IP - 07121-1 / 2020/2260: Difference between revisions

From GDPRhub
(Created page with "{{DPAdecisionBOX |Jurisdiction=Slovenia |DPA-BG-Color= |DPAlogo=LogoSE.png |DPA_Abbrevation=IP |DPA_With_Country=IP (Slovenia) |Case_Number_Name=07121-1 / 2020/2260 |ECLI=...")
 
(LogoSE.png => LogoSI.png)
 
(9 intermediate revisions by 2 users not shown)
Line 3: Line 3:
|Jurisdiction=Slovenia
|Jurisdiction=Slovenia
|DPA-BG-Color=
|DPA-BG-Color=
|DPAlogo=LogoSE.png
|DPAlogo=LogoSI.png
|DPA_Abbrevation=IP
|DPA_Abbrevation=IP
|DPA_With_Country=IP (Slovenia)
|DPA_With_Country=IP (Slovenia)
Line 52: Line 52:
}}
}}


Employee participation in the production of the company's video greeting card. Opinion of Slovenian IP
The Slovenian DPA issued an opinion on the case of an employee participation in the production of a company's video greeting card under article 6 (1) and 4 (11) of the GDPR.


== English Summary ==
==English Summary==


=== Facts ===
===Facts===
A company’s director decides to prepare and send by e-mail to the clients a video greeting card. The video should be recorded by the workers at home under mandatory participation. The authority was requested to decide upon the legality of the director’s decision and upon the lawfulness of the processing of the workers’ personal data.  
A company’s director decides to prepare and send by e-mail to the clients a video greeting card. The video should be recorded by the workers at home under mandatory participation. The authority was requested to decide upon the legality of the director’s decision and upon the lawfulness of the processing of the workers’ personal data.  


=== Dispute ===
===Dispute===
Can the employer process employee’s personal data under the legal base of consent of article 6 (1) GDPR?
Can the employer process employee’s personal data under the legal base of consent of article 6 (1) GDPR?


=== Holding ===
===Holding===
The Slovenian DPA finds itself competent of deciding upon the legal basis and the conditions of a lawful processing. Article 6 (1) GDPR provides the conditions of lawful processing. Slovenia’s national legislation provides that employees’ personal data can be processed only if this is determined by law, or if it is necessary for the exercise of rights and obligations arising from the employment relationship or are related to the employment relationship. Due to the inequality of power in the employment relationship and for the protection of the employee, the processing is only possible in exceptional cases and provided that the individual can refuse consent. The consent of article 4 (11) GDPR will suffice only if it is voluntary, specific, informed and unambiguous.  The participation at the greeting video is only possible under voluntary consent, which means only if the employee can refuse without negative consequences.   
The Slovenian DPA finds itself competent of deciding upon the legal basis and the conditions of a lawful processing. Article 6 (1) GDPR provides the conditions of lawful processing. Slovenia’s national legislation provides that employees’ personal data can be processed only if this is determined by law, or if it is necessary for the exercise of rights and obligations arising from the employment relationship or are related to the employment relationship. Due to the inequality of power in the employment relationship and for the protection of the employee, the processing is only possible in exceptional cases and provided that the individual can refuse consent. The consent of article 4 (11) GDPR will suffice only if it is voluntary, specific, informed and unambiguous.  The participation at the greeting video is only possible under voluntary consent, which means only if the employee can refuse without negative consequences.   


== Comment ==
==Comment==
''Share your comments here!''
''Share your comments here!''


== Further Resources ==
==English Machine Translation of the Decision==
''Share blogs or news articles here!''
 
== English Machine Translation of the Decision ==
The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.
The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.
 
