The GDPR

Article 88 of the Regulation allows Member States, either by law or through collective agreements, make adjustments to data protection rules for  employment relationship, including more precise rules for the protection of rights and freedoms.

These rules could be provide for processing to be limited purposes such as recruitment, performance of the employment contract, other obligations established by law or by collective agreements, management, planning and organization of labour, equality and diversity in the workplace, occupational health and safety, protection of property belonging to the employer or client, exercise and enjoyment of rights and benefits related to the employment, individually or collectively, as well as for the termination of the employment relationship.

Those rules must include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place (paragraph 2).

Initially, the second proposed version of the Regulation authorised the Member State to establish, by law, the conditions, in which the personal data relating to employment could be processed on the basis of the employee’s consent. This provision was deleted, as the G29 argued consent of an employee can be considered as expressed explicitly and freely as part of an employment contract characterized by a subordination link (Opinion 15/2011 of 13 July 2011 on the definition of consent, WP 187, p 15;. see also WP 48 on the processing of personal data in the employment context. WP 114 - Working document on a common interpretation of Article 26, paragraph 1 of Directive 95/46/EC of 24 October 1995, is also relevant).

Finally, Each Member State shall notify the Commission of those provisions adopted into its law no later than 2 years after the publication of the Regulation and, without delay, any subsequent amendment affecting them.

The Directive

The Directive did not contain any specific provision in the context of labour law.

Potential issues

The difficulty will doubtlessly arise from the divergences of the regime between the Member States and from a lack of harmonization, as the lowest severity to be applied in a matter could foster a social dumping phenomenon. Therefore, control is provided via the notifications to the Commission, which should help to avoid excessive disparities.

 

European Union

Retour au sommaire

Article 29 Working Party

Opinion 2/2017 on data processing at work - wp249 ( 8 June 2017)

This Opinion complements the previous Article 29 Working Party (“WP29”) publications Opinion 8/2001 on the processing of personal data in the employment context (WP48) , and the 2002 Working Document on the surveillance of electronic communications in the workplace (WP55). Since the publication of these documents, a number of new technologies have been adopted that enable more systematic processing of employees’ personal data at work, creating significant challenges to privacy and data protection. This Opinion makes a new assessment of the balance between legitimate interests of employers and the reasonable privacy expectations of employees by outlining the risks posed by new technologies and undertaking a proportionality assessment of a number of scenarios in which they could be deployed. Whilst primarily concerned with the Data Protection Directive, the Opinion looks toward the additional obligations placed on employers by the General Data Protection Regulation. It also restates the position and conclusions of Opinion 8/2001 and the WP55 Working Document, namely that when processing employees’ personal data:

-  employers should always bear in mind the fundamental data protection principles, irrespective of the technology used; -  the contents of electronic communications made from business premises enjoy the same fundamental rights protections as analogue communications;

- consent is highly unlikely to be a legal basis for data processing at work, unless employees can refuse without adverse consequence;

- performance of a contract and legitimate interests can sometimes be invoked, provided the processing is strictly necessary for a legitimate purpose and complies with the principles of proportionality and subsidiarity;

- employees should receive effective information about the monitoring that takes place; and

- any international transfer of employee data should take place only where an adequate level of protection is ensured.

Link

Retour au sommaire

European Union

CJEU caselaw

C-34/21 (30 March 2023) - Hauptpersonalrat der Lehrerinnen und Lehrer

1.      Article 88 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that national legislation cannot constitute a ‘more specific rule’, within the meaning of paragraph 1 of that article, where it does not satisfy the conditions laid down in paragraph 2 of that article.

2.      Article 88(1) and (2) of Regulation 2016/679

must be interpreted as meaning that the application of national provisions adopted to ensure the protection of employees’ rights and freedoms in respect of the processing of their personal data in the employment context must be disregarded where those provisions do not comply with the conditions and limits laid down in Article 88(1) and (2), unless those provisions constitute a legal basis referred to in Article 6(3) of that regulation, which complies with the requirements laid down by that regulation.

Judgment of the court

Opinion of the advocate General

---

C-65/23 (19 December 2024) - K GmbH (Traitement de données personnelles des employés)

1.      Article 88(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that a provision of national law which concerns the processing of personal data for the purposes of employment relationships and has been adopted pursuant to Article 88(1) of that regulation must have the effect of requiring its addressees to comply not only with the requirements arising from Article 88(2) of that regulation, but also with those arising from Article 5, Article 6(1) and Article 9(1) and (2) thereof.

2.      Article 88(1) of Regulation 2016/679

must be interpreted as meaning that, where a collective agreement falls within the scope of that provision, the margin of discretion that the parties to that agreement have to determine whether the processing of personal data is ‘necessary’, within the meaning of Article 5, Article 6(1) and Article 9(1) and (2) of that regulation, does not prevent the national court from carrying out a full judicial review in that regard.

Judgment of the Court 

Retour au sommaire Retour au sommaire