Data Protection in the Workplace: Law and Limitations

During the COVID-19 pandemic, numerous questions have arisen regarding the processing of employees’ personal data by employers. In light of these challenges, the law has specified the way information is transmitted and has imposed penalties on employers who process personal data without the consent of their employees. This article explores the key aspects of this law and provides information on the obligations of employers and the rights of employees.

The Law and Data Protection

The law clearly emphasizes that data protection regulations must not be abused, even in extraordinary situations such as the COVID-19 pandemic. For all instances of processing employees’ personal data, a lawful basis for processing is required. There are six different legal bases, with an employee’s consent being just one of them. For example, employers often process employees’ data to fulfill their legal obligations, such as enrolling employees in health insurance or calculating their salaries. In these cases, employee consent is not necessary.

Principles of Data Processing

When processing data, employers are obligated to adhere to specific principles prescribed by the law. These principles include proportionality, necessity, transparency, accuracy, and lawfulness. Employers are also required to inform employees about the data they collect, the purpose of processing, and employees’ rights.

Transferring Data to Third Parties

In accordance with the law, employers can entrust the processing of data to third parties through a separate contract. This contract ensures that the data processor will comply with the law and the agreed-upon terms. Moreover, the data will be processed solely for the purpose already presented to the employee and for which consent has been given.

Employer Accountability

The law stipulates the responsibility of employers who fail to comply with legal requirements and who unauthorizedly transfer or misuse personal data. This accountability manifests itself in administrative and criminal liabilities for the employer. Violating the law can result in fines or imprisonment for up to one year. Additionally, employers may be liable to compensate employees for any harm caused.

Monitoring and Data Protection

The Commissioner for Information of Public Importance and Personal Data Protection is the supervisory authority responsible for ensuring compliance with data processing regulations by employers. Their role is crucial in upholding the right to personal data protection.

In conclusion, safeguarding employees’ personal data is a fundamental obligation of employers. The law rigorously regulates data processing and imposes penalties for non-compliance with legal provisions. Understanding these regulations and adhering to data processing principles by employers is essential for preserving the rights and privacy of employees.