<pre> The Information Commissioner (hereinafter: IP) received your e-mail stating that the Director had decided to prepare a video greeting card for the clients, which would then be sent to the company's clients by e-mail. The video must be recorded by the workers at home, participation is mandatory. You wonder if this is allowed.
<pre>
<!DOCTYPE html><html lang="si"><head><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><meta name="viewport" content="width=device-width"><meta charset="utf-8"><!--
On the basis of the information you have provided to us, in accordance with Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data Directive 95/46 / EC (hereinafter the General Data Protection Regulation), point 7 of the first paragraph of Article 49 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 94/07-UPB1, hereinafter ZVOP-1) and 2 In accordance with Article of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05, hereinafter ZInfP), we provide our non-binding opinion on your question.
This website is powered by TYPO3 - inspiring people to share!
TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.
We emphasize at the outset that the IP cannot assess specific processing of personal data outside the inspection procedure or other administrative procedure. This means that in issuing an opinion, the IP can only draw attention to the relevant legal basis and the conditions that must be met for certain processing of personal data to be lawful.
TYPO3 is copyright 1998-2019 of Kasper Skaarhoj. Extensions are copyright of their respective owners.
Information and contribution at https://typo3.org/
P first explains that any processing of personal data must have an appropriate and lawful legal basis . These are set out in Article 6 (1) of the General Data Protection Regulation and are as follows:
--><link rel="shortcut icon" href="https://www.ip-rs.si/fileadmin//user_upload/favicon.ico" type="image/x-icon"><title> IP-RS :: Search engine according to GDPR </title><meta name="generator" content="TYPO3 CMS"><meta name="revisit-after" content="7 days"><meta name="robots" content="index,follow"><link rel="stylesheet" type="text/css" href="https://www.ip-rs.si/typo3temp/assets/css/b5ece644a2.css?1597648248" media="all"><link rel="stylesheet" type="text/css" href="https://www.ip-rs.si/typo3conf/ext/t3colorbox/Resources/Public/Css/1.5.13/example1/colorbox.css?1501572977" media="all"><link rel="stylesheet" type="text/css" href="https://www.ip-rs.si/typo3conf/ext/pxa_survey/Resources/Public/Css/pxa_survey.css?1592208471" media="all"><link rel="stylesheet" type="text/css" href="https://www.ip-rs.si/fileadmin/templates/css/styles.min.css?1605612107" media="all"><link rel="stylesheet" type="text/css" href="https://www.ip-rs.si/fileadmin/templates/css/fontawesome/cssFA/fontawesome-all.css?1527501832" media="all"><link rel="stylesheet" type="text/css" href="https://www.ip-rs.si/fileadmin/templates/css/user.css?1563862582" media="all"><script src="https://www.ip-rs.si/fileadmin/templates/js/jquery_2.1.3.min.js?1501510497" type="text/javascript"></script><script src="https://www.ip-rs.si/fileadmin/templates/js/bx.slider.js?1548401353" type="text/javascript"></script><script src="https://www.ip-rs.si/typo3temp/assets/js/9d57a8584e.js?1597648248" type="text/javascript"></script><link rel="schema.DCTERMS" href="http://purl.org/dc/terms/"><meta name="DCTERMS.title" content="Iskalnik po mnenjih GDPR"><meta name="copyright" content="x 2021 INFORMACIJSKI POOBLAŠČENEC"><meta name="DCTERMS.rights" content="x 2021 INFORMACIJSKI POOBLAŠČENEC"><meta name="date" content="2020-12-04T10:12:21+00:00"><meta name="DCTERMS.date" content="2020-12-04T10:12:21+00:00"><meta name="robots" content="index,follow"><link rel="start" href="https://www.ip-rs.si/zakonodaja/"><link rel="canonical" href="https://www.ip-rs.si/vop/"><meta property="og:title" content="Search engine according to GDPR"><meta property="og:type" content="article"></head><body class="p57" id="scheme4"><div class="page-h sub pr" id="scheme1"><header role="banner"><div class="row p pr"><img id="printLogo" src="https://www.ip-rs.si/fileadmin/templates/images/printLogo.gif" width="174" height="66" alt="Information Commissioner logo" /> <a class="logoIPRS ti pa" href="https://www.ip-rs.si/">Information Commissioner</a> <span class="logoRS ti pa">Republic of Slovenia</span><nav role="navigation"><ul id="mainNav"><li> <a href="https://www.ip-rs.si/zakonodaja/">Legislation</a><ul><li> <a href="https://www.ip-rs.si/zakonodaja/ustava/">Constitution</a></li><li> <a href="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/">Reform of the European legislative framework for the protection of personal data</a></li><li> <a href="https://www.ip-rs.si/zakonodaja/zakon-o-informacijskem-pooblascencu/">Information Commissioner Act</a></li><li> <a href="https://www.ip-rs.si/zakonodaja/zakon-o-varstvu-osebnih-podatkov/">Law on Protection of Personal Data</a></li><li> <a href="https://www.ip-rs.si/zakonodaja/zakon-o-dostopu-do-informacij-javnega-znacaja/">Access to Public Information Act</a></li><li> <a href="https://www.ip-rs.si/zakonodaja/zakon-o-inspekcijskem-nadzoru/">Inspection Act</a></li><li> <a href="https://www.ip-rs.si/zakonodaja/zakon-o-splosnem-upravnem-postopku/">The Law on General Administrative Procedure</a></li><li> <a href="https://www.ip-rs.si/zakonodaja/drugi-zakoni/">Other laws</a></li><li> <a href="https://www.ip-rs.si/nc/zakonodaja/mednarodni-predpisi/">International regulations</a></li><li> <a href="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2020/">Comments of the Information Commissioner on draft regulations</a></li></ul></li><li> <a href="https://www.ip-rs.si/obrazci/varstvo-osebnih-podatkov/">Forms</a><ul><li> <a href="https://www.ip-rs.si/obrazci/varstvo-osebnih-podatkov/" title="Forms in the field of personal data protection">Protection of personal data</a></li><li> <a href="https://www.ip-rs.si/obrazci/pravice-pacientov/" title="Patients&#39; rights forms">Patients&#39; rights</a></li><li> <a href="https://www.ip-rs.si/obrazci/informacije-javnega-znacaja/" title="Forms in the field of access to public information">Public information</a></li><li> <a href="https://www.ip-rs.si/obrazci/informacije-za-medije/" title="Media forms">Information for the media</a></li></ul></li><li> <a href="https://www.ip-rs.si/publikacije/letna-porocila/">Publications</a><ul><li> <a href="https://www.ip-rs.si/publikacije/letna-porocila/">Annual reports</a></li><li> <a href="https://www.ip-rs.si/publikacije/prirocniki-in-smernice/">Manuals and guidelines</a></li><li> <a href="https://www.ip-rs.si/publikacije/porocila/">Reports</a></li><li> <a href="https://www.ip-rs.si/publikacije/multimedija/">Multimedia</a></li></ul></li><li> <a href="https://www.ip-rs.si/o-pooblascencu/osebna-izkaznica/">About the Commissioner</a><ul><li> <a href="https://www.ip-rs.si/o-pooblascencu/osebna-izkaznica/">ID card</a></li><li> <a href="https://www.ip-rs.si/o-pooblascencu/zgodovina/" title="History of the Information Commissioner">History</a></li><li> <a href="https://www.ip-rs.si/o-pooblascencu/pristojnosti/">Responsibilities</a></li><li> <a href="https://www.ip-rs.si/o-pooblascencu/informacijska-pooblascenka/">Information Commissioner</a></li><li> <a href="https://www.ip-rs.si/o-pooblascencu/vodstvo/">Leadership</a></li><li> <a href="https://www.ip-rs.si/o-pooblascencu/generalna-sekretarka/">Secretary General</a></li><li> <a href="https://www.ip-rs.si/o-pooblascencu/zaposleni/">Employees</a></li><li> <a href="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/">Public information</a></li><li> <a href="https://www.ip-rs.si/o-pooblascencu/uporabne-povezave/">Useful links</a></li><li> <a href="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/">International operation of the Information