menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Finland) language
Contact our local member in Finland mail_outline
Visit the website of HH Partners - Law Firm, Helsinki, Finland account_balance

arrow_backPrevious Article
Article 88
Next Articlearrow_forward

Processing in the context of employment

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 88 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 88 keyboard_arrow_up

Key words related to article 88

Show the recitals of the Regulation related to article 88 keyboard_arrow_down Hide the recitals of the Regulation related to article 88 keyboard_arrow_up

(155) Member State law or collective agreements, including ‘works agreements’, may provide for specific rules on the processing of employees' personal data in the employment context, in particular for the conditions under which personal data in the employment context may be processed on the basis of the consent of the employee, the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.

There is no recital in the Directive related to article 88.

The GDPR

Article 88 of the Regulation allows Member States, either by law or through collective agreements, make adjustments to data protection rules for  employment relationship, including more precise rules for the protection of rights and freedoms.

These rules could be provide for processing to be limited purposes such as recruitment, performance of the employment contract, other obligations established by law or by collective agreements, management, planning and organization of labour, equality and diversity in the workplace, occupational health and safety, protection of property belonging to the employer or client, exercise and enjoyment of rights and benefits related to the employment, individually or collectively, as well as for the termination of the employment relationship.

Those rules must include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place (paragraph 2).

Initially, the second proposed version of the Regulation authorised the Member State to establish, by law, the conditions, in which the personal data relating to employment could be processed on the basis of the employee’s consent. This provision was deleted, as the G29 argued consent of an employee can be considered as expressed explicitly and freely as part of an employment contract characterized by a subordination link (Opinion 15/2011 of 13 July 2011 on the definition of consent, WP 187, p 15;. see also WP 48 on the processing of personal data in the employment context. WP 114 - Working document on a common interpretation of Article 26, paragraph 1 of Directive 95/46/EC of 24 October 1995, is also relevant).

Finally, Each Member State shall notify the Commission of those provisions adopted into its law no later than 2 years after the publication of the Regulation and, without delay, any subsequent amendment affecting them.

The Directive

The Directive did not contain any specific provision in the context of labour law.

Potential issues

The difficulty will doubtlessly arise from the divergences of the regime between the Member States and from a lack of harmonization, as the lowest severity to be applied in a matter could foster a social dumping phenomenon. Therefore, control is provided via the notifications to the Commission, which should help to avoid excessive disparities.

 

Finland

In general, the requirements for processing personal data in connection with employment in Finland are stricter than the requirements in other EU countries.

The Finnish law regulates the following: processing of the health data of employees, processing the personal data relating to performance tests and examinations, personal data relating to drug tests, technical surveillance in the workplace, and retrieving and opening employees’ email and other messages.

Consulting data privacy professional who is familiar with the Finnish regulation is recommendable.

arrow_back Previous Article • Article 88 • Next Article arrow_forward
arrow_back Previous Article • Article 88 Next Article arrow_forward

Summary

European Union

European Union

Retour au sommaire

Article 29 Working Party

Opinion 2/2017 on data processing at work - wp249 ( 8 June 2017)

This Opinion complements the previous Article 29 Working Party (“WP29”) publications Opinion 8/2001 on the processing of personal data in the employment context (WP48) , and the 2002 Working Document on the surveillance of electronic communications in the workplace (WP55). Since the publication of these documents, a number of new technologies have been adopted that enable more systematic processing of employees’ personal data at work, creating significant challenges to privacy and data protection. This Opinion makes a new assessment of the balance between legitimate interests of employers and the reasonable privacy expectations of employees by outlining the risks posed by new technologies and undertaking a proportionality assessment of a number of scenarios in which they could be deployed. Whilst primarily concerned with the Data Protection Directive, the Opinion looks toward the additional obligations placed on employers by the General Data Protection Regulation. It also restates the position and conclusions of Opinion 8/2001 and the WP55 Working Document, namely that when processing employees’ personal data:

-  employers should always bear in mind the fundamental data protection principles, irrespective of the technology used; -  the contents of electronic communications made from business premises enjoy the same fundamental rights protections as analogue communications;

- consent is highly unlikely to be a legal basis for data processing at work, unless employees can refuse without adverse consequence;

- performance of a contract and legitimate interests can sometimes be invoked, provided the processing is strictly necessary for a legitimate purpose and complies with the principles of proportionality and subsidiarity;

- employees should receive effective information about the monitoring that takes place; and

- any international transfer of employee data should take place only where an adequate level of protection is ensured.

Link

Retour au sommaire

National authority

As a general note, in most of the cases, processing an employee's personal data based on the consent of the employee is not valid basis for the processing, since an employee is considered to be a weaker party compared to an employer, and therefore, the consent is not necessarily freely given by the employee.

 

Guidance of the Finnish Office of the Data Protection Ombudsman to frequently asked questions relating to working life

Link to the guidance: https://tietosuoja.fi/en/faq-working-life

What personal data on employees and job applicants can employer process?

The employer may only process personal data that is directly necessary with regard to the employee's employment relationship, which is related to the exercise of the rights and obligations of the parties or to the benefits provided by the employer, or that result from the specific nature of the work. The employer is therefore not allowed to process any personal data relating to an employee.

This so-called requirement of necessity is laid down in section 3 of the Act on the Protection of Privacy in Working Life. The requirement of necessity cannot be waived, even with the employee’s consent.

The requirement of necessity also applies to job search situations. The employer's right to collect the personal data of a job applicant depends on the job for which the person has applied. In a job search situation, the information needed is mainly that which demonstrates the applicant's qualifications and suitability for the job in question.

The requirement of necessity also applies to information collected by the employer through testing or assessing the job applicant or employee. The employer’s personal and aptitude tests must be necessary for the employment relationship. The processing of, for example, drug test data and employee health data must also comply with the requirement of necessity.

What should an employer take into account when collecting personal data from the employees and job applicants?

The employer must collect personal data on employees and jobseekers primarily from the employees and job applicants themselves. If the employer collects personal data from a source other than the employee, the employee's consent to the collection must be obtained in principle. However, consent is not required where an authority discloses information to an employer for the performance of a statutory task, or where the collection or receipt of the information is specifically provided for by law.

For example, if the employer wants to ask a former employer about a job applicant’s performance at work, the employer must obtain the job applicant’s consent to do so.

Is the employer allowed to monitor or supervise the employee's use of the internet?

The employer has the right to supervise and monitor work (the right of direction), by virtue of which the employer can specify the duties of individual employees, issue work-related orders and monitor the performance of employees. However, this right does not entitle the employer to monitor the employee by collecting or viewing the identifying data accumulated through the employee’s use of the internet.

Neither can the employee give a valid consent to the employer's supervision of his or her browsing. The right to confidential communications also applies to browsing the internet and the identifying data accumulated thereby.

The employer can nevertheless issue rules on the use of information networks, such as whether browsing the internet at the workplace is permitted in the first place and, if it is, what kinds of sites employees are permitted to visit. The employer also has the right to block access to certain sites.

Is the employer permitted to locate its employees?

Determining the location of employees is part of technical supervision, which needs to be processed in the co-operation procedure at the workplace. It is only possible if the employer has an appropriate basis and need for it. Locating employees can be justified by, for example, ensuring the safety of employees and the correct allocation of resources (such as vehicles). Locating using a mobile phone requires the consent implied by law on the services of electronic communications.

In the opinion of the Data Protection Ombudsman, location data should not, as a rule, be used for the monitoring of obligations under labour law, such as the monitoring of working hours. Using location data for monitoring and keeping track of working hours can be possible, however, if the employee works at home or mostly away from the employer’s premises and there are no other, less intrusive means of monitoring available.

If the positioning system is intended to be used for monitoring and keeping track of working hours, the employer should specify this as one of the purposes of the processing of location data. If this purpose has not been specified in advance and no cooperation procedure has been implemented on the matter at the workplace, the location data may not be used for monitoring compliance with the terms of the employment or service relationship.

When is the processing of data concerning trade union membership permitted?

Trade union membership falls under a special category of personal data, and its processing is provided for in Article 9 of the General Data Protection Regulation. The processing of data concerning trade union membership is permitted when this is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.

An organisation involved in trade union activities is permitted to process data concerning trade union membership in connection with its operations provided the appropriate safeguards are observed. Under section 6 (3) of the Data Protection Act, the processing of data concerning trade union membership is permitted in connection with, for example, industrial action.

A trade union may process the data of its own trade associations only. Processing of personal data is permitted if it concerns the data of the current or former members of these associations or persons who have regular contacts with the associations linked to the purpose of these associations. It is also required that personal data be not disclosed to a third party without the consent of the data subject and that the processing concerns data to the processing of which the data subject has specifically consented.

