Article 88 GDPR: Difference between revisions

From GDPRhub
Line 208: Line 208:


==== Meaning of Employment ====
==== Meaning of Employment ====
The terms “employment” or “employee” are not defined in this Article nor in the GDPR. Although there is therefore no clear definition of what both terms include, following the Opinions issued by the WP29,<ref>Referenced in the section below</ref> there shall be a certain degree of dependence on the employer from the employee side, which would exclude self-employed workers.<ref>See also ''Selk'', in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 88 GDPR, margin numbers 41-50 (Beck 2018, 2nd ed.) (accessed 30.04.2021)</ref> Secondly, as the Article does not distinguish between public and private employment, public servants can be considered to be included.
The terms “employment” or “employee” are not defined in this Article nor in the GDPR. Although there is therefore no clear definition of what both terms include, following the Opinions issued by the WP29,<ref>Article 29 Data Protection Working Party, Opinion 8/2001 on the processing of personal data in the employment context, 13 September 2001 (available [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2001/wp48_en.pdf here]); Article 29 Data Protection Working Party, Opinion 2/2017 on data processing at work, 8 June 2017 (available [https://ec.europa.eu/newsroom/article29/items/610169/en here]).</ref> there shall be a certain degree of dependence on the employer from the employee side, which would exclude self-employed workers.<ref>See also ''Selk'', in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 88 GDPR, margin numbers 41-50 (Beck 2018, 2nd ed.) (accessed 30 April 2021).</ref> Secondly, as the Article does not distinguish between public and private employment, public servants can be considered to be included.
==== Specific Considerations ====
==== Specific Considerations ====
The WP29, in its Opinion on the processing of personal data in the employment context<ref>Article 29 Data Protection Working Party, Opinion 8/2001 on the processing of personal data in the employment context, 13 September 2001. Available at: <nowiki>https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2001/wp48_en.pdf</nowiki></ref> makes particular reference to consent in the context of an employment relationship. Consent, according to Article 7 GDPR, must be freely given. However, an imbalance of power exists in an employment relationship exists, so that employer and employee are never on the same level. Therefore, consent may not be freely given, but coerced because of the nature of such relationship, or because the employee may fear the consequences of refusing to give consent. Employees shall not rely on consent but on a legitimate interest or other legal basis.
The WP29, in its Opinion on the processing of personal data in the employment context<ref>Article 29 Data Protection Working Party, Opinion 8/2001 on the processing of personal data in the employment context, 13 September 2001 (available [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2001/wp48_en.pdf here]).</ref> makes particular reference to consent in the context of an employment relationship. Consent, according to [[Article 7 GDPR]], must be freely given. However, an imbalance of power exists in an employment relationship, meaning that employer and employee are never on the same level. Therefore, consent may not be freely given, but coerced because of the nature of such relationship, or because the employee may fear the consequences of refusing to give consent. Employees shall not rely on consent but on a legitimate interest or other legal basis.


The WP29 also establishes certain transparency requirements for the employer when processing employee data.<ref>Article 29 Data Protection Working Party, Opinion 2/2017 on data processing at work, 8 June 2017</ref> Employees shall be fully aware of every processing activity regarding their data. The employer shall provide their employees with clear information when monitoring takes place, including the circumstances of such monitoring and possibilities to prevent so.
The WP29 also establishes certain transparency requirements for the employer when processing employee data.<ref>Article 29 Data Protection Working Party, Opinion 2/2017 on data processing at work, 8 June 2017 (available [https://ec.europa.eu/newsroom/article29/items/610169/en here]).</ref> Employees shall be fully aware of every processing activity regarding their data. The employer shall provide their employees with clear information when monitoring takes place, including the circumstances of such monitoring and possibilities to prevent their data being processed by monitoring technologies.<ref>Article 29 Data Protection Working Party, Opinion 2/2017 on data processing at work, 8 June 2017 (available [https://ec.europa.eu/newsroom/article29/items/610169/en here]).</ref>