Commissioner</a></li></ul></li></ul><select id="mobileNav"><option value="https://www.ip-rs.si/zakonodaja/"> Legislation</option><option value="https://www.ip-rs.si/zakonodaja/ustava/"> -Constitution </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/"> -Reform of the European legislative framework for the protection of personal data </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/aktualne-novice/"> --Uctual </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/"> --Key areas of the Regulation </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/pooblascena-oseba-za-varstvo-podatkov/"> --- Data protection officer </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/ocena-ucinka-v-zvezi-z-varstvom-podatkov/"> --- Data protection impact assessment </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/ocena-ucinka-v-zvezi-z-varstvom-podatkov/kriteriji-za-oceno-ustreznosti-izvedene-ocene-ucinkov/"> ---- Criteria for assessing the adequacy of the impact assessment carried out </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/privolitev/"> --- Consent </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/pogodbena-obdelava/"> --- Contract processing </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/evidenca-dejavnosti-obdelave/"> --- Records of processing activities </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/prijava-krsitev-varnosti/"> --- Reporting security breaches </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/najpogostejsa-vprasanja-in-odgovori/"> --Frequently asked questions and answers </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/uporabna-gradiva/"> --Useful materials </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/evropski-odbor-za-varstvo-podatkov/"> --European Data Protection Board </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/evropski-odbor-za-varstvo-podatkov/delovna-skupina-iz-clena-29-arhiv/"> --- Article 29 Working Party (archives) </option><option value="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/mnenja-in-smernice-ip/"> - IP opinions and guidelines</option><option value="https://www.ip-rs.si/zakonodaja/zakon-o-informacijskem-pooblascencu/"> -Information Commissioner Act</option><option value="https://www.ip-rs.si/zakonodaja/zakon-o-varstvu-osebnih-podatkov/"> -Law on Protection of Personal Data </option><option value="https://www.ip-rs.si/zakonodaja/zakon-o-varstvu-osebnih-podatkov/pravilnik-o-zaracunavanju-stroskov-pri-izvrsevanju-pravice-posameznika-do-seznanitve-z-lastnimi-osebnimi-podatki/"> --Rules on charging costs in the exercise of the individual&#39;s right to be acquainted with his or her own personal data </option><option value="https://www.ip-rs.si/zakonodaja/zakon-o-varstvu-osebnih-podatkov/pravilnik-o-metodologiji-vodenja-registra-zbirk-osebnih-podatkov/"> --Rules on the methodology of keeping the register of personal data collections </option><option value="https://www.ip-rs.si/zakonodaja/zakon-o-varstvu-osebnih-podatkov/pravilnik-o-pridobivanju-potrebnih-informacij-za-odlocanje-o-iznosu-osebnih-podatkov-v-tretje-drzave/"> --Rules on obtaining the necessary information to decide on the export of personal data to third countries </option><option value="https://www.ip-rs.si/zakonodaja/zakon-o-dostopu-do-informacij-javnega-znacaja/"> - Law on Access to Public Information </option><option value="https://www.ip-rs.si/zakonodaja/zakon-o-dostopu-do-informacij-javnega-znacaja/pravilnik-o-vzpostavitvi-in-vodenju-registra-zavezancev-za-informacije-javnega-znacaja/"> --Rules on the establishment and maintenance of the Register of persons liable for public information </option><option value="https://www.ip-rs.si/zakonodaja/zakon-o-dostopu-do-informacij-javnega-znacaja/uredba-o-posredovanju-in-ponovni-uporabi-informacij-javnega-znacaja/"> --Regulation on the transmission and re-use of public information</option><option value="https://www.ip-rs.si/zakonodaja/zakon-o-inspekcijskem-nadzoru/"> - Inspection Act</option><option value="https://www.ip-rs.si/zakonodaja/zakon-o-splosnem-upravnem-postopku/"> -The Law on General Administrative Procedure</option><option value="https://www.ip-rs.si/zakonodaja/drugi-zakoni/"> -Other laws</option><option value="https://www.ip-rs.si/zakonodaja/drugi-zakoni/kazenski-zakonik/"> --Criminal Code</option><option value="https://www.ip-rs.si/zakonodaja/drugi-zakoni/zakon-o-prekrskih/"> --The Misdemeanors Act</option><option value="https://www.ip-rs.si/zakonodaja/drugi-zakoni/zakon-o-upravnem-sporu/"> --Administrative Dispute Act</option><option value="https://www.ip-rs.si/zakonodaja/drugi-zakoni/zakon-o-upravnih-taksah/"> --Law on Administrative Fees</option><option value="https://www.ip-rs.si/zakonodaja/drugi-zakoni/zakon-o-tajnih-podatkih/"> --Law on Classified Information </option><option value="https://www.ip-rs.si/zakonodaja/drugi-zakoni/zakon-o-elektronskih-komunikacijah/"> --Law on Electronic Communications</option><option value="https://www.ip-rs.si/zakonodaja/drugi-zakoni/zakon-o-pacientovih-pravicah/">--Patient Rights Act</option><option value="https://www.ip-rs.si/zakonodaja/drugi-zakoni/zakon-o-medijih/"> --Media law</option><option value="https://www.ip-rs.si/zakonodaja/drugi-zakoni/zakon-o-bancnistvu/"> --Banking law</option><option value="https://www.ip-rs.si/zakonodaja/drugi-zakoni/zakon-o-ustavnem-sodiscu/"> --The Constitutional Court Act</option><option value="https://www.ip-rs.si/zakonodaja/drugi-zakoni/zakon-o-javnem-narocanju/"> --Public Procurement Act</option><option value="https://www.ip-rs.si/nc/zakonodaja/mednarodni-predpisi/"> -International regulations </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/"> -Comments of the Information Commissioner on draft regulations </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2020/"> --2020 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2019/"> --2019 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2018/"> --2018 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2017/"> --2017 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2016/"> --2016 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2015/"> --2015 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2014/"> --2014 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2013/"> --2013 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2012/"> --2012 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2011/"> --2011 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2010/"> --2010 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2009/"> --2009 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2008/"> --2008 </option><option value="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2007/"> --2007</option><option value="https://www.ip-rs.si/obrazci/"> Forms</option><option value="https://www.ip-rs.si/obrazci/varstvo-osebnih-podatkov/"> -Forms in the field of personal data protection</option><option value="https://www.ip-rs.si/obrazci/varstvo-osebnih-podatkov/koliko-stane/"> --How much does it cost?</option><option value="https://www.ip-rs.si/obrazci/pravice-pacientov/"> -Patient rights forms</option><option value="https://www.ip-rs.si/obrazci/informacije-javnega-znacaja/"> -Forms in the field of access to public information</option><option value="https://www.ip-rs.si/obrazci/informacije-javnega-znacaja/koliko-stane/"> --How much does it cost?