Article 29 working party, Data Protection Law

The European Data Protection Board replaced the Article 29 working place.

Article 29 working party previously produced a helpful document surveillance of electronic communications in the workplace.

Workers have a right to privacy and data protection at work.

They have a legitimate expectation of a degree of privacy at work.

This is however balanced against employer rights.

Before an employer decides to monitor workers he/she must carry out an assessment regarding will there be monitoring transparency, it is necessary, is it fair to workers, is it proportionate to their concern.

If an employer wishes to use detection equipment, employees must know its happening, what is the purpose for this activity etc.

Article 8 of the European convention on fundamental freedoms provides for a right to private and family life. Article 8 references the right regarding in the ‘home’.

There has been much caselaw however regarding the extent of this article 8 right outside of the home.

In Halford v the UK it was concluded intercepting workers phone calls contravened article 8. Therefore the notion of ‘private life’ extended to outside of the home.

Surveillance at work can take place in many forms, such as, via email, internet access, paper etc.

Necessity

It is important for the employer to determine if employee monitoring is necessary.

Monitoring emails, internet use would have to be justified by exceptional circumstances. This could include for criminal activity regarding the worker.

Finality

Data collected must be only collected for a specific, legitimate, explicit purpose.#

Data must only be processed for the purpose it was intended.

Transparency

Employers have to be open, transparent with staff regarding monitoring activities.

It is necessary for an employer to provide a clear policy to the employees regarding any email or internet monitoring.

The who, the how, the where, the when, the reasons / purposes for a monitoring work activity must be detailed to employees. Covert surveillance flies in the face of transparency etc. so this matter has to treated very carefully in a workplace.

A worker like any other individual has a right of access to personal data related them being processed.

Legitimacy

Data processing of a persons data can only take place if there is a legitimate purpose.

A correct legitimate interest of the employer balancing fundamental rights of workers assessment must be done by the employer if monitoring workers is being considered.

Proportionality

Any employer seeking to monitor employers must have in mind for personal data matters that the principle of proportionality will apply. This means that the data processing must not be excessive, it must be relevant, it must be adequate and no more.

So blanket monitoring of all employee emails or internet use will not adhere to this principle.

Accuracy and Retention Data

Any personal data stored for a legitimate purpose must be accurate and kept up to date and not kept for longer than is necessary. Keeping data for a rainy day philosophy will generally not wash in terms of good data protection practice.

Security

 An employer has a legal obligation to ensure measures are in place regarding employees data security.

Policies

Policies are so important again in this context in a workplace.

We know, we are all deluged in paperwork but it necessary essence have correct policies in place should an employer wish to engage in monitoring in the workplace.

Having robust policies also focus the mind and can set up employers up for a better foundation in data protection matters.