Can an employer ask an employee's previous employer about the employee's performance in their previous jobs?

The employer must remember that it must primarily collect personal data concerning an employee from the employee themselves. The employer needs the employee's consent to collect personal data from other sources.

Furthermore, the employer must also take the necessity requirement into consideration, that is, the employer may only process personal data that are directly necessary for the employee's employment relationship, related to the fulfilment of the rights and obligations of the parties to the employment contract or the benefits offered by the employer to its employees, or that must be processed due to the special nature of the work.

In other words, the employer may ask the employee's previous employer about the employee's performance if it considers that the necessity requirement is met, cannot obtain the required information from the employee and has received the employee's consent for asking for the data.

Consent refers to any freely given, specific, informed and unambiguous expression of agreement by which the data subject accepts the processing of their personal data. The employer must be able to prove that it has received the employee's consent.

May an employer store an employee's credit information after checking it?

The principle of storage limitation must be observed in the storage of credit information just as with any other personal data. According to the principle, personal data may not be stored for longer than is necessary for the purposes for which the personal data are processed.

In other words, the employer must determine the purpose for which the credit information is being processed and estimate when the purpose of processing the credit information has been fulfilled. When the credit information is no longer needed for this purpose, it must be erased.

Long storage periods are not justified for credit information, because the information obtained with a credit information query always represents the situation at the time of the query. Credit information can change rapidly after any given query, making the credit information report obsolete.  

When and how can an employer process an employee's health information?

The employer is permitted to process data concerning the employee’s state of health (e.g. diagnoses) if the processing is required for the payment of the wages for the period of illness or other, corresponding health-related benefits or to determine whether the employee has a justified reason for absence. The processing of data concerning the state of health is also permitted if the employee specifically requests that his or her ability to work should be reviewed on the basis of the data. The employer also has the right to process data in situations and to the extent provided elsewhere by law.

The employer can collect data concerning the employee’s state of health from the employee. The collection of such data from other sources requires the employee’s written consent. If the employee delivers a medical certificate or statement on his or her ability to work to the employer, the employer may deliver it to the occupational health care provider unless prohibited by the employee.

The employer must keep records containing the employee’s health information separate from their other personal data. Health records must not be stored together with, for example, payroll records.

Only persons who prepare, take or implement decisions concerning the employment relationship on the basis of such information may process data concerning state of health. The employer must designate these persons or define the tasks involving the processing of health information.

The employer and any persons who process health information on behalf of the employer are bound by confidentiality and must not disclose the employee’s health information to third parties.

Data concerning state of health must be deleted immediately after the processing is no longer justified. The justification and need for processing must be assessed at least every five years.

Patients in occupational health care have the right to know who has processed their data and to whom it has been disclosed. An employee can ask occupational health care about this. The employer does not have access to the occupational health care medical records system.

What is the law on alcohol or drug testing for employees?

The Act on the Protection of Privacy in Working Life provides detailed provisions on drug testing and the processing of data on drug use (Act on the Protection of Privacy in Working Life, chapter 3). However, the processing of employee alcohol testing or data on alcohol consumption is not specifically covered by data protection legislation.

The Act on the Protection of Privacy and Working Life regulates, among other things, when an employer has the right to process data relevant to the drug test certificate of a job applicant or employee selected for a job. The employer must inform the job applicant or employee that this is a job for which the employer is entitled to process such data.

There are legal health requirements for certain jobs and professional groups. In such job, the employee must be able to prove that they are fit for work, for example for safety reasons. Mandatory health checks are part of being able to demonstrate work ability, and alcohol and drug use may be assessed as part of these checks.

A health check, test or sampling may only be carried out by a health professional or within the sphere of health care.

All health checks and tests carried out by occupational health care comply with the Occupational Health Care Act and other health legislation such as the Act on the Status and Rights of Patients.

What information does the employer receive about an employee's work ability? Can occupational health care disclose to the employer information about an employee's alcohol or drug testing?

Occupational health care may not disclose an employee's health information to the employer without the employee’s consent. This means that occupational health care cannot, for example, give individual test results, diagnostic information or mental health information to an employer unless the employee so desires.

Certain professional groups are subject to compulsory health checks, which include a comprehensive examination of the employee’s state of health to demonstrate work ability. The health check may also include an assessment of alcohol or drug use. Occupational health care may only provide the employer with information on the employee’s work ability at a general level.

A general report on the health check is drawn up and submitted to the employer. The certificate includes general assessment of whether or not the person is suitable for the job. The entry can take the form of "able to work", "partially able to work" or "unable to work", for example. The certificate does not include individual test results, a diagnosis or a specific health-related reason why an employee unsuitable for the job (e.g. alcohol consumption).

An employer's right to order a drug test and to process data on drug use is regulated by the Act on the Protection of Privacy and Working Life. A drug test certificate is drawn up stating whether the employee has used drugs for non-medical purposes in such a way that their ability to work or function is impaired. According to the Occupational Health Care Act, the certificate must be given to the person being tested for delivery to the employer.

Does an employee have the right to refuse a health check or alcohol or drug test on the grounds of privacy?

For certain professional groups and jobs, an employee must be able to prove that they are fit for work. Health checks are required by law and the employee cannot refuse them without good reason. According to the Occupational Health Care Act, an employee or job applicant selected for a job may not, without justified reason, refuse to participate in a health check that is necessary  

  1. to determine their state of health in work or a work environment that poses a particular risk of illness, or to determine
  2. their ability to perform the work or their functional capacity, due to health requirements arising from the work.

Even if an employee has a valid reason for refusing to participate in an occupational health assessment, this may result in disciplinary action at the employer's discretion.

The employer can also offer voluntary health checks and other occupational health services to support work ability. An employee has the right to choose whether or not to undergo these voluntary checks or tests. The employer has a legal obligation to provide preventive occupational health services.

Can an employee's alcohol consumption be tested without their knowledge?

Employees have the right to know what tests on them are being done. A health check must always be carried out in agreement with the employee. Occupational health care is provided in accordance with the Act on the Status and Rights of Patients, which provides for the patient's right to self-determination.

Does an employer have permission to read employee's email?

Email correspondence is confidential. However, on certain conditions, the employer has the right to retrieve or open messages sent to or from an employee's email address.

In order to do so, the employer must have sought to ensure that it would not need to read the employee's email. In the Act on the Protection of Privacy in Working Life, this obligation is referred to as the employer’s obligations regarding necessary arrangements. In order to avoid the need to read an employee's email, the employer should offer the employee the opportunity to take the following measures:

  • The employee can, with the aid of the electronic mail system’s automatic reply function, send a notification to a message sender about his or her absence and the length of absence, and information about the person who is to take care of the tasks of the absent employee.
  • The employee can direct messages to another person approved by the employer for this task or to another employer-approved address of the employee.
  • The employee can give his or her consent to an arrangement whereby in his or her absence another person of his or her choosing and approved by the employer can receive messages sent to the employee. The aim is to establish whether the employee has been sent a message that is clearly intended for the employer for the purpose of managing the work and on which it is essential for the employer to have information on account of its operations or the appropriate organisation of the work.

In what circumstances can an employer retrieve an employee's email messages?

As a rule, an employee's email correspondence is confidential. The employer must seek to ensure that it will not need to read the employee's email. In the Act on the Protection of Privacy in Working Life, this obligation is referred to as the employer’s obligations regarding necessary arrangements. (Also see the answer to the question "Does an employer have permission to read an employee's email?")

During or immediately before their absence, the employee may have been sent messages belonging to the employer that the employer needs in order to complete negotiations concerning its operations, to serve customers or to safeguard its operations. The employer may also have sent such messages immediately before their absence.

The Act on the Protection of Privacy in Working Life specifically provides for the circumstances in which the employer may retrieve or open an employee's email messages. The employer may have the right to retrieve messages belonging to it from the employee's email when all of the following conditions are met:

  • The employee manages tasks independently on behalf of the employer and the employer does not operate a system with which the matters attended to by the employee and the processing stages involved are recorded or are otherwise ascertained.
  • It is evident, on account of the employee’s tasks and matters pending, that messages belonging to the employer have been sent or received.
  • The employee is temporarily prevented from performing their duties, and messages belonging to the employer cannot be obtained for the employer’s use despite the fact that the employer has seen to its statutory obligations.
  • The employee’s consent cannot be obtained within a reasonable time and the investigation of the matter cannot be delayed.​​​

The employer is permitted to search for messages by sender, recipient or subject with the help of the administrator. The information on the message sender, recipient or title may not be processed more extensively than necessary for the purpose of retrieving the message.