</option><option value="https://www.ip-rs.si/obrazci/informacije-za-medije/"> - Media forms</option><option value="https://www.ip-rs.si/publikacije/"> Publications</option><option value="https://www.ip-rs.si/publikacije/letna-porocila/"> -Annual reports</option><option value="https://www.ip-rs.si/publikacije/prirocniki-in-smernice/"> -Manuals and guidelines </option><option value="https://www.ip-rs.si/publikacije/prirocniki-in-smernice/drustva-in-varstvo-osebnih-podatkov/"> --Companies and personal data protection</option><option value="https://www.ip-rs.si/publikacije/porocila/"> -Reports</option><option value="https://www.ip-rs.si/publikacije/multimedija/"> -Multimedia</option><option value="https://www.ip-rs.si/publikacije/multimedija/samo-za-mlade/"> --Only for young people</option><option value="https://www.ip-rs.si/o-pooblascencu/"> About the Commissioner</option><option value="https://www.ip-rs.si/o-pooblascencu/osebna-izkaznica/"> -ID card</option><option value="https://www.ip-rs.si/o-pooblascencu/zgodovina/"> -History of the Information Commissioner</option><option value="https://www.ip-rs.si/o-pooblascencu/pristojnosti/"> - Politeness</option><option value="https://www.ip-rs.si/o-pooblascencu/pristojnosti/varstvo-osebnih-podatkov/">--Privacy protection </option><option value="https://www.ip-rs.si/o-pooblascencu/pristojnosti/varstvo-osebnih-podatkov/zakon-o-elektronskih-komunikacijah/"> --- Electronic Communications Act </option><option value="https://www.ip-rs.si/o-pooblascencu/pristojnosti/varstvo-osebnih-podatkov/zakon-o-pacientovih-pravicah/"> --- Patients&#39; Rights Act </option><option value="https://www.ip-rs.si/o-pooblascencu/pristojnosti/varstvo-osebnih-podatkov/zakon-o-osebni-izkaznici-in-zakon-o-potnih-listinah/"> --- Identity Card Act and Travel Documents Act </option><option value="https://www.ip-rs.si/o-pooblascencu/pristojnosti/varstvo-osebnih-podatkov/zakon-o-bancnistvu/"> ---Banking law </option><option value="https://www.ip-rs.si/o-pooblascencu/pristojnosti/varstvo-osebnih-podatkov/zakon-o-potrosniskih-kreditih/"> --- Consumer Credit Act </option><option value="https://www.ip-rs.si/o-pooblascencu/pristojnosti/varstvo-osebnih-podatkov/uredba-o-sistemih-brezpilotnih-zrakoplovov/"> --- Regulation on unmanned aerial vehicle systems </option><option value="https://www.ip-rs.si/o-pooblascencu/pristojnosti/varstvo-osebnih-podatkov/uredba-o-izvajanju-uredbe-o-drzavljanski-pobudi/"> --- Regulation on the implementation of the Regulation on the citizens&#39; initiative </option><option value="https://www.ip-rs.si/o-pooblascencu/pristojnosti/varstvo-osebnih-podatkov/konvencija-o-izvajanju-schengenskega-sporazuma/"> --- Convention Implementing the Schengen Agreement </option><option value="https://www.ip-rs.si/o-pooblascencu/pristojnosti/informacije-javnega-znacaja/"> --Public information</option><option value="https://www.ip-rs.si/o-pooblascencu/informacijska-pooblascenka/"> -Information Commissioner</option><option value="https://www.ip-rs.si/o-pooblascencu/vodstvo/"> -Leadership</option><option value="https://www.ip-rs.si/o-pooblascencu/generalna-sekretarka/"> - Secretary General</option><option value="https://www.ip-rs.si/o-pooblascencu/zaposleni/"> -Employees</option><option value="https://www.ip-rs.si/o-pooblascencu/zaposleni/svetovalci/"> --Consultants</option><option value="https://www.ip-rs.si/o-pooblascencu/zaposleni/drzavni-nadzorniki/"> --State Supervisors</option><option value="https://www.ip-rs.si/o-pooblascencu/zaposleni/raziskovalci/"> --Researchers</option><option value="https://www.ip-rs.si/o-pooblascencu/zaposleni/drugi-zaposleni/"> --Other employees</option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/"> -Public information </option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/javni-natecaji/"> --Public tenders </option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/javni-natecaji/arhiv-javnih-natecajev/"> --- Archive of public tenders </option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/javni-razpisi/"> --Public tenders </option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/javni-razpisi/arhiv-javih-razpisov/"> --- Archive of public tenders </option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/javna-narocila/"> --Public orders </option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/javna-narocila/arhiv-javnih-narocil/"> --- Public Procurement Archive </option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/katalog-informacij-javnega-znacaja/"> --Catalogue of public information </option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/interni-akti-informacijskega-pooblascenca/"> --Internal acts of the Information Commissioner </option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/letna-porocila/"> --Annual reports </option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/o-spletni-strani/"> --About the website </option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/informacije-o-obdelavi-osebnih-podatkov/"> --Information on the processing of personal data </option><option value="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/izjava-o-dostopnosti-spletne-strani/"> --Declaration of website accessibility</option><option value="https://www.ip-rs.si/o-pooblascencu/uporabne-povezave/"> -Useful links </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/"> -International operation of the Information Commissioner </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/initiative-20i7/"> --Initiative 20i7 </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/"> --Participation in international working bodies </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/vis/"> --- VIS </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/wp-29/"> --- WP 29 </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/iwgdpt/"> --- IWGDPT </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/europol/"> --- Europol </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/sis/"> --- SIS </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/sis-pravni-okvir/"> --- SIS - Legal framework </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/sis-kateri-osebni-podatki-se-obdelujejo-v-sis-ii/"> --- SIS - What personal data is processed in SIS II? </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/sis-kdo-lahko-uporablja-podatke-iz-sis-ii/"> --- SIS - Who can use SIS II data? </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/sis-kaj-je-urad-sirene/"> --- SIS - What is the SIRENE Bureau? </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/sis-kdo-izvaja-nadzor-nad-obdelavo-osebnih-podatkov-v-okviru-sis-ii/"> --- SIS - Who controls the processing of personal data under SIS II? </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/sis-kaksne-pravice-imam-v-zvezi-z-obdelavo-mojih-osebnih-podatkov-v-sis-ii/"> --- SIS - What rights do I have regarding the processing of my personal data in SIS II? </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/cis/"> --- CIS </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/eurodac/"> --- Eurodac </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/sodelovanje-v-mednarodnih-delovnih-telesih/t-pd/"> --- T-PD </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/evropski-odbor-za-varstvo-podatkov/"> --European Data Protection Board </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/mednarodna-konferenca-pooblascencev-za-varstvo-podatkov-in-zasebnost-icdpcc/"> --ICDPCC International Conference of Data Protection and Privacy Commissioners </option><option value="https://www.ip-rs.si/o-pooblascencu/mednarodno-delovanje-informacijskega-pooblascenca/pravice-posameznika-v-zvezi-z-mednarodnimi-zbirkami-osebnih-podatkov/"> --Individual rights in relation to international personal data files</option></select></nav><div class="pa lang"> <a href="https://www.ip-rs.si/index.php?id=883"><img src="https://www.ip-rs.si/fileadmin/user_upload/jpg/iskalnik.png" height="22" width="22"></a> <a href="https://www.ip-rs.si/index.php?id=884"><img src="https://www.ip-rs.si/fileadmin/user_upload/jpg/gluhi.png" height="22" width="22"></a> <a href="https://www.ip-rs.si/vop/">SLO</a> | <a href="https://www.ip-rs.si/en/vop/">ENG</a> </div><!--
• consent (point (a)),
    <div class="pa search">
• the conclusion or performance of a contract (point (b)),
 
