In further production from the group's June plenary session, the EU's Article 29 Working Party, the collection of data protection authorities, released today extensive guidance (warning: automatic PDF download) relating to the privacy of employees, including a series of nine practical scenarios. This update to similar guidance issued in 2001 is necessitated, the DPAs write, by technological developments and the coming into force of the General Data Protection Regulation, despite the fact that they note much of the guidance takes into account the current data protection environment under the Directive.
Further, the new guidance takes into account the burgeoning "sharing economy" and the changing nature of work. "Where the word 'employee' is used in this opinion," the guidance states, "WP29 does not intend to restrict the scope of this term merely to persons with an employment contract recognized as such under applicable labour laws." Rather, the opinion covers "all situations where there is an employment relationship."
Much of the guidance, in fact, should be familiar to seasoned data protection professionals in the EU. For instance, there is early and frequent reminder that consent should be used only rarely as the basis for legitimate processing in an employment relationship; that the transparency and data minimizations principles are just as important and valid in a work setting; and that automated decision-making is still to be avoided.
However, it's interesting to note which aspects of the GDPR the WP29 considers "new obligations" for employers. Data protection by design, for example, should be practiced for employees as with any other data subjects. This might manifest itself in the context of issuing a device to an employee where "the most privacy-friendly solutions should be selected." Many employee matters, too, might trigger data protection impact assessments, which may further lead to consultation with relevant data protection authorities.
Finally, the WP29 points to Article 88, which allows for member states to provide for more specific data protection rules in the workplace. This is an area that privacy professionals will want to watch closely, as it could be an area where the EU is far from uniform.
So, what does "risk" look like for the WP29 in the workplace? Essentially, employees need to know how they're being monitored via a clear and accessible monitoring policy, and employers may need to understand their systems better than they do now. Do you know and explain the data logs created by your corporate Wi-Fi? Are you using IT monitoring systems, initially designed to detect anomalies, to monitor employee performance? Are you using a vehicle-tracking system to make sure employees are where they say they are? All these situations, they say, may create risks to the rights and freedoms of employees as data subjects.
The scenarios highlight a number of specific situations and answer what are likely common questions:
Can I check the social media accounts of people applying for jobs? Almost definitely not, unless you say you're going to do that in a job advertisement that the applicant is responding to.
Can I monitor the LinkedIn profiles of former employees to make sure they don't violate noncompete clauses? Yeah, you can probably do that, as long as you don't have a better method for protecting that legal right. But, no, you shouldn't be regularly monitoring the social media profiles of your employees.
I can use data loss prevention tools, right? Almost definitely, but you should conduct a DPIA before implementing the new technology, and you should take extra care in transparency, for example, warning an employee that the email they are about to send is likely to trigger the DLP technology and a person might review the email's contents.
I can use key-logging and mouse-movement detection technologies to make sure my remote employees are who they say they are, right? No. Don't do that. Such technologies are "disproportionate."
What about BYOD devices? What can I do there? Tread carefully. The WP29 discusses BYOD in great care, noting that security software should not scan parts of the device logically considered personal, such as the photos folder, that location tracking is unlikely to be appropriate for a personal device, and that "sandboxing" is encouraged. Further, prohibition of BYOD might be the best recourse.
I've got an idea! Fitness trackers for everyone, so that we can make sure employees are working healthy! No. Well, maybe. Despite the fact that this is a common occurrence in the United States, where employees can opt-in to having their steps tracked in exchange for rewards, "It is highly unlikely that legally valid consent can be given for the tracking or monitoring of such data as employees are essentially not 'free' to give such consent in the first place," the DPAs write. "Even if the employer uses a third party to collect the health data, which would only provide aggregated information abut the general health developments of the employer, the processing would still be unlawful." However, if you want to give employees fitness trackers as presents and let them use them as they see fit because you think it will eventually result in a healthier workforce, that would be OK.
Can I use my access control system to track when employees come and go? No. You could retain that information so as to audit who was in the building when a theft occurred, for example, but you can't use it for something like a performance evaluation.
What about cool new video analytics that allow me to automatically be alerted if someone stops moving on the assembly line? Nope. You remember that automated decision-making stuff, right? Don't do it.
But I'm doing the video analytics in a vehicle, to make sure they're driving safely. Surely that's allowed? Nope. Don't do that. Figure out a better way to make sure they're driving safely.
In short, keep the basic principles of data protection in mind during all employee interactions. They are data subjects just like any other data subjects, and tests of proportionality, legal basis and legitimate interest still apply. In some ways, even more so, as consent is mostly not an option for moving forward with data processing. As new technologies are presented offering new promises of efficiency and business development, tread carefully.
Photo credit: Tyne & Wear Archives & Museums Long-serving employees at Readhead's shipyard via photopin(license)