of the existence of any monitoring and the purposes for the monitoring. Policies relating to workplace monitoring must be clear and readily accessible.
• Data processing at work must be a proportionate response to the risks faced by an employer. For example, if it is possible to block websites, instead of continuously monitoring all communications, blocking should be chosen.
• With regard to Bring Your Own Device (“BYOD”) policies, employers should implement measures to prevent extensive device monitoring, as processing in this context may be unlawful if it captures data relating to the employee’s private and family life.
• Health data processed by wearable devices should be accessible only to the employee and not the employer. The reason for this is that data in this context is unlikely to be truly anonymous and employees are not able to provide “free” consent to an employer.
• Employers should refrain from the use of facial recognition technologies in the context of video analytics at the workplace, as this may be deemed disproportionate.
• The employer should inform employees about the use of vehicle telematics, collecting data both about the vehicle and the employee using the vehicle (e.g., GPS tracking, driving behavior), and offer an opt-out (e.g., ability to temporarily turn off location) when the private use of a professional vehicle is allowed. In addition, event data recorders used to prevent accidents should not result in the continuous monitoring of the employee driver.
• Employers must take the principle of data minimization into account when deciding on the deployment of new technologies. Information should be stored for the minimum amount of time necessary and deleted when no longer needed, and the employer should have a specified retention period.
• Use of most cloud applications will result in the international transfer of employee data. Any transfers to third countries may take place only where an adequate level of protection is ensured, and data shared outside the EEA and accessed by other entities within the organization must remain limited to the minimum necessary for the intended purposes.