• law (point (c)),
    <form action="/skupno/iskalnik/" method="GET"><input type="text" class="q" name="q" value="" placeholder="Iskalnik"><button class="submit"><i class="fa fa-search"></i></button></form>
• protection of the vital interests of the individual (point (d)),
   
• implementation of a public task (point (e) in connection with the fourth paragraph of Article 9 of ZVOP-1),
    </div>
• legitimate interests of the operator (point (f)).
--></div></header><div class="slider"><div id="heroImage"><img src="https://www.ip-rs.si/fileadmin/_processed_/9/8/csm_vop_banner2.1_a99bc83b50.jpg" width="1160" height="200" alt="dekorativna slika" title="Protection of personal data" /><!--
 
The field of labor law is specially regulated in special laws, especially in the Employment Relationships Act (Official Gazette of the Republic of Slovenia, No. 21/13, as amended; hereinafter ZDR-1) and in the Labor and Social Security Records Act ( Official Gazette of the Republic of Slovenia, No. 40/06; hereinafter ZEPDSV). Pursuant to the first paragraph of Article 48 of ZDR-1, personal data of employees may be collected, processed, used and transmitted to third parties only if this is determined by this or another law or if it is necessary for the exercise of rights and obligations arising from employment or in employment relationship. The types and content of records in the field of work and social security are determined in the ZEPDSV.
        <div class="slide-desc">
 
This means that the employer may process only those personal data of employees that are necessary for the exercise of rights and obligations arising from the employment relationship or are related to the employment relationship or are determined by the ZEPDSV . The IP clarifies that the personal data of employees, which can be processed by the employer if this is necessary for the exercise of rights and obligations arising from the employment relationship or in connection with the employment relationship, must be assessed on a case-by-case basis. It is up to the employer to explain why the employee needs certain personal data in order to exercise the rights and obligations arising from the employment relationship or in connection with the employment relationship.
         
 
According to IP, the case you described in your communication most likely does not represent the exercise of rights and obligations arising from the employment relationship or in relation to the employment relationship, which could be the legal basis on which the employer could obtain your recordings for making a video greeting card is given in point (a) of Article 6 (1) of the General Regulation, namely the consent of each employee .
              <h2>
 
Regarding consent  to the processing of personal data of employees, IP points out that consent in employment in relation to the above employment law applies only to those personal data that are not related to the exercise of rights and obligations arising from employment or not related to employment. Due to the pronounced inequality of power of the parties in employment relations or due to the protection of the employee, who is a weaker party in relation to the employer, the legislator regulated this area more strictly. Therefore, the processing of personal data on the basis of consent in this area is only possible in exceptional cases and provided that the individual can indeed refuse consent without any consequences for the employment relationship.
                <a href="https://www.ip-rs.si/varstvo-osebnih-podatkov/">
 
Article 4 (11) of the General Regulation provides that the consent of an individual may only be:
                  Varstvo osebnih podatkov
1. voluntary,
 
2. specific,
                </a>
3. informed and
 
4. unambiguous.
              </h2>
 
Voluntary consent means the actual selection and control of the data subject. Consent is thus not valid if the data subject has no real choice if he feels compelled to consent or if he will suffer negative consequences if he does not consent. If the consent is tied to conditions that cannot be negotiated, or if the individual cannot refuse or revoke the transfer of personal data without prejudice, the consent is not given validly, consequently such processing of personal data is without a legal basis, or illegal.
           
