Data protection is the right of an individual to prevent misuse of information about them. Updated legislation allows employees to have greater control over sensitive personal data. It is important for employees to understand their rights regarding their privacy and for employers to ensure that their employees are aware of their rights. Employers need to develop policies that take a compliant, but balanced, approach. Organisations that ignore their legal obligations risk reputational damage, potential prosecution in the courts and heavy penalties.
Definitions: –
Applicable laws
These would be the Data Protection Act 2018, General Data Protection Regulation (GDPR) 2018 and the Human Rights Act 1998.
Personal data
Data that relates to or can identify a living person, either by itself or together with other available information. Examples include a person’s name, phone number, bank details and medical history.
Data subject
The person to whom the personal data relates.
Sensitive data
This is data relating to a data subject’s racial or ethnic origin, political opinions, religious beliefs, trade union membership, health, sexual orientation and genetic or biometric data. Generally, sensitive data cannot be processed without the data subject’s explicit consent, but employers can process sensitive data where necessary to carry out an employment contract or to fulfil collective agreement obligations.
Data controllers
This means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Data processor
This means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. and data processors: organisations that collect or use personal data.
Data Processing
Any operation or set of operations that are performed on personal data, for example, collecting, recording, organising, structuring, storage, adaptation or alteration, retrieval, consultation, restriction, erasure or destruction.
Employees have several rights under GDPR as individuals, these are covere3d in the section “Right to privacy”
Processing of Data
Employers must ensure that they have a valid lawful basis for processing data. This section is aimed at employers and their obligations. As an employer, Data Protection might seem like a giant legal complication. It however is simply adding an extra step to already established processes.
The requirement of a lawful basis for processing means that processing must be conducted only when it is required. It must be more than just useful, and more than just standard practice. It must be a targeted and proportionate way of achieving a specific purpose. The lawful basis will not apply if you can reasonably achieve the purpose by some other less intrusive means, or by processing fewer data.
The six lawful bases are;
- Consent: the employee has given clear consent for you to process their data for a specific purpose.
- Contract: the processing is necessary for a contract you have with the employee, or because they have asked you to take specific steps before entering into a contract.
- Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
- Vital interests: the processing is necessary to protect someone’s life.
- Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
- Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the employee’s data which overrides those legitimate interests.
At Least one of these bases need to apply for you to lawfully process the data. The employee’s right to be informed requires you to provide people with information about your lawful basis for processing. This means you need to include these details in your privacy notice. You should think about why you want to process the data, and consider which lawful basis best fits the circumstances. If you feel that more than one basis applies, you should identify and document all of them from the start. You must not adopt a one-size-fits-all approach. No one basis should be seen as always better, safer or more important than the others, and there is no hierarchy in the order of the list.
An employee may request erasure if the data is not processed on a valid lawful basis,
For example, if you are using consent as your basis for processing the data and the employee withdraws this consent, or if you are using legitimate interests as your basis and there isn’t an overriding interest for processing this data, the employee can request erasure and be successful in their claim.
You can use the interactive tool provided by the ICO to get tailored guidance on the subject. www.ico.org.uk
You must be able to show compliance to GDPR by having appropriate privacy processes and policies, this means that you need to be able to show that you have properly considered which lawful basis applies to each processing purpose and can justify your decision. You need therefore to keep a record of which basis you are relying on for each processing purpose and a justification for why you believe it applies. There is no standard form for this, as long as you ensure that what you record is sufficient to demonstrate that a lawful basis applies.
Transparency Requirements
As an employer, you must be transparent about how you are using and safeguarding your employees’ data, inside, and outside the organisation. You must be accountable for your data processing activities and be able to show how you meet data protection principles.
You should make an inventory of all the personal data that you hold. You should then check it under the following headings, and ensure that you have the required consent and legal basis to process the data:
- What is the purpose of holding it?
- How was it obtained?
- Why was it originally gathered?
- How long will it be retained?
- Will it be shared with third parties, if yes, have the necessary processes been followed to ensure privacy?
An information audit or data mapping exercise can help you find out what personal data you hold and what you do with it. You should think about the intended audience for your privacy information and put yourself in their position. For all audiences, you must provide information to them in a way that is:
- concise;
- transparent;
- intelligible;
- easily accessible; and
- uses clear and plain language.
Responding to Subject Area Requests (SARs)
You must have procedures in place to respond to personal data access requests from employees within 1 month. This can be extended by a further 2 months if requests are complex or numerous.
You must provide the employee with a copy of their data and other supplementary information. If an employee makes a request electronically, you should provide the information in a commonly used electronic format, unless the employee requests otherwise. When deciding what format to use, you should consider both the circumstances of the particular request and whether the employee can access the data you provide in that format. It is good practice to ask the employee’s preferred format before fulfilling their request.
There are a few exemptions that allow you to refuse a SAR. You may refuse to provide all or some of the requested information, depending on the circumstances. You can also refuse to comply with a SAR if it is manifestly unfounded or manifestly excessive. Further guidance on this may be found here: www.ico.org.uk
When you refuse a SAR, you must inform the employee of the following:
- the reasons for refusing it;
- their right to make a complaint to the ICO or another supervisory authority;
- their ability to seek to enforce this right through the courts.
Refusal of request for Rectification and Erasure.
You may refuse a request for rectification or erasure if it is manifestly unfounded; or excessive. A request is manifestly unfounded if the employee had no intention to exercise their right to rectification or erasure. For example, an employee makes a request, but then offers to withdraw it in return for some form of benefit from the organisation; or the request is malicious in intent and is being used to harass an organisation with no real purposes other than to cause disruption. If an employee exercises the right to restriction to carry out a personal grudge towards the organisation, the request is manifestly unfounded and you could refuse to act on it. You must evaluate this on a case-by-case basis and be able to prove that it is meant to be unfounded.
A request is excessive if an employee has made several requests of the same kind and the current request repeats the content of the previous requests or if it overlaps with other requests made by the employee. A request isn’t always excessive and you need to make sure that you have assessed the request enough to rule out the legitimacy of the request. For example, an employee may feel the need to repeat a request if the organisation hasn’t handled the previous requests properly.
If you refuse to take action, you must inform the employee without unnecessary delay and within one month of receipt of the request. You should inform the employee about the reasons you are not taking action, their right to make a complaint to the ICO or another supervisory authority; and their ability to seek to enforce this right through a judicial remedy. You should also provide this information if you request a reasonable fee or need additional information to identify the employee.
You can find more information about the right to rectification here: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-restrict-processing/
Information about the right to erasure can be found here: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-rectification/
7.50