Article 88 GDPR

From GDPRhub
Article 88 - Processing in the context of employment
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 88 - Processing in the context of employment


1. Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer's or customer's property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.

2. Those rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.

3. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

Relevant Recital

Recital 155: Processing of Employees' Personal Data
Member State law or collective agreements, including ‘works agreements’, may provide for specific rules on the processing of employees' personal data in the employment context, in particular for the conditions under which personal data in the employment context may be processed on the basis of the consent of the employee, the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.

Overview

Article 88 GDPR offers the Member States the possibility of regulating processing of data in the context of employment at a national level. For this, Article 88 lists a list of possible matters and sets certain requirements regarding adequacy to the GDPR and notification to the Commission.

Commentary

List of matters (Article 88(1) GDPR)

Article 88(1) offers a list of matters that the Member States may regulate. Such list is not an exhaustive list, and therefore Member States have freedom to regulate additional matters. As it is mentioned under section “Notification to the Commission”, several Member States have already regulated matters that were not expressly listed in Article 88, such as video surveillance in the work place regulation.

Adequacy to the GDPR (Article 88(2) GDPR)

Article 88(2) obliges Member States, when they regulate matters related to employment data, to include in their provisions suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.

Therefore, Article 88 allows Member States to pass national laws as long as they are in line with the GDPR. Although this is already a consequence deriving from the primacy of EU Regulations over national law, the GDPR opts for a clear mandate that seeks to ensure the protection of employee data. Hence, GDPR requirements are a minimum standard for Member States, but there is no impediment for a Member State to include stricter safeguards.

Meaning of employment context

The terms “employment” or “employee” are not defined in this Article or in the GDPR. Although there is hence no clear definition of what both terms include, following the Opinions issued by the Article 29 Working Party,[1] there shall be a certain degree of dependence on the employer from the employee side, which would exclude self-employed workers.[2]

Secondly, as the Article does not difference between public and private employment, it can therefore be considered that public servants are included in this concept.

Specific considerations

The Article 29 Working Party, in its Opinion on the processing of personal data in the employment context[3] makes a particular reference to consent in the context of an employment relationship. Consent, according to Article 7 GDPR, must be freely given. However, in an employment relationship exists an imbalance of power, so that employer and employee are never on the same level. Therefore, consent may not be freely given, but coerced because of the nature of such relationship, or because the employee may fear the consequences if refusing to give consent. Employees shall not rely on consent but on a legitimate interest or other legal basis.

On the other hand, the A29WP also establishes certain transparency requirements for the employer when processing employee data.[4] Employees shall be fully aware of every processing activity regarding their data. The employer shall provide their employees clear information when monitoring takes place, including the circumstances of such monitoring and possibilities to prevent so.

Regarding transfers of data within the same group of companies, Article 48 specifies that a controller may rely on legitimate interest to transfer data for processing by a different controller within the same group. However, in any case, legitimate interest shall be carefully assessed to ensure that the interests and the data subject are respected and do not override the interest of the controller.[5]

Notification to the Commission (Article 88(3) GDPR)

According to Article 88(3), Member States shall notify the Commission about any provisions in their national law pursuant to this Article. Currently, Austria, Bulgaria, Cyprus, the Czech Republic, Denmark, Estonia, Åland’s Finish province, France, Germany, Hungary, Ireland, Italy, Lithuania, Luxembourg, Poland, Romania, and Slovakia have issued notifications in this regard.[6]

For example, Italy makes reference in its national law to remote and home-work, compelling the employer to respect the employees’ personality and moral freedom.[7]

Slovakian law contains a provision that allows the employer to publish the data of its employees when it is necessary for the fulfillment of the jobs, providing that respect, dignity and safety of the data subject are respected.[8]

Irish national law additionally refers to the processing of special categories of personal data for purposes of employment and social welfare law.[9]

France has included in its national law provisions regarding video surveillance in the work place, individual information about salaries, or pay slip processing.[10]

Germany has included in its Federal law regulation for consent, special categories of data, video surveillance, the processing of employee data documentation, or for compensating employees for data breaches.[11]

Case law

The Court of Justice of the European Union has to this date dealt with several cases regarding the processing of personal data in the context of employment.[12]

In the Rundfonk case,[13] the CJEU regarded a case of publicly making available information about salaries of employees from the public sector, based on public interest. The Court ruled that inferences in their data protection right could be legitimate if they pursued a legitimate aim and were proportional.

In the Worten case,[14] the Court dealt with a case regarding the transfer of the working times of the employee to a national authority responsible of monitoring working conditions. The Court stated that the working times were considered personal data, as they can be related to an identifiable person, and that in order to make them available to a third party, they must be necessary to perform the monitoring task imposed to the public authority.

Currently, questions regarding distance learning and the data privacy implications, including processing of personal data from employees for videoconferencing, have been referred to the CJEU for consultation by a German administrative court.[15]

Decisions

→ You can find all related decisions in Category:Article 88 GDPR

References

  1. Referenced in the section below
  2. See also Selk, in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 88 GDPR, margin numbers 41-50 (Beck 2018, 2nd ed.) (accessed 30.04.2021)
  3. Article 29 Data Protection Working Party, Opinion 8/2001 on the processing of personal data in the employment context, 13 September 2001. Available at: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2001/wp48_en.pdf
  4. Article 29 Data Protection Working Party, Opinion 2/2017 on data processing at work, 8 June 2017
  5. See also Selk, in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 88 GDPR, margin numbers 175-177 (Beck 2018, 2nd ed.) (accessed 30.04.2021)
  6. Available at: https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu/eu-countries-gdpr-specific-notifications_en. Last accessed 30/04/20219
  7. Available at: https://ec.europa.eu/info/sites/default/files/it_notification_art_49_51_83_84_85_88_90.pdf. Last accessed 30/04/20219
  8. Available at: https://ec.europa.eu/info/sites/default/files/sk_notification_51.4_85.3_88.3_publish_0.pdf. Last accessed 30/04/20219
  9. Available at: http://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/pdf. Last accessed 30/04/20219
  10. Available at: https://ec.europa.eu/info/sites/default/files/fr_notification_gdpr_articles_49_51_84_85_88_90_publish.pdf. Last accessed 30/04/20219
  11. Available at: https://ec.europa.eu/info/sites/default/files/de_notification_articles_49.5_51.4_83.9_84.2_85.3_88.3_90.2_publish.pdf. Last accessed 30/04/20219
  12. Van Eecke/Simkus, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 88 GDPR, pp. 1232-1233 (Oxford University Press, Oxford, 2020)
  13. CJEU, Joined Cases G-465/00, C-138/01 and C-139/01, Osterreichischer Rundfank, 20 May 2003
  14. CJEU, Case C-342-12, Worten, 30 May 2013
  15. Available at: https://www.pinsentmasons.com/out-law/analysis/cjeu-to-rule-on-processing-of-personal-data-from-employees-for-videoconferencing. Last accessed: 30/04/2021