 
The European Data Protection Board (EDPB) in Guideline no. 05/2020 on consent under Regulation 2016/679, adopted on 4 May 2020, highlighted in point 23 a case similar to the one described, in which it describes a case of duly obtained consent (and its refusal) in the case of the dismissal of employees. An example is given of a film crew that will shoot in one part of the office. In such a case, the employer can ask all employees sitting in this part of the office to consent to the recording, as they may appear in the background of the video. Those who do not wish to be filmed should not be penalized in any way for doing so, but are provided with equivalent office conditions in other premises for the duration of the filming. You can read more about this in the guidelines at the following link:  https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_sl.pdf.
        </div>
      --></div></div><div class="page pr"><div class="row"><nav class="c3 sideNav"><ul><li> <a href="https://www.ip-rs.si/varstvo-osebnih-podatkov/iskalnik-po-odlocbah-in-mnenjih/mnenja-gdpr/">Opinions - GDPR</a></li><li> <a href="https://www.ip-rs.si/varstvo-osebnih-podatkov/iskalnik-po-odlocbah-in-mnenjih/odlocbe-in-mnenja-vop/">Decisions and opinions - Protection of personal data</a></li><li> <a href="https://www.ip-rs.si/varstvo-osebnih-podatkov/iskalnik-po-odlocbah-in-mnenjih/sodbe-upravnega-sodisca/">Judgments of the Administrative Court</a></li><li> <a href="https://www.ip-rs.si/varstvo-osebnih-podatkov/iskalnik-po-odlocbah-in-mnenjih/zahteve-za-oceno-ustavnosti/">Requirements for constitutional review</a></li><li> <a href="https://www.ip-rs.si/zakonodaja/pripombe-informacijskega-pooblascenca-na-predloge-predpisov/2020/">Comments of the Information Commissioner on draft regulations</a></li><li> <a href="https://www.ip-rs.si/varstvo-osebnih-podatkov/iskalnik-po-odlocbah-in-mnenjih/sodbe-mednarodnih-sodisc/">Judgments of international courts</a> </li></ul></nav><article class="c9"><!--TYPO3SEARCH_begin--><header class="pr"><nav class="breadcrumbs"> <a href="https://www.ip-rs.si/">Home</a> &gt; Search engine according to GDPR</nav><h1> Search engine according to GDPR</h1> <i class="fa fa-font" id="zoomIn">+</i> <i class="fa fa-font" id="zoomOut">-</i><a href="javascript:window.print()"><i class="fa fa-print" id="print"></i></a> </header><!--  CONTENT ELEMENT, uid:2320/list [begin] --><div id="c2320" class="csc-frame csc-frame-default"><!--  Plugin inserted: [begin] --><div><div> <b>Date:</b> 16.12.2020</div><div> <b>Title:</b> Employee participation in the production of the company&#39;s video greeting card</div><div> <b>Number:</b> 07121-1 / 2020/2260</div><div> <b>Subject matter:</b> Employment, Legal basis, Assent</div><div> <b>Legal act:</b> Opinion</div></div><br><div><p class="bodytext"> <em>The Information Commissioner (hereinafter: IP) received your e-mail stating that the Director had decided to prepare a video greeting card for the clients, which would then be sent to the company&#39;s clients by e-mail. The video must be recorded by the workers at home, participation is mandatory. You wonder if this is allowed.</em></p><p class="bodytext"></p><p class="bodytext"> On the basis of the information you have provided to us, in accordance with Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data Directive 95/46 / EC (hereinafter the General Data Protection Regulation), point 7 of the first paragraph of Article 49 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 94/07-UPB1, hereinafter ZVOP-1) and 2 In accordance with Article of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05, hereinafter ZInfP), we provide our non-binding opinion on your question.</p><p class="bodytext"></p><p class="bodytext"> We emphasize at the outset that the IP cannot assess specific processing of personal data outside the inspection procedure or other administrative procedure. This means that in issuing an opinion, the IP can only draw attention to the relevant legal basis and the conditions that must be met for certain processing of personal data to be lawful.</p><p class="bodytext"></p><p class="bodytext"> P first explains that any processing of personal data must have an <strong>appropriate and lawful legal basis</strong> . These are set out in Article 6 (1) of the General Data Protection Regulation and are as follows:</p><ul><li> <strong>consent</strong> (point (a)),</li><li> the conclusion or performance of a <strong>contract</strong> (point (b)),</li><li> <strong>law</strong> (point (c)),</li><li> protection of the <strong>vital interests of the</strong> individual (point (d)),</li><li> implementation of a <strong>public task</strong> (point (e) in connection with the fourth paragraph of Article 9 of ZVOP-1),</li><li> <strong>legitimate interests of the operator</strong> (point (f)).</li></ul><p class="bodytext"></p><p class="bodytext"> The field of labor law is specially regulated in special laws, especially in the Employment Relationships Act (Official Gazette of the Republic of Slovenia, No. 21/13, as amended; hereinafter ZDR-1) and in the Labor and Social Security Records Act ( Official Gazette of the Republic of Slovenia, No. 40/06; hereinafter ZEPDSV). Pursuant to the first paragraph of Article 48 of ZDR-1, personal data of employees may be collected, processed, used and transmitted to third parties only if this is determined by this or another law or if it is necessary for the exercise of rights and obligations arising from employment or in employment relationship. The types and content of records in the field of work and social security are determined in the ZEPDSV.</p><p class="bodytext"></p><p class="bodytext"> This means that the employer may process only those personal data of employees that are necessary for the <strong>exercise of rights and obligations arising from the employment relationship or are related to the employment relationship</strong> or are <strong>determined</strong> by <strong>the ZEPDSV</strong> . The IP explains that the personal data of employees, which can be processed by the employer if it is necessary for the exercise of rights and obligations arising from the employment relationship or in connection with the employment relationship, must be assessed on a case-by-case basis. It is up to the employer to explain why the employee needs certain personal data in order to exercise the rights and obligations arising from the employment relationship or in connection with the employment relationship.</p><p class="bodytext"></p><p class="bodytext"> According to IP, the case you described in your communication most likely does not represent the exercise of rights and obligations arising from the employment relationship or in relation to the employment relationship, which could be the legal basis on which the employer could obtain your recordings for production of a video greeting card is given in point (a) of Article 6 (1) of the General Regulation, namely the <strong>consent of each employee</strong> .</p><p class="bodytext"></p><p class="bodytext"> Regarding <strong>consent</strong> to the processing of personal data of employees, IP points out that consent in employment in relation to the above labor law applies only to those personal data that are not related to the exercise of rights and obligations arising from employment or not related to employment. Due to the marked inequality of power of the parties in employment relations or due to the protection of the employee, who is a weaker party in relation to the employer, the legislator regulated this area more strictly. Therefore, the processing of personal data on the basis of consent in this area is only possible in <strong>exceptional cases</strong> and <strong>provided that the individual can indeed refuse consent without any consequences for the employment relationship.</strong></p><p class="bodytext"></p><p class="bodytext"> Article 4 (11) of the General Regulation provides that the consent of an individual may only be:</p><ol><li> <strong>voluntary,</strong></li><li> concrete,</li><li> informed and</li><li> unambiguous.</li></ol><p class="bodytext"></p><p class="bodytext"> <strong>Voluntary consent</strong> means the actual selection and control of the data subject. Consent is thus not valid if the data subject has no real choice if he feels compelled to consent or if he will suffer negative consequences if he does not consent. If the consent is tied to conditions that cannot be negotiated, or if the individual cannot refuse or revoke the transfer of personal data without prejudice, the consent is not given validly, consequently such processing of personal data is without a legal basis, or illegal.