Regarding transfers of data within the same group of companies, Article 48 specifies that a controller may rely on legitimate interest to transfer data for processing by a different controller within the same group. However, in any case, legitimate interest shall be carefully assessed to ensure that the interests and the data subject are respected and do not override the interest of the controller.<ref>See also ''Selk'', in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 88 GDPR, margin numbers 175-177 (Beck 2018, 2nd ed.) (accessed 30.04.2021)</ref>
Regarding transfers of data within the same group of companies, [[Article 48 GDPR|Article 48]] specifies that a controller may rely on legitimate interest to transfer data for processing by a different controller within the same group. However, in any case, legitimate interest shall be carefully assessed to ensure that the interests of the data subject are respected and do not override the interest of the controller.<ref>See also ''Selk'', in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 88 GDPR, margin numbers 175-177 (Beck 2018, 2nd ed.) (accessed 30 April 2021).</ref>


=== (3) Notification to the Commission ===
==== Case Law ====
According to Article 88(3), Member States shall notify the Commission about any provisions in their national law pursuant to this Article. Currently, Austria, Bulgaria, Cyprus, the Czech Republic, Denmark, Estonia, Åland’s Finish province, France, Germany, Hungary, Ireland, Italy, Lithuania, Luxembourg, Poland, Romania, and Slovakia have issued notifications in this regard.<ref>Available at: https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu/eu-countries-gdpr-specific-notifications_en. Last accessed 30/04/20219</ref>
The CJEU has to this date dealt with several cases regarding the processing of personal data in the context of employment.<ref>''Van Eecke, Simkus'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 88 GDPR, pp. 1232-1233 (Oxford University Press 2020).</ref> The Rundfonk case<ref>CJEU, Osterreichischer Rundfank, Joined Cases C-465/00, C-138/01 and C-139/01, 20 May 2003 (available [https://curia.europa.eu/juris/document/document.jsf?docid=48331&doclang=EN here]). </ref> concerned the public disclosure of information regarding the salaries of employees in the public sector, based on public interest. The CJEU ruled that interferences in these employees' data protection rights could be legitimate if they pursued a legitimate aim and were proportional. The Worten case,<ref>CJEU, Worten, C-342-12, 30 May 2013 (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=137824&pageIndex=0&doclang=CS&mode=lst&dir=&occ=first&part=1&cid=4307987 here]). </ref> concerned the transfer of the working times of employees to a national authority responsible fopr monitoring working conditions. The CJEU stated that the working times were considered personal data, as they can be related to an identifiable person, and that in order to make them available to a third party, they must be necessary to perform the monitoring task imposed to the public authority.


For example, Italy makes reference in its national law to remote and home-work, compelling the employer to respect the employees’ personality and moral freedom.<ref>Available at: <nowiki>https://ec.europa.eu/info/sites/default/files/it_notification_art_49_51_83_84_85_88_90.pdf</nowiki>. Last accessed 30/04/20219</ref>  
Currently, questions regarding distance learning and the data privacy implications, including the processing of personal data of employees for videoconferencing, have been referred to the CJEU for consultation by a German administrative court.<ref>VG Wiesbaden, 23 K 1360/20.WI.PV, 21 December 2021 (available [https://www.rv.hessenrecht.hessen.de/bshe/document/LARE210000164 here]). </ref>


Slovakian law contains a provision that allows the employer to publish the data of its employees when it is necessary for the fulfillment of the jobs, providing that respect, dignity and safety of the data subject are respected.<ref>Available at: <nowiki>https://ec.europa.eu/info/sites/default/files/sk_notification_51.4_85.3_88.3_publish_0.pdf</nowiki>. Last accessed 30/04/20219</ref>
=== (3) Notification to the Commission ===
 