A report signed by the persons involved must be drawn up of the retrieval, stating why the message was retrieved, the time it was retrieved and who performed the retrieval. The report must be submitted to the employee concerned without undue delay.

The persons who participated in the retrieval of the message may not disclose the information they obtained to a third party during the employment relationship or after it has ended.

In what circumstances can an employer open an employee's email messages?

As a rule, an employee's email correspondence is confidential. In addition, the employer must seek to ensure that it will not need to read the employee's email. In the Act on the Protection of Privacy in Working Life, this obligation is referred to as the employer’s obligations regarding necessary arrangements. (Also see the answer to the question "Does an employer have permission to read an employee's email?")

The Act on the Protection of Privacy in Working Life specifically provides for the circumstances in which the employer may retrieve or open messages from an employee's email. The employer may have the right to open a message sent or received by an employee if the following conditions are met:

  • If, after the retrieval of the message, it is apparent that it is essential for the employer to learn the message's content in order to complete negotiations concerning its operations or to serve customers or safeguard its operations. The employer must ensure that the conditions for retrieving the message are also met.
  • The message sender and recipient cannot be contacted for the purpose of establishing the content of the message or for the purpose of sending it to an address indicated by the employer.
  • The employer may open the message with the assistance of the information system administrator and in the presence of another person.

​​​​​​A report about opening the message must be drawn up and signed by the persons involved. The report must state which message was opened, why it was opened, the time of opening, the persons who opened it and to whom the information on the content of the opened message was given. The report must be submitted to the employee concerned without undue delay.

The opened message must be stored, and its content and the information on the sender may not be processed more extensively than is necessary for the purpose of opening the message. The persons who took part in opening the message may not disclose the content of the message to a third party during or after the employment relationship.

Can an employer keep an employee's email account open after the termination of employment?

As a rule, the employer no longer has a legal basis for processing an employee's email account after the termination of their employment, so the employer must close the former employee's email account in order to minimise the processing of personal data.

In order to keep an employee's email account open after the termination of employment, the employer must, in the first instance, request the employee's consent for this. The employee's consent is also required for reading or forwarding their email. Consent refers to any freely given, specific, informed and unambiguous expression of agreement by which the employee accepts the processing of their personal data, in this case, keeping their email account open and reading and "forwarding" their email. The employer must be able to prove that it has received the employee's consent.

The employee can withdraw their consent at any time. The employee also has the right to demand that their email account be closed upon the termination of their employment.

Can an employee demand the closure of their work email account upon the termination of employment?

An employee has the right to demand that their email account is closed upon the termination of their employment. In the first instance, the employee should contact their former employer directly and demand the closure of their email account.

As a rule, the employer no longer has a legal basis for processing an employee's email account after the termination of their employment, so the employer must close the former employee's email account in order to minimise the processing of personal data.

In order to keep an employee's email account open after the termination of employment, the employer must, in the first instance, request the employee's consent for this. The employee's consent is also required for reading or ”forwarding” their email. Consent refers to any freely given, specific, informed and unambiguous expression of agreement by which the employee accepts the processing of their personal data, in this case, keeping their email account open and reading and "forwarding" their email. The employer must be able to prove that it has received the employee's consent. The employee can withdraw their consent at any time.

 

Can an employer sen an out-of-office message for an employee's email without the employee's consent?​

As a rule, the employer needs the employee's consent for setting an out-of-office message for their email account.

However, in exceptional circumstances, the employer may access the employee's email account and set an out-of-office message without the employee's consent if all of the following conditions are met:

  • the employee manages tasks independently on behalf of the employer and the employer does not operate a system with which the matters attended to by the employee and the processing stages involved are recorded or are otherwise ascertained;
  • it is evident, on account of the employee’s tasks and matters pending, that messages belonging to the employer have been sent or received;
  • the employee is temporarily prevented from performing their duties, and messages belonging to the employer cannot be obtained for the employer’s use despite the fact that the employer has seen to its statutory obligations; and
  • the employee's consent cannot be obtained in a reasonable time, for example due to illness, and the matter cannot wait.​​

For what purposes can an employer use camera surveillance?

An employer may only use camera surveillance on its premises for the purposes of:

  1. ensuring the personal safety of its employees and others on the employer's premises;
  2. protecting property;
  3. ensuring the functioning of production processes; or
  4. preventing or investigating incidents that put safety, property or production processes at risk.

Camera surveillance may not be used

  • to monitor an employee or a specific group of employees at the workplace;
  • in the personal office of an employee;
  • in recreation rooms;
  • in changing rooms;
  • in toilets; or
  • according to the Office of the Data Protection Ombudsman's decision, for monitoring obligations under labour law, such as compliance with working hours.

However, camera surveillance may exceptionally be targeted at specific workstations if necessary

  1. due to a manifest threat of violence or risk to the health and safety of an employee;
  2. in order to prevent and investigate property offences if handling property of significant value or quality, such as money, securities or valuables, is an essential part of the employee's duties; or
  3. upon the employee's request or if the surveillance has been agreed on with the employer, provided that the purpose of the surveillance is to safeguard the interests and rights of the employee.

What does the employer need to take into account when considering camera surveillance for the workplace?

The employer must take the following considerations into account when planning and implementing camera surveillance at the workplace:

  1. Before introducing camera surveillance, determine whether other, less invasive methods would be possible.
  2. Make sure that the camera surveillance does not compromise the privacy of employees more than is necessary for the achievement of the appropriate purposes of the surveillance.
  3. Make sure that employees are clearly and openly informed of the controller of the data generated by camera surveillance, the purposes of and legal basis for processing the personal data, the recipients of the personal data, the storage times of the data, as well as the rights of the data subject.
  4. Draw up internal documentation that includes a record of processing activities and, if necessary, a data protection impact assessment.
  5. Specify the individuals in the organisation whose duties or position give them the right to watch/process camera footage according to the controller's instructions. Also specify how the footage will be protected from unauthorised access.
  6. Conduct a cooperation or consultation procedure with the required parties on the implementation of camera surveillance.
  7. After the cooperation of consultation procedure, inform the employees of the start of camera surveillance, how it is implemented and in which situations the footage may be used, as well as the placement of any cameras used to monitor workstations.
  8. Post clearly visible signs of the camera surveillance and its implementation method in the premises under surveillance.
  9. Only use the footage for the appropriate, planned and declared purposes for which the camera surveillance has been conducted.
  10. Specify the storage time for recorded footage and destroy it immediately when it is no longer required.

For which purposes can an employer use recorded camera surveillance footage in exceptional cases?

As a rule, the employer can only use camera surveillance footage for the pre-planned and declared purposes of the surveillance. However, in exceptional cases, the employer has the right to use such footage:

  1. to demonstrate grounds for termination;
  2. to investigate or prove harassment referred to in the Act on Equality between Women and Men (609/1986), harassment referred to in section 14 of the Non-Discrimination Act (1325/2014) or harassment and inappropriate behaviour referred to in the Occupational Safety and Health Act (738/2002) if the employer has justified cause to suspect the employee of harassment or inappropriate behaviour; or
  3. to investigate an occupational accident or other dangerous or threatening situation referred to in the Occupational Safety and Health Act.

 

Retour au sommaire
arrow_back Previous Article • Article 88 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C-34/21 (30 March 2023) - Hauptpersonalrat der Lehrerinnen und Lehrer

1.      Article 88 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that national legislation cannot constitute a ‘more specific rule’, within the meaning of paragraph 1 of that article, where it does not satisfy the conditions laid down in paragraph 2 of that article.

2.      Article 88(1) and (2) of Regulation 2016/679

must be interpreted as meaning that the application of national provisions adopted to ensure the protection of employees’ rights and freedoms in respect of the processing of their personal data in the employment context must be disregarded where those provisions do not comply with the conditions and limits laid down in Article 88(1) and (2), unless those provisions constitute a legal basis referred to in Article 6(3) of that regulation, which complies with the requirements laid down by that regulation.

Judgment of the court

Opinion of the advocate General

C-65/23 (19 December 2024) - K GmbH (Traitement de données personnelles des employés)

1.      Article 88(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that a provision of national law which concerns the processing of personal data for the purposes of employment relationships and has been adopted pursuant to Article 88(1) of that regulation must have the effect of requiring its addressees to comply not only with the requirements arising from Article 88(2) of that regulation, but also with those arising from Article 5, Article 6(1) and Article 9(1) and (2) thereof.

2.      Article 88(1) of Regulation 2016/679

must be interpreted as meaning that, where a collective agreement falls within the scope of that provision, the margin of discretion that the parties to that agreement have to determine whether the processing of personal data is ‘necessary’, within the meaning of Article 5, Article 6(1) and Article 9(1) and (2) of that regulation, does not prevent the national court from carrying out a full judicial review in that regard.

