The European Data Protection Authorities, organized in the Article 29 Working Group, have issued an opinion on data processing at work (the "Opinion"). This opinion provides new guidelines for establishing a balance between the legitimate interests of the employer on the one hand, and the protection of the employee's privacy on the other hand.
The Opinion describes several new technologies that are being used at work to a greater extent. In addition, it also includes the use of wearables and the use of personal data from the social media accounts of (future) employees. With the help of examples, for every technology, the Opinion describes how employers can make use of these technologies in a privacy-friendly way. The fact that an employer possesses electronic devices does not rule out employees’ rights to confidentiality of their communication, location data and correspondence.
Furthermore, the Opinion once again emphasizes that employees are hardly ever in a position to freely give their consent, given the dependency that results from the employer/employee relationship. Except for extraordinary situations, employers will have to rely on a legal ground other than consent in order to legally process the personal date of employees. This rule covers all situations where there is an employment relationship, regardless of whether this relationship is based on an employment contract.
The legal ground for monitoring will most likely be the necessity to achieve a legitimate purpose of the employer. Based on the Opinion, it is important that employers only monitor employees if: • the monitoring is necessary • the legitimate purpose cannot be achieved by other means that are less intrusive • the processing is proportionate
In addition, employers must always inform their employees sufficiently in advance of the possibility that the use of certain technologies may result in them being monitored. Moreover, employers must indicate what the purpose of the use of these certain technologies is, as well as provide any other information that is relevant in order to guarantee data is processed with due care. Please click here for a PDF file of the Opinion