Processing of Data
Employers must ensure that they have a valid lawful basis for processing data. This section is aimed at employers and their obligations. As an employer, Data Protection might seem like a giant legal complication. It however is simply adding an extra step to already established processes.
The requirement of a lawful basis for processing means that processing must be conducted only when it is required. It must be more than just useful, and more than just standard practice. It must be a targeted and proportionate way of achieving a specific purpose. The lawful basis will not apply if you can reasonably achieve the purpose by some other less intrusive means, or by processing fewer data. The six lawful bases are;
- Consent: the employee has given clear consent for you to process their data for a specific purpose.
- Contract: the processing is necessary for a contract you have with the employee, or because they have asked you to take specific steps before entering into a contract.
- Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
- Vital interests: the processing is necessary to protect someone’s life.
- Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
- Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the employee’s data which overrides those legitimate interests.
At Least one of these bases need to apply for you to lawfully process the data. The employee’s right to be informed requires you to provide people with information about your lawful basis for processing. This means you need to include these details in your privacy notice. You should think about why you want to process the data, and consider which lawful basis best fits the circumstances. If you feel that more than one basis applies, you should identify and document all of them from the start. You must not adopt a one-size-fits-all approach. No one basis should be seen as always better, safer or more important than the others, and there is no hierarchy in the order of the list.
An employee may request erasure if the data is not processed on a valid lawful basis,
For example, if you are using consent as your basis for processing the data and the employee withdraws this consent. Or if you are using legitimate interests as your basis and there isn’t an overriding interest for processing this data. The employee can request erasure and be successful in their claim.
You can use the interactive tool provided by the ICO to get tailored guidance on the subject. www.ico.org.uk
You must be able to show compliance to GDPR by having appropriate privacy processes and policies, this means that you need to be able to show that you have properly considered which lawful basis applies to each processing purpose and can justify your decision. You need therefore to keep a record of which basis you are relying on for each processing purpose and a justification for why you believe it applies. There is no standard form for this, as long as you ensure that what you record is sufficient to demonstrate that a lawful basis applies.
Transparency Requirements
As an employer, you must be transparent about how you are using and safeguarding your employees’ data, inside, and outside the organisation. You must be accountable for your data processing activities and be able to show how you meet data protection principles.
You should make an inventory of all the personal data that you hold. You should then check it under the following headings, and ensure that you have the required consent and legal basis to process the data:
What is the purpose of holding it?
- How was it obtained?
- Why was it originally gathered?
- How long will it be retained?
- Will it be shared with third parties, if yes, have the necessary processes been followed to ensure privacy?
An information audit or data mapping exercise can help you find out what personal data you hold and what you do with it. You should think about the intended audience for your privacy information and put yourself in their position. For all audiences, you must provide information to them in a way that is concise, transparent, intelligible, easily accessible; and uses clear and plain language.
You can use the following methods to relay private information to your employees. Using more than one technique is effective in providing such information. It is often better to relay the information in the same manner that it was collected.
- Short notices containing key privacy information that have additional layers of more detailed information
- Dashboards that inform people how you use their data and allow them to manage what happens with it.
- Just-in-time notices which give relevant and focused privacy information delivered at the time you collect individual pieces of information about people.
- Icons (symbols) that indicate the existence of a particular type of data processing.
- Mobile and smart device functionalities, including pop-ups, voice alerts and mobile device gestures.
Responding to Subject Area Requests (SARs)
You must have procedures in place to respond to personal data access requests from employees within 1 month. This can be extended by a further 2 months if requests are complex or numerous.
You must provide the employee with a copy of their data and other supplementary information. If an employee makes a request electronically, you should provide the information in a commonly used electronic format, unless the employee requests otherwise. When deciding what format to use, you should consider both the circumstances of the particular request and whether the employee can access the data you provide in that format. It is good practice to ask the employee’s preferred format before fulfilling their request.
There are a few exemptions that allow you to refuse a SAR. You may refuse to provide all or some of the requested information, depending on the circumstances. You can also refuse to comply with a SAR if it is manifestly unfounded or manifestly excessive. Further guidance on this may be found here: www.ico.org.uk
When you refuse a SAR, you must inform the employee of the following:
- the reasons for refusing it;
- their right to make a complaint to the ICO or another supervisory authority;
- their ability to seek to enforce this right through the courts.
Refusal of request for Rectification and Erasure.
- You may refuse a request for rectification or erasure if it is
- Manifestly unfounded; or
- Excessive
A request is manifestly unfounded if the employee had no intention to exercise their right to rectification or erasure. For example, an employee makes a request, but then offers to withdraw it in return for some form of benefit from the organisation, or the request is malicious in intent and is being used to harass an organisation with no real purposes other than to cause disruption. If an employee exercises the right to restriction to carry out a personal grudge towards the organisation, the request is manifestly unfounded and you could refuse to act on it. You must evaluate this on a case by case basis and be able to prove that it is meant to be unfounded.
A request is excessive if an employee has made several requests of the same kind and the current request repeats the content of the previous requests or if it overlaps with other requests made by the employee. A request isn’t always excessive and you need to make sure that you have assessed the request enough to rule out the legitimacy of the request. For example, an employee may feel the need to repeat a request if the organisation hasn’t handled the previous requests properly.
If you refuse to take action, you must inform the employee without unnecessary delay and within one month of receipt of the request. You should inform the employee about:
The reasons you are not taking action;
- Their right to make a complaint to the ICO or another supervisory authority; and
- Their ability to seek to enforce this right through a judicial remedy.
- You should also provide this information if you request a reasonable fee or need additional information to identify the employee.
You can find more information about the right to rectification here: www.ico.org.uk
Information about the right to erasure can be found here: www.ico.org.uk
Data Breach
A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes breaches that are the result of both accidental and deliberate causes
You must report certain types of personal data breach to the Information Commissioner’s Office (ICO), and in some circumstances, to the affected employees as well. Additionally, you must also keep a record of any personal data breaches, regardless of whether you need to report them or not. You need to be able to detect, investigate, report (both internally and externally) and document any breaches. Having robust policies, procedures and reporting structures help you do this.
If you decide not to inform the employees, you will still need to notify the ICO unless you can demonstrate that the breach is unlikely to result in a risk to rights and freedoms. The ICO has the power to compel you to inform affected employees if we consider there is a high risk. In any event, you should document your decision-making process.
You need to describe, in clear and plain language,
the nature of the personal data breach and;
the name and contact details of any data protection officer you have, or another contact point where more information can be obtained;
a description of the likely consequences of the personal data breach; and
a description of the measures taken or proposed to deal with the personal data breach and, where appropriate, a description of the measures taken to mitigate any possible adverse effects.
specific and clear advice to employees on the steps they can take to protect themselves, and what you are willing to do to help them.
You can find more information about this here; www.ico.org.uk
Covid-19 Guidance
The pandemic has impacted all employers globally. Most of whom are trying to keep their businesses afloat while protecting their employees. Employers had to deal with the problem of identifying and containing cases of coronavirus in the workplace as means of discharging their general duty to provide a safe and secure working environment. Employee privacy cannot be assumed in a crisis, with business continuity, security and employee safety often prevailing above employees’ data protection rights. The Information Commissioner’s Office (ICO) has created a data protection and coronavirus information hub that includes some helpful but high-level information for employers on the processing of personal data during the pandemic. It can be found here: https://ico.org.uk/global/data-protection-and-coronavirus-information-hub/
7.52