Judgment of the Court 

Retour au sommaire Retour au sommaire
arrow_back Previous Article • Article 88 Next Article arrow_forward
Regulation
1e 2e

Art. 88

1. Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer's or customer's property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.

2. Those rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.

3. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.
1st proposal close

Art. 82

1. Within the limits of this Regulation, Member States may adopt by law specific rules regulating the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.

2. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by the date specified in Article 91(2) at the latest and, without delay, any subsequent amendment affecting them.

3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1.
2nd proposal close

Art. 82

1. Member States may by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer’s or customer’s property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship. (…)

2. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by the date specified in Article 91(2) at the latest and, without delay, any subsequent amendment affecting them.

3. Member States may by law determine the conditions under which personal data in the employment context may be processed on the basis of the consent of the employee.
Directive close

No specific provision
Finland
compare_arrows
visibility Old law

the Finnish Data Protection Act  (1050/2018), in force since January 1, 2019

Section 30 Processing of personal data in employment context

Provisions on the processing of personal data concerning employees, performance of tests and examinations on employees and the related requirements, technical surveillance in the workplace, and retrieving and opening employees’ email messages are laid down in the Act on the Protection of Privacy in Working Life (759/2004). 

*

Act on the Protection of Privacy in Working Life (759/2004)

Section 1 Purpose of the Act

The purpose of this Act is to promote the protection of privacy and other fundamental rights safeguarding the protection of privacy in working life. 

*

Section 2 Scope of application

This Act lays down provisions on the processing of personal data concerning employees, the performance of tests and examinations on employees and the related requirements, technical surveillance in the workplace, and retrieving and opening employees’ electronic mail messages.

The provisions of this Act concerning employees also apply to civil servants and any persons in a civil service relationship or comparable service relationship subject to public law, and, as appropriate, to job applicants.

In addition to what is provided in this Act, regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter Data Protection Regulation, contains provisions regarding the processing of employees’ personal data. 

Unless otherwise provided in this Act, the provisions of the Data Protection Act (1050/2018) shall also apply to the processing of personal data. Part VI of the Act on  Electronic Communications Services (917/2014) contains provisions regarding the confidentiality of communications and the protection of privacy. (347/2019)

The employee’s obligation to undergo a health examination is governed by separate provisions. 

*

Section 3 Necessity requirement  

The employer is only allowed to process personal data directly necessary for the employee’s employment relationship, which is connected with managing the rights and obligations of the parties to the employment relationship or with the benefits provided by the employer for the employee or which arises from the special nature of the work concerned.

No exceptions can be made to the necessity requirement, even with the employee’s consent. 

*

Section 4 (347/2019) General preconditions for collecting personal data concerning employees and the employer's duty to provide information

The employer shall collect personal data concerning the employee primarily from the employee himself or herself. In order to collect personal data from elsewhere, the employer must obtain the consent of the employee. However, this consent is not required when an authority discloses information to the employer to enable the latter to fulfil a statutory duty, or if it is expressly separately provided by law on collecting or obtaining data. The Security Clearance Act (726/2014) contains provisions regarding requests for security clearance. The Act on Checking the Criminal Background of Persons Working with Children (504/2002) contains provisions laying out the procedure to be followed when checking the criminal background of persons appointed to work with minors. Provisions on the right to obtain data from the criminal records are laid down in the Criminal Records Act (770/1993). 

The employer shall notify the employee in advance that data concerning the employee will be collected in order to establish his or her reliability. If the employer acquires personal credit data on an employee, the employer must also notify the employee of the register from which the credit data are obtained. If data concerning the employee has been collected from a source other than the employee himself or herself, the employer must notify the employee of this data before it is used in making decisions concerning the employee. Chapter III of the Data Protection Regulation contains provisions regarding the obligation of the controller to provide information to the data subject and regarding the right of access by the data subject. 

The collection of personal data during recruitment and during an employment relationship is governed by the co-operation procedure referred to in the Act on Co-operation within Undertakings (334/2007), the Act on Cooperation in Government Agencies and Public Bodies (1233/2013), and the Act on Cooperation between the Employer and Employees in Municipalities (449/2007). 

*

Section 5 Processing data concerning health

The employer has the right to process data concerning the employee's health status if the data has been collected from the employee himself or herself, or elsewhere with the employee’s written consent, and the data needs to be processed in order to pay sick pay or other comparable health-related benefits or to establish whether there is a justified reason for absence or if the employee expressly wishes his or her working capacity to be assessed on the basis of data concerning his or her health. In addition, the employer has the right to process such data in the specific circumstances, and to the stipulated extent, separately provided elsewhere in the law.  

Data concerning the employee's health may only be processed by persons who prepare, make or implement decisions concerning employment relationships on the basis of such data. The employer shall nominate such persons or specify the tasks that involve processing of the data concerning health. Persons who process such data may not disclose any of it to a third party either during or after their employment relationship.

A doctor’s certificate or statement concerning the employee’s working capacity given to the employer by the employee may, however, be supplied to the occupational health service provider for the purpose of carrying out the occupational health care duties laid down in the Occupational Health Care Act (1383/2001), unless the employee has forbidden this.

The employer must store any data in its possession concerning the employee's health separately from any other personal data that it has collected. Data concerning health shall be erased immediately after the grounds for processing referred to in paragraph 1 have ceased to exist. The grounds and necessity of processing shall be evaluated at least every five years. (347/2019) 

*

Section 5 a (511/2008)  Processing of personal credit data 

The employer has the right to obtain and use personal credit data referred to in section 4 of the Credit Information Act (527/2007) concerning a job applicant selected for a position for the purpose of assessing the job applicant’s reliability when the intention is that the applicant will work in duties that require particular reliability and

1) that involve the power to make significant financial commitments on behalf of the employer or to use de facto independent discretionary power in the preparation of such commitments;

2) in which the employee’s specific duty is to grant and control financially significant credits;  

3) in the administration of which the employee is given access to specially protected trade secrets of key significance for the employer or its customer; (610/2018) 

4) that require access rights to information systems that will allow the transfer of the employer’s or its customer’s funds, or modify the related information, or in which the employee is granted system administrator rights to such an information system;

5) that essentially involve the processing, without any immediate supervision, of large amounts of money, or securities or valuable items;

6) that involve the guarding of the employer’s or its customer’s property;

7) that, as a rule, involve working in a private home without supervision. 

The provisions of subsection 1 shall also apply if the employee’s duties change during the employment relationship in such a way that they fulfil the preconditions laid down in the stated subsection concerning the employer’s right to handle personal credit data.

The employer is responsible for the costs of obtaining the personal credit data.

Section 19, subsection 2, paragraph 9 of the Credit Information Act contains provisions regarding the right to use personal credit data when a person is selected into a position of responsibility in a company. 

*

Section 6 Drug test certificate

The employer may only process data on the drug use testing of the employee which is contained in the drug test certificate supplied to the employer by the person concerned. The processing of the data is otherwise subject to the provisions of section 5(2-4).  

A drug test certificate means a certificate issued by a health care professional and laboratory designated by the employer stating that the employee has been tested for the use of a drug referred to in section 3, subsection 1, paragraph 5 of the Narcotics Act (373/2008) and containing a report based on the test stating whether the employee has used drugs for non-medicinal purposes in a manner that has impaired his or her working capacity or functional capacity. (375/2008) Drug tests and the certificates of such tests are subject to the provisions of section 19 of the Occupational Health Care Act.

*

Section 7 Submission of a drug test certificate during recruitment 

The employer may receive or otherwise process data entered in a drug test certificate, with the consent of the applicant selected for the job, only if the applicant is to do the type of work that requires precision, reliability, independent judgement or good ability to react and if performing the work while under the influence of drugs or while addicted to drugs could:

1) endanger the life, health or occupational safety of the employee or other persons;  

2) endanger national defence or state security;

3) endanger traffic safety;

4) increase the risk of significant environmental damage;

5) endanger the protection, usability, integrity and quality of information received while working and thus cause harm or damage to public interests protected by confidentiality provisions or endanger the protection of privacy or the rights of data subjects; or

6) endanger a trade secret, or cause more than a minor level of financial loss to the employer or the employer’s customer, provided that endangering a trade secret or causing a financial risk could not be prevented by other means. (610/2018) 

The employer also has the right to process data with the job applicant’s consent, as referred to in subsection 1, in the event that:

1) the applicant is to carry out tasks in which special trust is required, in which work will be performed elsewhere than in premises supervised by the employer and in which the performance of duties while under the influence of drugs or while addicted to drugs may cause significant financial loss to a customer of the employer or endanger the customer’s personal safety; 

2) the applicant is to carry out tasks which, on a permanent basis and to a material degree, include raising, teaching, caring for or otherwise looking after a minor, or other work involving personal interaction with a minor, and no other person is involved; or

3) the applicant is to carry out the type of tasks in which there is independent and uncontrolled access to drugs or a more than minor quantity of medicines that could be used for the purposes of intoxication. 