According to Article 88(3), Member States shall notify the Commission about any provisions in their national law pursuant to this Article. Currently, Austria, Bulgaria, Cyprus, the Czech Republic, Denmark, Estonia, Åland’s Finish province, France, Germany, Hungary, Ireland, Italy, Lithuania, Luxembourg, Poland, Romania, and Slovakia have issued notifications in this regard.<ref>European Commission, EU Member States notification to the European Commission under the GDPR (available [https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu/eu-countries-gdpr-specific-notifications_en here]).</ref>
Irish national law additionally refers to the processing of special categories of personal data for purposes of employment and social welfare law.<ref>Available at: <nowiki>http://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/pdf</nowiki>. Last accessed 30/04/20219</ref>


France has included in its national law provisions regarding video surveillance in the work place, individual information about salaries, or pay slip processing.<ref>Available at: <nowiki>https://ec.europa.eu/info/sites/default/files/fr_notification_gdpr_articles_49_51_84_85_88_90_publish.pdf</nowiki>. Last accessed 30/04/20219</ref>
For example, Italy makes reference in its national law to remote and home-work, compelling the employer to respect the employee's personality and moral freedom.<ref>Italy notification GDPR articles 49(5), 51(4), 83(9), 84(2), 85(3), 88(3), 90(2) (available [https://ec.europa.eu/info/sites/default/files/it_notification_art_49_51_83_84_85_88_90.pdf here]) (accessed 30 April 2021).</ref>  


Germany has included in its Federal law regulation for consent, special categories of data, video surveillance, the processing of employee data documentation, or for compensating employees for data breaches.<ref>Available at: <nowiki>https://ec.europa.eu/info/sites/default/files/de_notification_articles_49.5_51.4_83.9_84.2_85.3_88.3_90.2_publish.pdf</nowiki>. Last accessed 30/04/20219</ref>
Slovakian law contains a provision that allows the employer to publish the data of its employees when it is necessary for the fulfilment of the jobs, providing that respect, dignity and safety of the data subject are respected.<ref>Slovakia notification GDPR articles 51(4), 85(3), 88(3) (available [https://ec.europa.eu/info/sites/default/files/sk_notification_51.4_85.3_88.3_publish_0.pdf. here]) (accessed 30 April 2021).</ref>  
 
==== Case Law ====
The Court of Justice of the European Union has to this date dealt with several cases regarding the processing of personal data in the context of employment.<ref>''Van Eecke/Simkus'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 88 GDPR, pp. 1232-1233 (Oxford University Press, Oxford, 2020)</ref>


In the Rundfonk case,<ref>CJEU, Joined Cases G-465/00, C-138/01 and C-139/01, Osterreichischer Rundfank, 20 May 2003</ref> the CJEU regarded a case of publicly making available information about salaries of employees from the public sector, based on public interest. The Court ruled that inferences in their data protection right could be legitimate if they pursued a legitimate aim and were proportional.
Irish national law additionally refers to the processing of special categories of personal data for purposes of employment and social welfare law.<ref>Ireland notification GDPR articles 51(4), 84(2), 85(3), 88(3), 90(2) (available [http://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/pdf here]) (accessed 30 April 2021).</ref>


In the Worten case,<ref>CJEU, Case C-342-12, Worten, 30 May 2013</ref> the Court dealt with a case regarding the transfer of the working times of the employee to a national authority responsible of monitoring working conditions. The Court stated that the working times were considered personal data, as they can be related to an identifiable person, and that in order to make them available to a third party, they must be necessary to perform the monitoring task imposed to the public authority.
France has included in its national law provisions regarding video surveillance in the work place, individual information about salaries, or pay slip processing.<ref>France notification GDPR articles 49(5), 51(4), 84(2), 85(3), 88(3), 90(2) (available [https://ec.europa.eu/info/sites/default/files/fr_notification_gdpr_articles_49_51_84_85_88_90_publish.pdf. here]) (accessed 30 April 2021).</ref>


