IP - 07121-1/2020/390

IP - 07121-1/2020/390
Authority:	IP (Slovenia)
Jurisdiction:	Slovenia
Relevant Law:	Article 6(1)(c) GDPR Article 48 of ZDR-1 Article 110 of ZDR-1
Type:	advisory opinion
Outcome:	n/a
Started:
Decided:	23.03.2020
Published:
Fine:	None
Parties:	Unknown
National Case Number/Name:	07121-1/2020/390
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Slovenian
Original Source:	(IP) (in SL)
Initial Contributor:	n/a

The Information commission (the IP) issued an opinion explaining in which situation it is necessary for an employer to obtain information on employee’s sick leave for supervisory purposes, under Article 6(1)(c) GDPR.

English Summary

Facts

The Information commission (the IP) received a request for advisory opinion on what personal can be obtained from a doctor regarding an employee’s sick leave. In particular, it has been asked what information the doctor is required to disclose to a licensed detective acting on the behalf of an employer, to monitor employees.

Holding

First, the IP recalled that the processing of employee’s personal data by the employer is based on Article 6(1)(c) GDPR. In this regard, Article 48 of the Slovenian Act (No. 21/13, 78/13 - afterwards, 47/15 - ZZSDT, 33/16 - PZ-F, 52/16, 15/17 - dec. US, 22/19 - ZPosS and 81/19, hereafter ‘ZDR-1’), provides that workers’ data may be processed and shared with third parties only if it is prescribed by law or when it is necessary for the exercise of the rights and obligations arising from or in relation to the employment relationship.

Then, the IP explained that the control of the sick-leave can be necessary for the exercise of rights arising from the employment relationship. Indeed, Article 110(1) of the ZDR-1 provides that an employer may end the working contract if the employee does not follow the doctor’s instructions during his sick leave. Also, the employer is allowed to hire a detective to obtain information about abuses of rights by employees. Specifically, the detective may obtain on the behalf of the employer information on the instructions given by the doctor in relation to the sick leave. However, the doctor is not obliged to provide the data.

Lastly, the IP pointed out that the employer is also allowed to obtain information on the reasons why the worker reduced and adjusted his working schedule (eg sickness, injury outside work, occupational illness, injury at work) for the compensation wage calculation through the Health Insurance Act.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.

The Information Commissioner (hereinafter referred to as IP) has received your request for an opinion. You are wondering what information a worker can obtain from a doctor on the basis of an employer's authorization regarding the control of sick leave by a licensed detective, or what information doctors are required to provide for that purpose.

On the basis of the information you have provided, in accordance with Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Directive 95/46 / EC (hereinafter referred to as the General Data Protection Regulation), point 7 of the first paragraph of Article 49 of the Personal Data Protection Act (Official Gazette RS, No. 94/07-UPB1, hereinafter ZVOP-1), and 2 Article 43 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05, hereinafter ZInfP), we provide our non-binding opinion on your question.

Any processing of personal data must have an appropriate and legal legal basis. These are set out in Article 6 (1) of the General Data Protection Regulation. The general statutory basis of the employer for the processing of personal data within the meaning of Article 6 (1) (c) of the General Data Protection Regulation is the Employment Relationships Act (Official Gazette RS, No. 21/13, 78/13 - afterwards, 47/15 - ZZSDT, 33/16 - PZ-F, 52/16, 15/17 - dec. US, 22/19 - ZPosS and 81/19; hereinafter ZDR-1), which provides in the first paragraph of Article 48 that Workers' data may be collected, processed, used and delivered to third parties only if it is stipulated by this or other law or when it is necessary for the purpose of exercising the rights and obligations arising from the employment relationship or in relation to the employment relationship.

The control of the hospital stock, which is considered as processing of personal data by the collection, transmission and use of related personal data (Article 4 (2) of the General Data Protection Regulation), in certain cases is necessary in order to exercise the rights and obligations arising from the employment relationship. The provision of the 8th indent of the first paragraph of Article 110 of the ZDR-1 stipulates that an employer may terminate an employee's contract of employment if the employee does not follow the instructions of the competent doctor or medical commission during his absence from work due to illness or injury or if during that time gainful employment or leave the place of residence without the approval of the competent doctor or medical board. The employer may carry out the control of the hospital stock and the related processing of the personal data of the employees by himself, but may hire a detective for control, since, in accordance with the 9th indent of the second paragraph of Article 26 of the Law on Detective Activity (Official Gazette RS, No. 17/11) the detective's field of work also includes obtaining information about abuses of the right to be withheld from work due to illness or injury, abuses of exercising the right to reimbursement of transport costs to and from work, work under the influence of alcohol or illicit drugs, and other disciplinary violations and violators.

The employer or on his behalf the detective may obtain information on the employee's movement regimen (doctor's instructions on possible strict rest or allowable movement) during sick leave and information on the estimated time of absence, because without it he cannot act on suspicion of abuse of sick leave and organize work or provide replacing the absent worker. The data may be obtained from the employee or from his / her personal physician, who is not obliged to provide the data.

The employer also has a legal basis for obtaining information on the reason for temporary retention from work (eg sickness, injury outside work, occupational illness, injury at work, care), since he needs it to calculate wage compensation during temporary retention, but has no legal basis for obtaining it. diagnosis of disease or injury. The employer is informed about the reason for the restraint on the sick list, but if he is sick for more than 30 days, he receives a decision of the Health Insurance Act, which also specifies the regime of movement of the employee during absence.
Regarding the legality of processing personal data on sick leave of employees, IP has already published a press release, which is available on our web site: https://www.ip-rs.si/news/information-author-ip-je-po -but-initiatives-performed-inspection-controls-over-legal-1072 /.

You can read more about the protection of personal data in employment relationships in the IP guidelines, which are available at: https://www.ip-rs.si/fileadmin/user_upload/Pdf/smernice/Smernice_-_Varstvo_OP_v_delovne_razmerije_verzija_1.1_koncna.pdf.

All IP opinions are published and available on our website: https://www.ip-rs.si/vop/.
Also, all the key areas covered by the General Data Protection Regulation are presented at: https://www.ip-rs.si/legislation/reforma-european-legislative-framework-for-protection-personal-data/ key-areas-of-regulation / where you can find many useful tips on the essential obligations of companies and other organizations