The provisions of subsections 1 and 2 also apply if the employee’s duties change during the employment relationship in such a way that they meet the preconditions referred to above concerning the employer’s right to process data entered in a drug test certificate.  

Provisions on the submission of a drug test certificate to the employer as a precondition for appointment to a civil service post are laid down in section 8b of the State Civil Servants Act (750/1994) and, in the case of recruitment to a public sector service relationship, in section 7 of the Act on Civil Servants in Local Government (304/2003). Provisions on the action programme on substance abuse prevention are laid down in section 11 of the Occupational Health Care Act.  

*

Section 8 Submission of a drug test certificate during the employment relationship 

The employer may require the employee to present a drug test certificate during his or her employment relationship if the employer has a justified reason to suspect that the employee is under the influence of drugs at work or that the employee has a drug addiction and if testing is necessary to establish the employee’s working or functional capacity and the employee does the type of work that requires special precision, reliability, independent judgement or good ability to react and in which the performance of duties while under the influence of drugs or while addicted to drugs:  

1) seriously endangers the life, health or occupational safety of the employee or other persons;  

2) seriously endangers national defence or state security;

3) seriously endangers traffic safety;  

4) could considerably increase the risk of significant environmental damage;  

5) seriously endangers the protection, usability, integrity and quality of information received while working and could thus cause harm or damage to public interests protected by confidentiality provisions or endanger the protection of privacy or the rights of data subjects;  

6) endangers a financially significant trade secret or could cause a significant financial loss to the employer or the employer’s customer, provided that endangering the trade secret or causing a financial risk could not be prevented by other means; or (610/2018)

7) could significantly increase the risk of illegal trading in or spread of substances in the possession of the employer that are referred to in section 3, subsection 1, paragraph 5 of the Narcotics Act. (375/2008) 

The employer may impose on the employee a reasonable time limit within which the certificate must be presented. Provisions on the action programme on substance abuse prevention are laid down in section 11 of the Occupational Health Care Act.  

The employer also has the right to process data entered in a drug test certificate if, on the basis of a positive drug test result, the employee has pledged to undergo treatment for drug abuse and the processing of data in the certificate is related to monitoring implementation of the treatment.  

*

Section 9 The employer’s duty to provide information about a drug test certificate

The employer shall notify the job applicant in connection with the application procedure prior to the signing of an employment contract, or the employee prior to a change in the terms of his or her contract, that the work is such that the employer intends to process the data entered in a drug test certificate in accordance with section 7, or is such that the employer intends to require the employee to present a drug test certificate in accordance with section 8(2). 

*

Section 10 Cost of acquiring a certificate 

The employer shall meet the cost of acquiring certificates referred to in this Chapter which are submitted to it.

*

Section 11 Relation to the provisions on health examinations

The provisions of sections 7 and 8 will not prevent the taking of a drug test as a part of the job applicant’s or employee’s health examination performed by the occupational health care unit under the Occupational Health Care Act, the State Civil Servants Act or the Act on Civil Servants in Local Government. Provisions on information to be entered in the certificate issued following a health examination under the Occupational Health Care Act shall be laid down separately.  

*

Section 12 Application of the provisions to professional athletes

The provisions of this Chapter do not apply to athletes in an employment relationship referred to in Chapter 1, section 1, of the Employment Contracts Act (55/2001).  

*

Section 13 Personality and aptitude assessments 

With the employee’s consent, he or she can be tested by means of personality and aptitude assessments to establish his or her capacity to perform the work in question or his or her need for training and other occupational development. The employer shall ensure that the assessment methods used are reliable, the persons conducting the assessment are experts, and the findings of the assessment are free from error. When checking that the findings are free from error, the assessment method used and the nature of the assessment method must be taken into account.  

Upon request, the employer or an assessor designated by the employer shall provide the employee concerned with a written statement on the assessment of the employee’s personality or aptitude free of charge. If the employer has received the statement orally, the employee must be informed of its content. 

*

Section 14 Use of health care services

When carrying out employees health examinations and tests and taking samples, health care professionals, properly trained laboratory personnel and health care services must be used as provided in the health care legislation. The provisions of subsection 1 also apply to alcohol and drug tests. 

*

Section 15 Genetic testing

The employer is not permitted to require the employee to take part in genetic testing during recruitment or during the employment relationship, and has no right to know whether or not the employee has ever taken part in such testing. 

*

Section 16 Preconditions for camera surveillance

The employer may operate a system of continuous surveillance within its premises based on the use of technical equipment which transmits or records images (camera surveillance) for the purpose of ensuring the personal security of employees and other persons on the premises, protecting property or supervising the proper operation of production processes, and for preventing or investigating situations that endanger safety, property or the production process. Camera surveillance may not, however, be used for the surveillance of a particular employee or particular employees in the workplace. Neither may camera surveillance be used in lavatories, changing rooms or other similar places, in other staff facilities or in work rooms designated for the personal use of employees. 

Notwithstanding subsection 1, the employer may, however, direct the camera surveillance at a particular work station where employees are at work if the surveillance is essential for:

1) preventing an apparent threat of violence related to the work of the employee or an apparent harm or danger to the employee’s safety or health;  

2) preventing or investigating property crimes if an essential part of the employee’s work is to handle property of high value or quality, such as money, securities or valuables; or  

3) safeguarding the employee’s interests and rights, where the camera surveillance is based on the request of the employee who is to be the subject of the surveillance. (347/2019) 

*

Section 17 Transparency when implementing camera surveillance

When planning and implementing camera surveillance, the employer shall ensure that:

1) the opportunity of using other means that interfere less with the privacy of employees is explored before the introduction of camera surveillance;  

2) the privacy of employees is not interfered with more than is necessary for achieving the aim of the measures;  

3) paragraph was repealed by Act 347/2019  

4) recordings are used only for the purpose for which the surveillance was carried out;

5) after the cooperative and consultative procedures referred to in section 21, employees are informed of when the camera surveillance will begin, how it will be implemented, how and in what situations any recordings would be used and, in situations referred to in section 16 subsection 2, the locations of the cameras; and  

6) prominent notification of the camera surveillance and its method of implementation is displayed in the areas in which the cameras are located. 

Notwithstanding subsection 1, paragraph 4 and section 21, the employer has the right to use recordings for:  

1) substantiating the grounds for termination of an employment relationship;  

2) investigating and substantiating harassment or molestation as referred to in the Act on Equality Between Women and Men (609/1986), harassment referred to in section 14 of the Non-Discrimination Act (1325/2014) or harassment and inappropriate behaviour as referred to in the Occupational Safety and Health Act (738/2002), provided that the employer has a justified reason to suspect that the employee is guilty of harassment, molestation or inappropriate behaviour; or (1345/2014)

3) investigating an occupational accident or some other situation causing a danger or threat referred to in the Occupational Safety and Health Act.  

Recordings shall be destroyed as soon as they are no longer necessary for achieving the purpose of the camera surveillance, and no later than one year after the end of the recording. A recording may, however, be stored after this period if it is needed for completing the processing of a matter referred to in subsection 2 that emerged for investigation before the end of the maximum storage period or if the employer needs the recording to substantiate the appropriateness of terminating an employment relationship, or if there is some other special reason for keeping the recording.  

*

Section 18 The employer’s obligations regarding necessary arrangements

The employer has the right to retrieve and open electronic mail messages sent to an electronic mail address allocated by the employer for the use of the employee or electronic mail messages sent by the employee from such an address only if the employer has planned and arranged for the employee the necessary measures to protect electronic mail messages sent in the employee’s name or by the employee and, to this end, has specifically ensured that:

1) the employee can, with the aid of the electronic mail system’s automatic reply function, send notification to a message sender about his or her absence and the length of absence, and information about the person who is to take care of the tasks of the absent employee; or

2) the employee can direct messages to another person approved by the employer for this task or to another employer-approved address of the employee; or  

3) the employee can give his or her consent to an arrangement whereby in his or her absence another person of his or her choosing and approved by the employer for the task can receive messages sent to the employee, with the aim of establishing whether the employee has been sent a message that is clearly intended for the employer for the purpose of managing the work and on which it is essential for the employer to have information on account of its operations or the appropriate organisation of the work.  