Currently, questions regarding distance learning and the data privacy implications, including processing of personal data from employees for videoconferencing, have been referred to the CJEU for consultation by a German administrative court.<ref>Available at: https://www.pinsentmasons.com/out-law/analysis/cjeu-to-rule-on-processing-of-personal-data-from-employees-for-videoconferencing. Last accessed: 30/04/2021</ref>
Germany's Federal law regulates employee consent, special categories of data, video surveillance, the processing of employee data documentation, and the compensation of employees for data breaches.<ref>Germany notification GDPR articles 49(5), 51(4), 83(9), 84(2), 85(3), 88(3), 90(2) (available [https://ec.europa.eu/info/sites/default/files/de_notification_articles_49.5_51.4_83.9_84.2_85.3_88.3_90.2_publish.pdf here]) (accessed 30 April 2021).</ref>


== Decisions ==
== Decisions ==

Revision as of 09:33, 6 September 2021

Article 88 - Processing in the context of employment
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 88 - Processing in the context of employment


1. Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer's or customer's property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.

2. Those rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.

3. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

Relevant Recital

Recital 155: Processing of Employees' Personal Data
Member State law or collective agreements, including ‘works agreements’, may provide for specific rules on the processing of employees' personal data in the employment context, in particular for the conditions under which personal data in the employment context may be processed on the basis of the consent of the employee, the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.

Commentary

Article 88 GDPR offers Member States the possibility of regulating the processing of data in the context of employment at a national level. For this, Article 88 contains a list of possible matters to be regulated (Article 88(1)), sets certain requirements regarding the standards enshrined in the GDPR (Article 88(2)) and notification to the Commission (Article 88).

(1) List of Matters

Article 88(1) offers a list of matters that Member States may regulate. This is not an exhaustive list, and therefore Member States have the freedom to regulate additional matters. As noted under the section 'Notification to the Commission' below, several Member States have already regulated matters that were not expressly listed in Article 88, such as video surveillance in the work place.

(2) GDPR Equivalent

Article 88(2) obliges Member States, when they regulate matters related to employment data, to include in their provisions suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems in the work place.

Therefore, Article 88 allows Member States to pass national laws as long as they are in line with the GDPR. Although this is already a consequence deriving from the primacy of EU Regulations over national law, the GDPR opts for a clear mandate that seeks to ensure the protection of employee data. Hence, the GDPR requirements are a minimum standard for Member States, but there is no impediment for a Member State to include stricter safeguards.

Meaning of Employment

The terms “employment” or “employee” are not defined in this Article nor in the GDPR. Although there is therefore no clear definition of what both terms include, following the Opinions issued by the WP29,[1] there shall be a certain degree of dependence on the employer from the employee side, which would exclude self-employed workers.[2] Secondly, as the Article does not distinguish between public and private employment, public servants can be considered to be included.

Specific Considerations

The WP29, in its Opinion on the processing of personal data in the employment context[3] makes particular reference to consent in the context of an employment relationship. Consent, according to Article 7 GDPR, must be freely given. However, an imbalance of power exists in an employment relationship, meaning that employer and employee are never on the same level. Therefore, consent may not be freely given, but coerced because of the nature of such relationship, or because the employee may fear the consequences of refusing to give consent. Employees shall not rely on consent but on a legitimate interest or other legal basis.

The WP29 also establishes certain transparency requirements for the employer when processing employee data.[4] Employees shall be fully aware of every processing activity regarding their data. The employer shall provide their employees with clear information when monitoring takes place, including the circumstances of such monitoring and possibilities to prevent their data being processed by monitoring technologies.[5]

Regarding transfers of data within the same group of companies, Article 48 specifies that a controller may rely on legitimate interest to transfer data for processing by a different controller within the same group. However, in any case, legitimate interest shall be carefully assessed to ensure that the interests of the data subject are respected and do not override the interest of the controller.[6]

Case Law

The CJEU has to this date dealt with several cases regarding the processing of personal data in the context of employment.[7] The Rundfonk case[8] concerned the public disclosure of information regarding the salaries of employees in the public sector, based on public interest. The CJEU ruled that interferences in these employees' data protection rights could be legitimate if they pursued a legitimate aim and were proportional. The Worten case,[9] concerned the transfer of the working times of employees to a national authority responsible fopr monitoring working conditions. The CJEU stated that the working times were considered personal data, as they can be related to an identifiable person, and that in order to make them available to a third party, they must be necessary to perform the monitoring task imposed to the public authority.

