We would like to ensure that you are still receiving content that you find useful – please confirm that you would like to continue to receive ILO newsletters.
13 May 2009
Recent decisions of the Privacy Authority and the Supreme Court emphasize that employees' personal data must be carefully managed. Employers must take particular care to comply with the rules applying to data processing and the electronic circulation of personal data.
Section 7 of the Data Protection Code(1) provides that an employee (ie, a data subject) has the right to access personal data processed by his or her employer (ie, the data controller). Since information about an employee that is used in the everyday administration of an employment relationship is 'personal data' for the purposes of the code, employees may access such information by submitting a request to the data controller or processor. The data subject may grant power of representation to natural persons, associations or organizations in connection with the exercise of these rights, provided that he or she confirms this in writing. The data controller must respond to the data subject's request without delay.
Section 10 of the code states that the data processor is responsible for retrieving such employee data, which can be communicated electronically. The data must be easily intelligible and must include all personal data concerning the data subject. Data relating to third parties must be omitted from the communication.
An employee's request to access personal data may be rejected if the data is processed:
An employee may access personal data without rectifications or additions in respect of performance evaluation data, opinions and any form of subjective assessment, policy implementation or decision-making activity.
The authority has confirmed the right of access in respect of personal data concerning:
The authority has rejected objections by employers seeking to block access to an employee's personal data. In one case the employer objected to a request for access to the employee's personal data because the information related exclusively to the terms and conditions of the employer's professional activity, but the authority rejected the objection and held that the employee had the right to access all such personal data. The authority has also rejected the argument that communicating data to an employee might prejudice an internal investigation,(5) finding that an employer's response may be delayed only for "the period during which the performance of the investigation… might be... materially prejudiced" - the authority will determine this period on a case-by-case basis.
The Supreme Court has recognized an employee's right to access to his or her personal data during legal proceedings and in all the preceding phases:
"data processed by an employer concerning an employee's working activity… shall be accessible for administrative inspections and... to the data subject, with full respect for the principle of good faith in the performance of contracts. If such data is relevant to a lawsuit, the employee has the right to submit it to the court;... [this] does not depend on the judge's discretion, notwithstanding the possible existence of other evidence and the principles governing the resource-efficient gathering of evidence in proceedings. The [code] forms the basis for this decision, specifically Section 7(1), which states that 'a data subject has the right to obtain confirmation of the existence of personal data relating to him or her, regardless of whether such information has already been recorded, and to have such data communicated to him or her in intelligible form'."
The materials contained on this website are for general information purposes only and are subject to the disclaimer.
ILO is a premium online legal update service for major companies and law firms worldwide. In-house corporate counsel and other users of legal services, as well as law firm partners, qualify for a free subscription.