The provisions of sections 19 and 20 constitute further preconditions for the retrieval or opening of the electronic mail messages referred to in subsection 1 above.  

*

Section 19 Retrieval of electronic messages belonging to the employer

The employer has the right, assisted by the person vested with the authority of information system administrator, to find out on the basis of information concerning the message sender, recipient or title, whether the employee has, in his or her absence, been sent, or has sent or received immediately before the absence, messages belonging to the employer that, in order to complete negotiations concerning its operations or to serve customers or safeguard its operations, it is otherwise essential for the employer to gain information on, if:  

1) the employee manages tasks independently on behalf of the employer and the employer does not operate a system with which the matters attended to by the employee and the processing stages involved are recorded or are otherwise ascertained;

2) it is evident, on account of the employee’s tasks and matters pending, that messages belonging to the employer have been sent or received;

3) the employee is temporarily prevented from performing his or her duties, and messages belonging to the employer cannot be obtained for the employer’s  use despite the fact that the employer has seen to the obligations referred to in section 18; and  

4) the employee’s consent cannot be obtained within a reasonable time and the investigation of the matter cannot be delayed.  

If the employee has died or if he or she is prevented in a permanent way from performing his or her duties and his or her consent cannot be obtained, the employer has the right, under the conditions laid down in subsection 1(1-2) and on the basis of information on the message sender, recipient or title, to find out if there are messages belonging to it, unless finding out about the matters attended to by the employee and safeguarding of the employer’s operations is possible by other means.

If message retrieval does not lead to opening of the message, a report signed by the persons involved stating why the message was retrieved, the time it was retrieved and who performed the retrieval must be drawn up. The report shall be submitted to the employee without undue delay, unless otherwise provided by subsection 2. The information on the message sender, recipient or title may not be processed more extensively than necessary for the purpose of retrieving the message, and the persons processing the information may not disclose it to a third party during the employment relationship or after it has ended.  

*

Section 20 Opening of electronic messages belonging to the employer 

If, on the basis of the information on the sender or recipient of an electronic message or the message title, it is apparent that a message sent to the employee or by the employee is clearly one that belongs to the employer and about whose content it is essential that the employer obtains information in order to complete negotiations concerning its operations or to serve customers or safeguard its operations, and the message sender and recipient cannot be contacted for the purpose of establishing the content of the message or for the purpose of sending it to an address indicated by the employer, the employer may, in cases referred to in section 19, open the message with the assistance of the person vested with the authority of information system administrator and in the presence of another person. 

A report about the opening shall be drawn up, signed by the persons involved, stating which message was opened, why it was opened, the time of opening, the persons performing the opening and to whom the information on the content of the opened message was given. The report shall be submitted to the employee without undue delay, unless otherwise provided by section 19 subsection 2. The opened message shall be stored, and its content and the information on the sender may not be processed more extensively than is necessary for the purpose of opening the message, nor may the persons processing the information disclose the content of the message to a third party during the employment relationship or after it has ended. 

The person employed by the employer or a person acting on the instruction of the former, to whom the employee has directed his or her electronic mail in the manner referred to in section 18 subsection 1 paragraph 2 or who can, in the manner referred to in section 18 subsection 1 paragraph 3, and with the employee’s consent, receive messages sent in the employee’s name, has the right to open a message, complying with the provisions of subsection 2, unless the employee has given his or her consent to another procedure. 

*

Section 21 Cooperation in organising technical monitoring and data network use

The purpose, implementation, and methods of camera surveillance, access control, and other technical monitoring directed at employees, as well as the use of email and other information networks, and the processing of data concerning an employee's email and other electronic communications, are subject to the dialogue referred to in the Act on Co-operation within Undertakings and the Act on Co-operation within the Evangelical Lutheran Church of Finland, as well as the co-operation procedure referred to in the Act on Co-operation within Government Agencies and Institutions and the Act on Co-operation between Employer and Personnel in Municipalities and Wellbeing Services Counties. In companies and public corporations not covered by the co-operation legislation, the employer shall, prior to decision-making, reserve the employees or their representatives an opportunity to be heard regarding the aforementioned matters. (24.10.2025/945)

After the procedure referred to in subsection 1, the employer shall define the purpose and methods of the technical monitoring directed at employees and inform the employees of the purpose, implementation, and methods of the monitoring, as well as the use of email and information networks.

*

Section 22 (347/2019) Supervision

Compliance with this Act shall be supervised by the occupational health and safety authorities within their competence together with the Data Protection Ombudsman. Provisions on the tasks and the competence of the Data Protection Ombudsman are laid down in Articles 55–59 of the Data Protection Regulation and section 14 of the Data Protection Act. Chapters 2 and 3 of the Act on Occupational Safety and Health Enforcement and Cooperation on Safety and Health at Workplaces (44/2006) lay down provisions on the competence of the occupational safety and health authorities.

*

Section 23 Display

The employer shall make this Act freely available to employees at the place of work. 

 
Old law close

Act on the Protection of Privacy in Working Life (759/2004), (as it is in force April 15, 2026)

Section 1 Purpose of the Act

The purpose of this Act is to promote the protection of privacy and other fundamental rights safeguarding the protection of privacy in working life. 

*

Section 2 Scope of application

This Act lays down provisions on the processing of personal data concerning employees, the performance of tests and examinations on employees and the related requirements, technical surveillance in the workplace, and retrieving and opening employees’ electronic mail messages.

The provisions of this Act concerning employees also apply to civil servants and any persons in a civil service relationship or comparable service relationship subject to public law, and, as appropriate, to job applicants.

In addition to what is provided in this Act, regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter Data Protection Regulation, contains provisions regarding the processing of employees’ personal data. 

Unless otherwise provided in this Act, the provisions of the Data Protection Act (1050/2018) shall also apply to the processing of personal data. Part VI of the Act on  Electronic Communications Services (917/2014) contains provisions regarding the confidentiality of communications and the protection of privacy. (347/2019)

The employee’s obligation to undergo a health examination is governed by separate provisions. 

*

Section 3 Necessity requirement  

The employer is only allowed to process personal data directly necessary for the employee’s employment relationship, which is connected with managing the rights and obligations of the parties to the employment relationship or with the benefits provided by the employer for the employee or which arises from the special nature of the work concerned.

No exceptions can be made to the necessity requirement, even with the employee’s consent. 

*

Section 4 (347/2019) General preconditions for collecting personal data concerning employees and the employer's duty to provide information

The employer shall collect personal data concerning the employee primarily from the employee himself or herself. In order to collect personal data from elsewhere, the employer must obtain the consent of the employee. However, this consent is not required when an authority discloses information to the employer to enable the latter to fulfil a statutory duty, or if it is expressly separately provided by law on collecting or obtaining data. The Security Clearance Act (726/2014) contains provisions regarding requests for security clearance. The Act on Checking the Criminal Background of Persons Working with Children (504/2002) contains provisions laying out the procedure to be followed when checking the criminal background of persons appointed to work with minors. Provisions on the right to obtain data from the criminal records are laid down in the Criminal Records Act (770/1993). 

The employer shall notify the employee in advance that data concerning the employee will be collected in order to establish his or her reliability. If the employer acquires personal credit data on an employee, the employer must also notify the employee of the register from which the credit data are obtained. If data concerning the employee has been collected from a source other than the employee himself or herself, the employer must notify the employee of this data before it is used in making decisions concerning the employee. Chapter III of the Data Protection Regulation contains provisions regarding the obligation of the controller to provide information to the data subject and regarding the right of access by the data subject. 

The collection of personal data during recruitment and during an employment relationship is governed by the co-operation procedure referred to in the Act on Co-operation within Undertakings (334/2007), the Act on Cooperation in Government Agencies and Public Bodies (1233/2013), and the Act on Cooperation between the Employer and Employees in Municipalities (449/2007). 

*

Section 5 Processing data concerning health

The employer has the right to process data concerning the employee's health status if the data has been collected from the employee himself or herself, or elsewhere with the employee’s written consent, and the data needs to be processed in order to pay sick pay or other comparable health-related benefits or to establish whether there is a justified reason for absence or if the employee expressly wishes his or her working capacity to be assessed on the basis of data concerning his or her health. In addition, the employer has the right to process such data in the specific circumstances, and to the stipulated extent, separately provided elsewhere in the law.  

Data concerning the employee's health may only be processed by persons who prepare, make or implement decisions concerning employment relationships on the basis of such data. The employer shall nominate such persons or specify the tasks that involve processing of the data concerning health. Persons who process such data may not disclose any of it to a third party either during or after their employment relationship.

