The hunger for data continues to grow. Driven by the measurement frenzy, start-ups offering pioneering assessment tools are springing up: Tests that allow the qualities of an applicant or employee to be analysed. One uses DNA, another performs an in-depth brain analysis.
This obviously affects privacy. It's highly questionable whether – under current privacy law - employers can still legally carry out assessments, perform in-depth (big data) investigations into staff capacities or offer coaching programmes. This applies even if the employee is able to consent to this.
The FD of 20 May covered the report by the Rathenau Instituut ('Human rights in the robot age'). The report argues in favour of the human right not to be measured or coached. This new human right seems like an unnecessary luxury. After all, whenever a person is measured, personal data is processed. And the protection of personal data is already a fundamental right.
A fundamental right obviously is not absolute. Someone with a legitimate interest can generally process personal data for this purpose if this is necessary. But the same doesn't apply to 'special personal data' such as health data. The processing of such data is banned, unless a legal exception can be found.
So, an important question is what is covered by the term 'special personal data'. In 2012, the Dutch data protection agency, (then the Cbp, now the Autoriteit Persoonsgegevens, AP) investigated an organisation which required staff to undergo compulsory assessments in the interests of good business practice. At the time, the Cbp concluded that although (psychological) data collected in an assessment was 'sensitive' it did not qualify as special personal data. This implied that a legitimate interest in processing assessment data might suffice. However, the Cbp did not consider the assessments to be necessary for the intended purpose.
But in 2015, European privacy supervisors jointly concluded that the definition of health data was much broader. Since then, the AP has worked on the basis that health data also includes data about intellectual and emotional capacities, such as IQ, assertiveness, selfawareness and empathy. Typical qualities that are measured in an assessment. Organising an assessment or a coaching programme nearly always involves processing special personal data. Which is therefore banned, unless...
The main exception is consent. That seems to make sense. But a major problem arises if the assessment or coaching programme is work-related in any way. Because the privacy authorities also consider that employees are hardly ever capable of freely giving valid consent. The relationship of authority and dependence means that the consent isn't 'free' and is therefore invalid.
The only other exception available to an employer is processing which is necessary for the reintegration or support of employees in relation to unfitness for work. It won't normally be possible to take advantage of this exception.
This means that an assessment or coaching programme can only go ahead if it takes place at the initiative of the tested person, totally outside the working environment. In my view, the virtually closed route of free consent in the working environment represents (severe) overprotection amounting to a restriction of the right to self-determination and therefore of the personal freedom of employees.
It is also difficult to reconcile with the fact that citizens are considered to freely consent to the sharing of personal data for many services which can only be obtained in return for the sharing of data, such as the combined Google services or, under the forthcoming payment services directive, payment services.
The forthcoming General Data Protection Regulation (GDPR), which comes into force on 25 May 2018, may well throw a lifeline to employers. This is because the GDPR creates an exception for the processing of special personal data if this is necessary for the assessment of the employee's fitness for work. In my view, this should be interpreted in a broad sense. Otherwise, the leeway available to employers will be severely restricted. This applies to assessments, but equally to the administration of a drugs test on someone who does dangerous work, for example.