Currently, questions regarding distance learning and the data privacy implications, including the processing of personal data of employees for videoconferencing, have been referred to the CJEU for consultation by a German administrative court.[10]

(3) Notification to the Commission

According to Article 88(3), Member States shall notify the Commission about any provisions in their national law pursuant to this Article. Currently, Austria, Bulgaria, Cyprus, the Czech Republic, Denmark, Estonia, Åland’s Finish province, France, Germany, Hungary, Ireland, Italy, Lithuania, Luxembourg, Poland, Romania, and Slovakia have issued notifications in this regard.[11]

For example, Italy makes reference in its national law to remote and home-work, compelling the employer to respect the employee's personality and moral freedom.[12]

Slovakian law contains a provision that allows the employer to publish the data of its employees when it is necessary for the fulfilment of the jobs, providing that respect, dignity and safety of the data subject are respected.[13]

Irish national law additionally refers to the processing of special categories of personal data for purposes of employment and social welfare law.[14]

France has included in its national law provisions regarding video surveillance in the work place, individual information about salaries, or pay slip processing.[15]

Germany's Federal law regulates employee consent, special categories of data, video surveillance, the processing of employee data documentation, and the compensation of employees for data breaches.[16]

Decisions

→ You can find all related decisions in Category:Article 88 GDPR

References

  1. Article 29 Data Protection Working Party, Opinion 8/2001 on the processing of personal data in the employment context, 13 September 2001 (available here); Article 29 Data Protection Working Party, Opinion 2/2017 on data processing at work, 8 June 2017 (available here).
  2. See also Selk, in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 88 GDPR, margin numbers 41-50 (Beck 2018, 2nd ed.) (accessed 30 April 2021).
  3. Article 29 Data Protection Working Party, Opinion 8/2001 on the processing of personal data in the employment context, 13 September 2001 (available here).
  4. Article 29 Data Protection Working Party, Opinion 2/2017 on data processing at work, 8 June 2017 (available here).
  5. Article 29 Data Protection Working Party, Opinion 2/2017 on data processing at work, 8 June 2017 (available here).
  6. See also Selk, in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 88 GDPR, margin numbers 175-177 (Beck 2018, 2nd ed.) (accessed 30 April 2021).
  7. Van Eecke, Simkus, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 88 GDPR, pp. 1232-1233 (Oxford University Press 2020).
  8. CJEU, Osterreichischer Rundfank, Joined Cases C-465/00, C-138/01 and C-139/01, 20 May 2003 (available here).
  9. CJEU, Worten, C-342-12, 30 May 2013 (available here).
  10. VG Wiesbaden, 23 K 1360/20.WI.PV, 21 December 2021 (available here).
  11. European Commission, EU Member States notification to the European Commission under the GDPR (available here).
  12. Italy notification GDPR articles 49(5), 51(4), 83(9), 84(2), 85(3), 88(3), 90(2) (available here) (accessed 30 April 2021).
  13. Slovakia notification GDPR articles 51(4), 85(3), 88(3) (available here) (accessed 30 April 2021).
  14. Ireland notification GDPR articles 51(4), 84(2), 85(3), 88(3), 90(2) (available here) (accessed 30 April 2021).
  15. France notification GDPR articles 49(5), 51(4), 84(2), 85(3), 88(3), 90(2) (available here) (accessed 30 April 2021).
  16. Germany notification GDPR articles 49(5), 51(4), 83(9), 84(2), 85(3), 88(3), 90(2) (available here) (accessed 30 April 2021).