</p><p class="bodytext"></p><p class="bodytext"> The European Data Protection Board (EDPB) in Guideline no. 05/2020 on consent under Regulation 2016/679, adopted on 4 May 2020, highlighted in point 23 a case similar to the one described, in which it describes the case of duly obtained consent (and its refusal) in the case of the dismissal of employees. An example is given of a film crew that will shoot in one part of the office. In such a case, the employer can ask all employees sitting in this part of the office to consent to the recording, as they may appear in the background of the video. Those who do not wish to be filmed should not be penalized in any way for doing so, but are provided with equivalent office conditions in other premises for the duration of the filming. You can read more about this in the guidelines at the following link: <a href="https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_sl.pdf" target="_blank">https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf</a> .</p><p class="bodytext"></p><p class="bodytext"> <strong>In view of the above, IP concludes that the participation of employees in the preparation of the company&#39;s video greeting card is generally only possible with the consent of employees. The acquisition can be voluntary, which means that the employee can refuse it without suffering any negative consequences.</strong></p><p class="bodytext"></p><p class="bodytext"> You can also read about how personal data is protected in employment relationships in the IP brochure, which illustrates everything you need to know about the protection of personal data in employment relationships in a simple way, with many examples and pictorial material. It can be found at the following link: <a href="https://www.ip-rs.si/fileadmin/user_upload/Pdf/brosure/brosura_delovna_populacija.pdf" target="_blank">https://www.ip-rs.si/fileadmin/user_upload/Pdf/brosure/brosura_delovna_populacija.pdf</a> .</p><p class="bodytext"></p><p class="bodytext"> We advise you to read more about the rights of the individual regarding data protection on our website www.tiodločaš.si.</p><p class="bodytext"></p><p class="bodytext"> All IP opinions are published and available on our website: <a href="https://www.ip-rs.si/vop/" target="_blank">https://www.ip-rs.si/vop/</a> .</p><p class="bodytext"></p><p class="bodytext"> Also, all key areas as regulated by the General Regulation on Data Protection are presented at: <a href="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/" target="_blank">https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna -areas-of-regulation /</a> , where you can find a lot of useful advice on the essential obligations of companies and other organizations for the proper implementation of personal data protection measures.</p><p class="bodytext"></p><p class="bodytext"> Greetings,</p><p class="bodytext"></p><p class="bodytext"> Mojca Prelesnik,</p><p class="bodytext"> Information Commissioner</p><p class="bodytext"></p><p class="bodytext"> mag. Vanja Zrimšek, B.Sc. dipl. right,<br /> IP consultant </p><p class="bodytext"></p><p class="bodytext"></p><p class="bodytext"><img height="60" src="https://www.ip-rs.si/fileadmin/_processed_/a/d/csm_iDecide_Logo_breznapisa_6a4d7a39e6.png" width="300" alt="IDecide project logo" /></p><p class="bodytext"> This opinion was developed in the framework of the project &quot;Justice, Equality and Citizenship Program 2014-2020&quot;, funded by the European Union.</p><p class="bodytext"></p><p class="bodytext"> The content of this opinion is an optional opinion of the Information Commissioner and is his sole responsibility. The European Commission does not accept responsibility for any use which may be made of the information contained therein.</p><p class="bodytext"></p></div><div> <a href="javascript:history.back();">Back</a> </div><!--  Plugin inserted: [end] --></div><!--  CONTENT ELEMENT, uid:2320/list [end] --><!--TYPO3SEARCH_end--></article></div></div><footer><div class="row"><address class="c3"> <strong class="title">ABOUT US</strong><p class="bodytext"> <strong>Information Commissioner</strong></p><p class="bodytext"> <strong>Dunajska cesta 22</strong></p><p class="bodytext"> <strong>1000 Ljubljana, Slovenia</strong></p><p class="bodytext"></p><p class="bodytext"> <a href="https://www.ip-rs.si/fileadmin/user_upload/png/zemljevid_IPRS.PNG" title="Initiates file download">Map</a> (source: najdi.si)</p><p class="bodytext"> T: 01 230 97 30<br /> F: 01 230 97 78</p><p class="bodytext"> E-mail: <a href="javascript:linkTo_UnCryptMailto('iwehpk6cl:elWel9no:oe');">gp.ip (at) ip-rs.si</a><br /> Reporting violations: <a href="https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/prijava-krsitev/" target="_blank">instructions and form</a></p></address><div class="c3"> <strong class="title">OFFICE HOURS</strong><p class="bodytext"> <strong>MON - FRI</strong></p><p class="bodytext"> 10.00 - 12.00 and 14.00 - 15.00</p><p class="bodytext"></p><p class="bodytext"> A personal visit is only possible with prior notice to the above e-mail address or telephone number.</p></div><div class="c3 h1"> <strong class="title">LINKS</strong><!--  CONTENT ELEMENT, uid:1350/html [begin] --><div id="c1350" class="csc-frame csc-frame-default"><!--  Raw HTML content: [begin] --><p> <a href="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/">Public information</a></p><p> <a href="https://www.ip-rs.si/publikacije/prirocniki-in-smernice/" title="In the guidelines, personal file managers can find answers to the most frequently asked questions in each area of personal data protection. The guidelines also provide quick guides, checklists, and examples of good and bad practice.">Manuals and guidelines</a></p><p> <a href="https://www.ip-rs.si/obrazci/varstvo-osebnih-podatkov/" title="Forms">Forms</a></p><p> <a href="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/o-spletni-strani/" title="About the website">Privacy policy</a></p><p> <a href="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/informacije-o-obdelavi-osebnih-podatkov/" title="About the website">Information on the processing of personal data</a></p><p> <a href="https://www.ip-rs.si/o-pooblascencu/informacije-javnega-znacaja/izjava-o-dostopnosti-spletne-strani/" target="_blank">Website Accessibility Statement</a></p><p> <a href="https://www.upravljavec.si" target="_blank">Support for small businesses</a></p><p> <a href="https://www.tiodlocas.si" target="_blank">Rights of individuals</a> </p><!--  Raw HTML content: [end] --></div><!--  CONTENT ELEMENT, uid:1350/html [end] --></div><div class="c3 pr"><div class="h1"><strong class="title"></strong><div class="cb-textpic" id="cb1351"><a name="c1351"></a><div class="cb-center cb-ic2 layout0"></div><p class="bodytext"> Telephone counseling in the field of personal data protection takes place within the project &quot;Justice, Equality and Citizenship Program 2014-2020&quot;, funded by the European Union. </p><p class="bodytext"><img height="44" src="https://www.ip-rs.si/fileadmin/_processed_/d/7/csm_iDecide_Logo_breznapisa_nogastrani_e14a48342f.png" width="220" alt="IDecide project logo" /></p></div></div></div></div></footer></div><script src="https://www.ip-rs.si/typo3conf/ext/t3colorbox/Resources/Public/JavaScript/jquery.colorbox-1.5.13.min.js?1501572991" type="text/javascript"></script><script src="https://www.ip-rs.si/typo3conf/ext/pxa_survey/Resources/Public/JavaScript/Survey.js?1573637584" type="text/javascript"></script><script src="https://www.ip-rs.si/fileadmin/templates/js/scripts.min.js?1501510497" type="text/javascript"></script><script src="https://www.ip-rs.si/typo3conf/ext/pxa_survey/Resources/Public/JavaScript/pxa_survey.js?1573637584" type="text/javascript"></script><script src="https://www.ip-rs.si/typo3temp/assets/js/2619955b93.js?1597648248" type="text/javascript"></script></body></html>
In view of the above, IP concludes that the participation of employees in the preparation of the company's video greeting card is generally only possible with the consent of the employees. The acquisition can be voluntary, which means that the employee can reject it without suffering any negative consequences.
</pre>
</pre>