A doctor’s certificate or statement concerning the employee’s working capacity given to the employer by the employee may, however, be supplied to the occupational health service provider for the purpose of carrying out the occupational health care duties laid down in the Occupational Health Care Act (1383/2001), unless the employee has forbidden this.

The employer must store any data in its possession concerning the employee's health separately from any other personal data that it has collected. Data concerning health shall be erased immediately after the grounds for processing referred to in paragraph 1 have ceased to exist. The grounds and necessity of processing shall be evaluated at least every five years. (347/2019) 

*

Section 5 a (511/2008)  Processing of personal credit data 

The employer has the right to obtain and use personal credit data referred to in section 4 of the Credit Information Act (527/2007) concerning a job applicant selected for a position for the purpose of assessing the job applicant’s reliability when the intention is that the applicant will work in duties that require particular reliability and

1) that involve the power to make significant financial commitments on behalf of the employer or to use de facto independent discretionary power in the preparation of such commitments;

2) in which the employee’s specific duty is to grant and control financially significant credits;  

3) in the administration of which the employee is given access to specially protected trade secrets of key significance for the employer or its customer; (610/2018) 

4) that require access rights to information systems that will allow the transfer of the employer’s or its customer’s funds, or modify the related information, or in which the employee is granted system administrator rights to such an information system;

5) that essentially involve the processing, without any immediate supervision, of large amounts of money, or securities or valuable items;

6) that involve the guarding of the employer’s or its customer’s property;

7) that, as a rule, involve working in a private home without supervision. 

The provisions of subsection 1 shall also apply if the employee’s duties change during the employment relationship in such a way that they fulfil the preconditions laid down in the stated subsection concerning the employer’s right to handle personal credit data.

The employer is responsible for the costs of obtaining the personal credit data.

Section 19, subsection 2, paragraph 9 of the Credit Information Act contains provisions regarding the right to use personal credit data when a person is selected into a position of responsibility in a company. 

*

Section 6 Drug test certificate

The employer may only process data on the drug use testing of the employee which is contained in the drug test certificate supplied to the employer by the person concerned. The processing of the data is otherwise subject to the provisions of section 5(2-4).  

A drug test certificate means a certificate issued by a health care professional and laboratory designated by the employer stating that the employee has been tested for the use of a drug referred to in section 3, subsection 1, paragraph 5 of the Narcotics Act (373/2008) and containing a report based on the test stating whether the employee has used drugs for non-medicinal purposes in a manner that has impaired his or her working capacity or functional capacity. (375/2008) Drug tests and the certificates of such tests are subject to the provisions of section 19 of the Occupational Health Care Act.

*

Section 7 Submission of a drug test certificate during recruitment 

The employer may receive or otherwise process data entered in a drug test certificate, with the consent of the applicant selected for the job, only if the applicant is to do the type of work that requires precision, reliability, independent judgement or good ability to react and if performing the work while under the influence of drugs or while addicted to drugs could:

1) endanger the life, health or occupational safety of the employee or other persons;  

2) endanger national defence or state security;

3) endanger traffic safety;

4) increase the risk of significant environmental damage;

5) endanger the protection, usability, integrity and quality of information received while working and thus cause harm or damage to public interests protected by confidentiality provisions or endanger the protection of privacy or the rights of data subjects; or

6) endanger a trade secret, or cause more than a minor level of financial loss to the employer or the employer’s customer, provided that endangering a trade secret or causing a financial risk could not be prevented by other means. (610/2018) 

The employer also has the right to process data with the job applicant’s consent, as referred to in subsection 1, in the event that:

1) the applicant is to carry out tasks in which special trust is required, in which work will be performed elsewhere than in premises supervised by the employer and in which the performance of duties while under the influence of drugs or while addicted to drugs may cause significant financial loss to a customer of the employer or endanger the customer’s personal safety; 

2) the applicant is to carry out tasks which, on a permanent basis and to a material degree, include raising, teaching, caring for or otherwise looking after a minor, or other work involving personal interaction with a minor, and no other person is involved; or

3) the applicant is to carry out the type of tasks in which there is independent and uncontrolled access to drugs or a more than minor quantity of medicines that could be used for the purposes of intoxication. 

The provisions of subsections 1 and 2 also apply if the employee’s duties change during the employment relationship in such a way that they meet the preconditions referred to above concerning the employer’s right to process data entered in a drug test certificate.  

Provisions on the submission of a drug test certificate to the employer as a precondition for appointment to a civil service post are laid down in section 8b of the State Civil Servants Act (750/1994) and, in the case of recruitment to a public sector service relationship, in section 7 of the Act on Civil Servants in Local Government (304/2003). Provisions on the action programme on substance abuse prevention are laid down in section 11 of the Occupational Health Care Act.  

*

Section 8 Submission of a drug test certificate during the employment relationship 

The employer may require the employee to present a drug test certificate during his or her employment relationship if the employer has a justified reason to suspect that the employee is under the influence of drugs at work or that the employee has a drug addiction and if testing is necessary to establish the employee’s working or functional capacity and the employee does the type of work that requires special precision, reliability, independent judgement or good ability to react and in which the performance of duties while under the influence of drugs or while addicted to drugs:  

1) seriously endangers the life, health or occupational safety of the employee or other persons;  

2) seriously endangers national defence or state security;

3) seriously endangers traffic safety;  

4) could considerably increase the risk of significant environmental damage;  

5) seriously endangers the protection, usability, integrity and quality of information received while working and could thus cause harm or damage to public interests protected by confidentiality provisions or endanger the protection of privacy or the rights of data subjects;  

6) endangers a financially significant trade secret or could cause a significant financial loss to the employer or the employer’s customer, provided that endangering the trade secret or causing a financial risk could not be prevented by other means; or (610/2018)

7) could significantly increase the risk of illegal trading in or spread of substances in the possession of the employer that are referred to in section 3, subsection 1, paragraph 5 of the Narcotics Act. (375/2008) 

The employer may impose on the employee a reasonable time limit within which the certificate must be presented. Provisions on the action programme on substance abuse prevention are laid down in section 11 of the Occupational Health Care Act.  

The employer also has the right to process data entered in a drug test certificate if, on the basis of a positive drug test result, the employee has pledged to undergo treatment for drug abuse and the processing of data in the certificate is related to monitoring implementation of the treatment.  

*

Section 9 The employer’s duty to provide information about a drug test certificate

The employer shall notify the job applicant in connection with the application procedure prior to the signing of an employment contract, or the employee prior to a change in the terms of his or her contract, that the work is such that the employer intends to process the data entered in a drug test certificate in accordance with section 7, or is such that the employer intends to require the employee to present a drug test certificate in accordance with section 8(2). 

*

Section 10 Cost of acquiring a certificate 

The employer shall meet the cost of acquiring certificates referred to in this Chapter which are submitted to it.

*

Section 11 Relation to the provisions on health examinations

The provisions of sections 7 and 8 will not prevent the taking of a drug test as a part of the job applicant’s or employee’s health examination performed by the occupational health care unit under the Occupational Health Care Act, the State Civil Servants Act or the Act on Civil Servants in Local Government. Provisions on information to be entered in the certificate issued following a health examination under the Occupational Health Care Act shall be laid down separately.  

*

Section 12 Application of the provisions to professional athletes

The provisions of this Chapter do not apply to athletes in an employment relationship referred to in Chapter 1, section 1, of the Employment Contracts Act (55/2001).  

*

Section 13 Personality and aptitude assessments 

With the employee’s consent, he or she can be tested by means of personality and aptitude assessments to establish his or her capacity to perform the work in question or his or her need for training and other occupational development. The employer shall ensure that the assessment methods used are reliable, the persons conducting the assessment are experts, and the findings of the assessment are free from error. When checking that the findings are free from error, the assessment method used and the nature of the assessment method must be taken into account.  

Upon request, the employer or an assessor designated by the employer shall provide the employee concerned with a written statement on the assessment of the employee’s personality or aptitude free of charge. If the employer has received the statement orally, the employee must be informed of its content. 

*

Section 14 Use of health care services

When carrying out employees health examinations and tests and taking samples, health care professionals, properly trained laboratory personnel and health care services must be used as provided in the health care legislation. The provisions of subsection 1 also apply to alcohol and drug tests. 

*

Section 15 Genetic testing

The employer is not permitted to require the employee to take part in genetic testing during recruitment or during the employment relationship, and has no right to know whether or not the employee has ever taken part in such testing. 

