By Tirthesh Shah and Ayushi Modi 

This article gives an overview of Data Protection regime over the employee’s personal data collected by the employer/ organization in the course of employment. It is a recommended read for the HR Personnels, Recruitment firms, Payroll management and C-suite stakeholders.

Introduction

In every organization whether large, medium, small and even in technology/ automation driven company manpower plays a vital role. Starting from recruitment process, numerous types of personal data like name, contact details, address, e-mail id, identification numbers, qualifications, medical information, salary/ pay slips, family details and biometric information is collected and processed for the streamlined purposes like onboarding, employee benefits, pension, gratuity, statutory reporting, performance evaluation etc. Such information’s are mandated to be protected by the organization (i.e. collector or processor) under various employment laws and data protection laws either by virtue of existence in the region or by processing the data of individual.

Risks of Non compliance

Non-compliance of legislation can result in hefty fines from authorities and can hamper the reputation amongst customer and employees. For instance, under the EU-GDPR fines can be sanctioned up to EUR 20 million or 4 percent of the worldwide turnover. In the year 2020, the Data Protection Authority of Hamburg, Germany sanctioned one of the largest GDPR fine on H&M a clothing retailer, EUR 35 million for illegal monitoring of employees[1]. In a recently published report by DLA Piper, the year 2021 topped the data protection fines which totaled to approx. USD 1.2 billion[2].

Key regulatory frameworks — Globally

EU — General Data Protection Regulations (GDPR)

As per Article 6 of the EU-GDPR, employers can process the data of employees on the basis of either a contract or for the legitimate purposes of the business. Further, Article 88 of the EU-GDPR, further covers processing of personal data in the context of employment which states that Member states can provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context.[3]

US — California Consumer Privacy Act (CCPA)

Under Section 1798.145(h)(3) of the CCPA, since Jan. 1, 2020, a notice must be provided to employees by employers, at or before the point of the collection of personal information. Further, Section 1798.100(b) read along with CCPA Regulation Section 999.305.(f) this notice to employees needs to include information such as the categories of personal data and the purpose of collection. Under Section 1798.150 businesses are liable for undertaking adequate and reasonable security measures to protect the data of their employees. However, there are certain exemption provided under the CCPA on collection of employee personal data.’[4]

Canada — Personal Information Protection and Electronic Documents Act (PIPEDA)

Section 4(1)(b) of PIPEDA applies to every organization operating in the private sector, in respect of personal information that ‘is about an employee of, or an applicant for employment with, the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.’[5] PIPEDA does not apply to employee information in provincially-regulated organizations.[6]

However, organizations in the private sector are required to adhere to the applications of the Act. As per Section 4.7.4, ‘Organizations shall make their employees aware of the importance of maintaining the confidentiality of personal information.’

Brazil — Lei Geral de Proteção de Dados Pessoais (LGPD)

Article 17 of LGPD provides assured ownership of her/his personal data, with the fundamental rights of freedom, intimacy and privacy being guaranteed, under the terms of this Law. Further, Article 18 of the LGPD requires organizations to immediately adopt and fulfill employee DSR requests without cost to the employee, within a given time period and according to the terms provided in regulation.[7]

Rights of Employees

Amongst the protection provided, few legislations also provide for rights to current and/ or former employees for protection over their personal data which can be exercised, such as:

· Right to Withdraw their Consent

· Right to Information

· Right of Access

· Right to Correction or Rectification

· Right to Data portability

· Right to Object

· Right to Automated individual decision-making including profiling

Compliance action points

Any personal data collected by an employer in the course of their employment is protected under data protection laws. Hence, it lays an obligation on the employers to ensure appropriate security measures and practices in place. Few of the key measures which can be adopted are as follows:

• Defining the purpose of data collection and processing

• Formulation and implementation of privacy policies, forms, code of conduct and procedures

• Training and sensitization on data protection and privacy laws

• Provide a grievance redressal mechanism for employees

[1] https://datenschutz-hamburg.de/assets/pdf/2020-10-01-press-release-h+m-fine.pdf and https://www.tessian.com/blog/biggest-gdpr-fines-2020/

[2] https://www.dlapiper.com/en/us/insights/publications/2022/1/dla-piper-gdpr-fines-and-data-breach-survey-2022/

[3] https://gdpr-info.eu/art-88-gdpr/

[4] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201920200AB1281

[5] https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html

[6] https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/

[7]https://iapp.org/media/pdf/resource_center/Brazilian_General_Data_Protection_Law.pdf

Disclaimer: Nothing herein should be construed as a legal advice. The information provided on this website does not, and is not intended to, constitute legal advice; instead, all information, content, and materials available on this site are for general informational purposes only. Information on this website may not constitute the most up-to-date legal or other information.