After a somewhat slow start, the General Data Protection Regulation (GDPR) is now more alive than ever. It has moved from being that new buzzword legislation with those extremely high fines to a real-life challenge that is rating high on organizations\u2019 risk radar.<\/p>\n
Individuals have started to exercise their GDPR-related rights, the Belgian data protection authority (DPA) has started investigations and the DPA\u2019s Litigation Chamber is more active than ever. The Litigation Chamber\u2019s decisions, which can be found on the DPA\u2019s website (NL<\/a> \/ FR)<\/a>, help us to understand how GDPR requirements should be put into practice, as do the judgments of the Belgian Market Court (NL<\/a> \/ FR<\/a>), which is the court of appeal for GDPR-related litigation.<\/p>\n The GDPR is all about rights and obligations. \u201cConsent\u201d and the \u201cright to be forgotten\u201d are the concepts that everyone seems to remember, but the GDPR is much more than that. In many cases, these concepts do not even apply, which makes GDPR-related discussions even more confusing. <\/p>\n GDPR in the HR context<\/strong><\/p>\n The HR context is a good example of an area where such confusions often arise. Imagine an employee who has just received his yearly performance review, and imagine that the review was not good at all, for the second year in a row. A third bad review could mean reorientation, or even dismissal. Now imagine that the said employee goes to HR asking for his performance reviews, or at least the last two, to be removed from his employee file, because \u201che has the right to be forgotten.\u201d How should you react?<\/p>\n Or imagine another employee refusing to use his badge when leaving the building to smoke his seventh cigarette of the day, because \u201cyou are monitoring his behavior\u201d and \u201che never gave his consent for you to do that.\u201d How should you react?<\/p>\n Or just imagine either of these employees asking you to show them the notes you made about them during the last management meeting in which their behavior and attitude were discussed, because they wish to \u201cexercise their right of access\u201d and are \u201centitled to see it all.\u201d How should you react?<\/p>\n HR departments struggle with this kind of question quite frequently. Add wanting to store the CV of a job applicant or wanting to access the mailbox of an ex-employee and you have some of the most frequently asked GDPR questions related to both ends of the employment relationship.<\/p>\n While GDPR compliance is very nuanced and requires you to document every step, there is a way to get a solid initial idea of your GDPR compliance position. While it cannot be compared to an in-depth legal analysis, carrying out the following high-level assessment will put you in good stead. It is based on the following three questions: (1) Do you have a solid legal basis? (2) Have you been transparent about what you are doing? and (3) Is what you are doing proportionate to why you are doing it?<\/p>\n Solid legal basis<\/strong><\/p>\n The processing of personal data is not lawful unless it has a solid legal basis. Whereas the list of possible legal grounds is already limited, these grounds are even more reduced in the HR context, where you basically have only three options: (a) entering into or executing the labor agreement; (b) complying with a legal obligation or (c) the employer\u2019s legitimate interests.<\/p>\n If you know that rights of individuals are directly linked to the legal basis, and if you realize that consent is not mentioned in the above list, you will understand why the abovementioned \u201cI never gave my consent to do that\u201d-discussion can cause more than a little confusion.<\/p>\n Indeed, consent is, in general, not considered to be a valid legal basis for the processing of employee data because of the very stringent requirements for valid consent: it has to be freely given, specific, informed and constitute an unambiguous indication of an individual\u2019s wishes. Due to the imbalance between the position of employer and employee, consent can hardly be \u201cfreely given.\u201d Or, in other words, the employee often doesn\u2019t really have an option to say \u201cno\u201d.<\/p>\n While there might be situations where the employee does have a real choice, using consent as the go-to legal basis is an absolute no-no in the HR context, as was demonstrated by the \u20ac150,000 fine imposed by the Greek data protection authority on one of the Big Four consultancy firms for relying on consent as the legal basis for the processing of employee data. The processing of the data was not per se<\/em> unlawful, but processing it based on consent (instead of, for example, necessity to execute the labor agreement or complying with a legal obligation) was.<\/p>\n Transparency<\/strong><\/p>\n European privacy rights saw the light largely as a reaction to the covert monitoring of individuals and the complete lack of privacy under the Nazi regime, and it is against that backdrop that privacy, and the protection of personal data a few decades later, became fundamental rights. Knowing who knows what about you and what they do with that information is key, also in the HR context.<\/p>\n This is when questions like \u201cWhat notes and comments are in my employee file?\u201d, \u201cWhat did manager X or colleague Y say about me?\u201d and the abovementioned \u201cI am entitled to see it all\u201d-discussions come into play.