*

Section 16 Preconditions for camera surveillance

The employer may operate a system of continuous surveillance within its premises based on the use of technical equipment which transmits or records images (camera surveillance) for the purpose of ensuring the personal security of employees and other persons on the premises, protecting property or supervising the proper operation of production processes, and for preventing or investigating situations that endanger safety, property or the production process. Camera surveillance may not, however, be used for the surveillance of a particular employee or particular employees in the workplace. Neither may camera surveillance be used in lavatories, changing rooms or other similar places, in other staff facilities or in work rooms designated for the personal use of employees. 

Notwithstanding subsection 1, the employer may, however, direct the camera surveillance at a particular work station where employees are at work if the surveillance is essential for:

1) preventing an apparent threat of violence related to the work of the employee or an apparent harm or danger to the employee’s safety or health;  

2) preventing or investigating property crimes if an essential part of the employee’s work is to handle property of high value or quality, such as money, securities or valuables; or  

3) safeguarding the employee’s interests and rights, where the camera surveillance is based on the request of the employee who is to be the subject of the surveillance. (347/2019) 

*

Section 17 Transparency when implementing camera surveillance

When planning and implementing camera surveillance, the employer shall ensure that:

1) the opportunity of using other means that interfere less with the privacy of employees is explored before the introduction of camera surveillance;  

2) the privacy of employees is not interfered with more than is necessary for achieving the aim of the measures;  

3) paragraph was repealed by Act 347/2019  

4) recordings are used only for the purpose for which the surveillance was carried out;

5) after the cooperative and consultative procedures referred to in section 21, employees are informed of when the camera surveillance will begin, how it will be implemented, how and in what situations any recordings would be used and, in situations referred to in section 16 subsection 2, the locations of the cameras; and  

6) prominent notification of the camera surveillance and its method of implementation is displayed in the areas in which the cameras are located. 

Notwithstanding subsection 1, paragraph 4 and section 21, the employer has the right to use recordings for:  

1) substantiating the grounds for termination of an employment relationship;  

2) investigating and substantiating harassment or molestation as referred to in the Act on Equality Between Women and Men (609/1986), harassment referred to in section 14 of the Non-Discrimination Act (1325/2014) or harassment and inappropriate behaviour as referred to in the Occupational Safety and Health Act (738/2002), provided that the employer has a justified reason to suspect that the employee is guilty of harassment, molestation or inappropriate behaviour; or (1345/2014)

3) investigating an occupational accident or some other situation causing a danger or threat referred to in the Occupational Safety and Health Act.  

Recordings shall be destroyed as soon as they are no longer necessary for achieving the purpose of the camera surveillance, and no later than one year after the end of the recording. A recording may, however, be stored after this period if it is needed for completing the processing of a matter referred to in subsection 2 that emerged for investigation before the end of the maximum storage period or if the employer needs the recording to substantiate the appropriateness of terminating an employment relationship, or if there is some other special reason for keeping the recording.  

*

Section 18 The employer’s obligations regarding necessary arrangements

The employer has the right to retrieve and open electronic mail messages sent to an electronic mail address allocated by the employer for the use of the employee or electronic mail messages sent by the employee from such an address only if the employer has planned and arranged for the employee the necessary measures to protect electronic mail messages sent in the employee’s name or by the employee and, to this end, has specifically ensured that:

1) the employee can, with the aid of the electronic mail system’s automatic reply function, send notification to a message sender about his or her absence and the length of absence, and information about the person who is to take care of the tasks of the absent employee; or

2) the employee can direct messages to another person approved by the employer for this task or to another employer-approved address of the employee; or  

3) the employee can give his or her consent to an arrangement whereby in his or her absence another person of his or her choosing and approved by the employer for the task can receive messages sent to the employee, with the aim of establishing whether the employee has been sent a message that is clearly intended for the employer for the purpose of managing the work and on which it is essential for the employer to have information on account of its operations or the appropriate organisation of the work.  

The provisions of sections 19 and 20 constitute further preconditions for the retrieval or opening of the electronic mail messages referred to in subsection 1 above.  

*

Section 19 Retrieval of electronic messages belonging to the employer

The employer has the right, assisted by the person vested with the authority of information system administrator, to find out on the basis of information concerning the message sender, recipient or title, whether the employee has, in his or her absence, been sent, or has sent or received immediately before the absence, messages belonging to the employer that, in order to complete negotiations concerning its operations or to serve customers or safeguard its operations, it is otherwise essential for the employer to gain information on, if:  

1) the employee manages tasks independently on behalf of the employer and the employer does not operate a system with which the matters attended to by the employee and the processing stages involved are recorded or are otherwise ascertained;

2) it is evident, on account of the employee’s tasks and matters pending, that messages belonging to the employer have been sent or received;

3) the employee is temporarily prevented from performing his or her duties, and messages belonging to the employer cannot be obtained for the employer’s  use despite the fact that the employer has seen to the obligations referred to in section 18; and  

4) the employee’s consent cannot be obtained within a reasonable time and the investigation of the matter cannot be delayed.  

If the employee has died or if he or she is prevented in a permanent way from performing his or her duties and his or her consent cannot be obtained, the employer has the right, under the conditions laid down in subsection 1(1-2) and on the basis of information on the message sender, recipient or title, to find out if there are messages belonging to it, unless finding out about the matters attended to by the employee and safeguarding of the employer’s operations is possible by other means.

If message retrieval does not lead to opening of the message, a report signed by the persons involved stating why the message was retrieved, the time it was retrieved and who performed the retrieval must be drawn up. The report shall be submitted to the employee without undue delay, unless otherwise provided by subsection 2. The information on the message sender, recipient or title may not be processed more extensively than necessary for the purpose of retrieving the message, and the persons processing the information may not disclose it to a third party during the employment relationship or after it has ended.  

*

Section 20 Opening of electronic messages belonging to the employer 

If, on the basis of the information on the sender or recipient of an electronic message or the message title, it is apparent that a message sent to the employee or by the employee is clearly one that belongs to the employer and about whose content it is essential that the employer obtains information in order to complete negotiations concerning its operations or to serve customers or safeguard its operations, and the message sender and recipient cannot be contacted for the purpose of establishing the content of the message or for the purpose of sending it to an address indicated by the employer, the employer may, in cases referred to in section 19, open the message with the assistance of the person vested with the authority of information system administrator and in the presence of another person. 

A report about the opening shall be drawn up, signed by the persons involved, stating which message was opened, why it was opened, the time of opening, the persons performing the opening and to whom the information on the content of the opened message was given. The report shall be submitted to the employee without undue delay, unless otherwise provided by section 19 subsection 2. The opened message shall be stored, and its content and the information on the sender may not be processed more extensively than is necessary for the purpose of opening the message, nor may the persons processing the information disclose the content of the message to a third party during the employment relationship or after it has ended. 

The person employed by the employer or a person acting on the instruction of the former, to whom the employee has directed his or her electronic mail in the manner referred to in section 18 subsection 1 paragraph 2 or who can, in the manner referred to in section 18 subsection 1 paragraph 3, and with the employee’s consent, receive messages sent in the employee’s name, has the right to open a message, complying with the provisions of subsection 2, unless the employee has given his or her consent to another procedure. 

*

Section 21 Cooperation in organising technical monitoring and data network use

The purpose, implementation, and methods of camera surveillance, access control, and other technical monitoring directed at employees, as well as the use of email and other information networks, and the processing of data concerning an employee's email and other electronic communications, are subject to the dialogue referred to in the Act on Co-operation within Undertakings and the Act on Co-operation within the Evangelical Lutheran Church of Finland, as well as the co-operation procedure referred to in the Act on Co-operation within Government Agencies and Institutions and the Act on Co-operation between Employer and Personnel in Municipalities and Wellbeing Services Counties. In companies and public corporations not covered by the co-operation legislation, the employer shall, prior to decision-making, reserve the employees or their representatives an opportunity to be heard regarding the aforementioned matters. (24.10.2025/945)

After the procedure referred to in subsection 1, the employer shall define the purpose and methods of the technical monitoring directed at employees and inform the employees of the purpose, implementation, and methods of the monitoring, as well as the use of email and information networks.

*

Section 22 (347/2019) Supervision

Compliance with this Act shall be supervised by the occupational health and safety authorities within their competence together with the Data Protection Ombudsman. Provisions on the tasks and the competence of the Data Protection Ombudsman are laid down in Articles 55–59 of the Data Protection Regulation and section 14 of the Data Protection Act. Chapters 2 and 3 of the Act on Occupational Safety and Health Enforcement and Cooperation on Safety and Health at Workplaces (44/2006) lay down provisions on the competence of the occupational safety and health authorities.

*

Section 23 Display

The employer shall make this Act freely available to employees at the place of work. 
arrow_back Previous Article • Article 88 Next Article arrow_forward
close

2016 - www.itiplaw.eu.