Right to Privacy, Data Protection Laws and Disciplinary Proceedings

Spain has some of the strictest data protection laws in Europe and these laws, combined with the constitutional right to privacy, are particularly relevant to employers when considering the admissibility of evidence in disciplinary proceedings.

By way of example, in a case which came before the Madrid court of appeal last year, an employer sought to rely on evidence obtained from a GPS system in a company car. The employer wanted to show that the employee’s misconduct dismissal was justified because the GPS evidence proved that the employee had breached the contractual duty of good faith.1

 The employer lost the case both in the court of first instance and on appeal because it was held that the employer’s evidence had been obtained in breach of Spanish data protection law, and in breach of the constitutional right to privacy, and was therefore inadmissible. As a result, the dismissal was held to be unfair.

Whilst the employee had been informed that the company car had a GPS system installed, he was told it was for security purposes in case the car was stolen. The employee had not been expressly informed that information collected from the GPS system could be used against him in disciplinary proceedings.

Spanish law provides that employers have the right to adopt measures of supervision and control to ensure that employees are complying with their employment obligations, provided that such measures do not breach any of the employee’s constitutional rights. The Spanish constitution specifically states that the law will limit the use of information technology to guarantee the honor and personal and family privacy of Spanish citizens in the exercise of their rights. In addition, Spanish data protection law provides individuals have the rights, amongst others, to be informed: (i) of the existence of a file or how their personal data may be used, the objective of the collection of data and where the information will be sent; (ii) of the consequences of the obtaining of personal data.

Broadly speaking, these provisions have been interpreted by Spanish courts to mean that there is an obligation on employers to give employees prior, express, clear and unequivocal warning that personal data may be obtained and used in disciplinary proceedings. The courts have also stressed that any collection and use of data must be necessary, appropriate and proportional in all the circumstances.

In this case, the appeal court made the non-binding observation that if the business wanted to demonstrate that the employee had not been working during his normal working hours, or had used the company car for private purposes, then these were facts which could have been proved “without any difficulty” with evidence that had been obtained in a much less intrusive way and not in breach of his right to privacy and a private life. Unhelpfully, the court does not expand on how this might have been done.

We recommend that clients review their contracts of employment and company policies, including their data protection policies, to ensure that all the purposes for which the data may be used (including disciplinary purposes) are expressly listed. Employers also have an obligation to inform the Spanish Data Protection Agency about the creation of a file relating to evidence obtained for disciplinary proceedings.