<\/p>\n \u201cWe cannot give you that information, because X and Y also have a right to privacy\u201d, was the standard reply that many organizations used to deny such access.<\/p>\n In its Decision 70\/2020<\/a>, the Belgian DPA confirmed that the right of access should indeed not adversely affect the rights or freedoms of others, but added that such considerations should not result in a refusal to provide the requested information. In other words, it is indeed the employer\u2019s responsibility to anonymize information and\/or delete personal data of other persons where required in order to protect their GDPR rights, but these GDPR rights cannot be used as a reason not to provide access to the employee file in a timely manner.<\/p>\n Another decision that is relevant to the HR context is Decision 15\/2021<\/a>, as it paints a good picture of how an employee\u2019s access request can be pushed to the limit.<\/p>\n A former employee requested a copy of all his performance reviews, a copy of all the pictures in which he appeared (pictures taken at corporate events, pictures on the intranet, etc.), a copy of all the emails in his inbox, a transcript of every comment about him in his employee file, and a copy of all IT log entries related to him.<\/p>\n The Litigation Chamber confirmed that the information should not be an exact copy of the original documents as they might contain personal data related to other individuals, but again underlined that there is no reason not to provide the requested information after appropriate anonymization. And the Litigation Chamber even added a takeaway: everyone making notes in an employee file should be aware that the employee in question can always request access to such information.<\/p>\n While in this case the Litigation Chamber agreed that the protection of trade secrets was a good reason not to provide a copy of all the emails, it should be noted that it did not agree with denying such access based on the fact (i) that the employee had access to his own emails and, thus, already knew what was in those emails, or (ii) that the rights of senders or addressees could be harmed (as these data could be anonymized), or (iii) that the secrecy of electronic communications protects the emails from having to be disclosed (as the employee was a party to these communications).<\/p>\n In this case there was no proof that pictures existed in which the employee could be identified, but one could imagine how, for example, team building pictures on the intranet could become an issue in a similar type of litigation. Does your organization have such pictures? <\/p>\n Furthermore, providing a copy of all IT logs was, in this case and under these specific circumstances, considered a disproportionate effort for the employer.<\/p>\n Proportionality <\/strong><\/p>\n There are a number of GDPR principles, with well-sounding names like purpose limitation or data minimization, but meeting these principles is always somehow linked to meeting the proportionality test: is the processing of the data proportionate to the purpose(s)? For example, it is the proportionality test that determines the appropriate retention time for a CV, what information you can put on an employee badge, and whether you can use the email address of former employees or obtain access to their emails for business continuity purposes.<\/p>\n While there is rarely a one-size-fits-all for GDPR compliance, regulatory guidance at least gives organizations an indication of how to apply the proportionality test in certain circumstances.<\/p>\n While the Belgian data protection authority provides detailed guidance (NL<\/a> \/ FR<\/a>) on the processing of personal data in the context of recruitment, it is the Dutch DPA that provides specific guidance<\/a> on data retention with respect to CVs of non-accepted applicants, stating that it is usual for an organization to delete all the information regarding non-accepted applicants at the latest four weeks after the closure of the recruitment process. If you think about how CVs end up in mailboxes and on the desks of the different decision makers and how such information is, thus, easily duplicated, meeting such requirement is certainly no mean feat.<\/p>\n And if you ask for consent (yes, an example of where it could work as a legal basis in the HR context) to keep the CV in your recruitment pool? A maximum retention period of one year is reasonable, according to the Dutch DPA. You might want to take this type of guidance into account before sending a job posting to all the people in your recruitment database\u2026<\/p>\n And what could go wrong with the data on an employee badge? Name, picture, etc. \u2013 all obvious information, no? Well, apart from basic security requirements like not having a branded employee badge (which looks nice, but you wouldn\u2019t put your home address on the key hanger of your home keys, right?) you will need to come up with a very good explanation of why an employee\u2019s name must be put on the badge if you are not entitled to ask him to show you his ID.<\/p>\n Or, in other words: what\u2019s the purpose of having a name on the badge if you can\u2019t compare it with an official document? Or, from a GDPR mindset point of view: why would you increase the risk of having more data if it is not strictly necessary for the purposes of control and security, purposes that can be met by having only a picture on the badge. <\/p>\n