Latest revision as of 23:06, 10 February 2021

IP - 07121-1 / 2020/2260
LogoSI.png
Authority: IP (Slovenia)
Jurisdiction: Slovenia
Relevant Law: Article 4(11) GDPR
Article 4(11) GDPR
Article 6(1) GDPR
Type: Advisory Opinion
Outcome: n/a
Started:
Decided: 16.12.2020
Published:
Fine: None
Parties: n/a
National Case Number/Name: 07121-1 / 2020/2260
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Slovenian
Original Source: IP SLOVENIA (in SL)
Initial Contributor: n/a

The Slovenian DPA issued an opinion on the case of an employee participation in the production of a company's video greeting card under article 6 (1) and 4 (11) of the GDPR.

English Summary

Facts

A company’s director decides to prepare and send by e-mail to the clients a video greeting card. The video should be recorded by the workers at home under mandatory participation. The authority was requested to decide upon the legality of the director’s decision and upon the lawfulness of the processing of the workers’ personal data.

Dispute

Can the employer process employee’s personal data under the legal base of consent of article 6 (1) GDPR?

Holding

The Slovenian DPA finds itself competent of deciding upon the legal basis and the conditions of a lawful processing. Article 6 (1) GDPR provides the conditions of lawful processing. Slovenia’s national legislation provides that employees’ personal data can be processed only if this is determined by law, or if it is necessary for the exercise of rights and obligations arising from the employment relationship or are related to the employment relationship. Due to the inequality of power in the employment relationship and for the protection of the employee, the processing is only possible in exceptional cases and provided that the individual can refuse consent. The consent of article 4 (11) GDPR will suffice only if it is voluntary, specific, informed and unambiguous. The participation at the greeting video is only possible under voluntary consent, which means only if the employee can refuse without negative consequences.

Comment

Share your comments here!

English Machine Translation of the Decision

The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.

 The Information Commissioner (hereinafter: IP) received your e-mail stating that the Director had decided to prepare a video greeting card for the clients, which would then be sent to the company's clients by e-mail. The video must be recorded by the workers at home, participation is mandatory. You wonder if this is allowed.
 
On the basis of the information you have provided to us, in accordance with Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data Directive 95/46 / EC (hereinafter the General Data Protection Regulation), point 7 of the first paragraph of Article 49 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 94/07-UPB1, hereinafter ZVOP-1) and 2 In accordance with Article of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05, hereinafter ZInfP), we provide our non-binding opinion on your question.
 
We emphasize at the outset that the IP cannot assess specific processing of personal data outside the inspection procedure or other administrative procedure. This means that in issuing an opinion, the IP can only draw attention to the relevant legal basis and the conditions that must be met for certain processing of personal data to be lawful.
 
P first explains that any processing of personal data must have an appropriate and lawful legal basis . These are set out in Article 6 (1) of the General Data Protection Regulation and are as follows:
•	consent (point (a)),
•	the conclusion or performance of a contract (point (b)),
•	law (point (c)),
•	protection of the vital interests of the individual (point (d)),
•	implementation of a public task (point (e) in connection with the fourth paragraph of Article 9 of ZVOP-1),
•	legitimate interests of the operator (point (f)).
 
The field of labor law is specially regulated in special laws, especially in the Employment Relationships Act (Official Gazette of the Republic of Slovenia, No. 21/13, as amended; hereinafter ZDR-1) and in the Labor and Social Security Records Act ( Official Gazette of the Republic of Slovenia, No. 40/06; hereinafter ZEPDSV). Pursuant to the first paragraph of Article 48 of ZDR-1, personal data of employees may be collected, processed, used and transmitted to third parties only if this is determined by this or another law or if it is necessary for the exercise of rights and obligations arising from employment or in employment relationship. The types and content of records in the field of work and social security are determined in the ZEPDSV.
 
This means that the employer may process only those personal data of employees that are necessary for the exercise of rights and obligations arising from the employment relationship or are related to the employment relationship or are determined by the ZEPDSV . The IP clarifies that the personal data of employees, which can be processed by the employer if this is necessary for the exercise of rights and obligations arising from the employment relationship or in connection with the employment relationship, must be assessed on a case-by-case basis. It is up to the employer to explain why the employee needs certain personal data in order to exercise the rights and obligations arising from the employment relationship or in connection with the employment relationship.
 
According to IP, the case you described in your communication most likely does not represent the exercise of rights and obligations arising from the employment relationship or in relation to the employment relationship, which could be the legal basis on which the employer could obtain your recordings for making a video greeting card is given in point (a) of Article 6 (1) of the General Regulation, namely the consent of each employee .
 
Regarding consent  to the processing of personal data of employees, IP points out that consent in employment in relation to the above employment law applies only to those personal data that are not related to the exercise of rights and obligations arising from employment or not related to employment. Due to the pronounced inequality of power of the parties in employment relations or due to the protection of the employee, who is a weaker party in relation to the employer, the legislator regulated this area more strictly. Therefore, the processing of personal data on the basis of consent in this area is only possible in exceptional cases and provided that the individual can indeed refuse consent without any consequences for the employment relationship.
 
Article 4 (11) of the General Regulation provides that the consent of an individual may only be:
1.	voluntary,
2.	specific,
3.	informed and
4.	unambiguous.
 
Voluntary consent means the actual selection and control of the data subject. Consent is thus not valid if the data subject has no real choice if he feels compelled to consent or if he will suffer negative consequences if he does not consent. If the consent is tied to conditions that cannot be negotiated, or if the individual cannot refuse or revoke the transfer of personal data without prejudice, the consent is not given validly, consequently such processing of personal data is without a legal basis, or illegal.
 
The European Data Protection Board (EDPB) in Guideline no. 05/2020 on consent under Regulation 2016/679, adopted on 4 May 2020, highlighted in point 23 a case similar to the one described, in which it describes a case of duly obtained consent (and its refusal) in the case of the dismissal of employees. An example is given of a film crew that will shoot in one part of the office. In such a case, the employer can ask all employees sitting in this part of the office to consent to the recording, as they may appear in the background of the video. Those who do not wish to be filmed should not be penalized in any way for doing so, but are provided with equivalent office conditions in other premises for the duration of the filming. You can read more about this in the guidelines at the following link:   https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_sl.pdf.
 
In view of the above, IP concludes that the participation of employees in the preparation of the company's video greeting card is generally only possible with the consent of the employees. The acquisition can be voluntary, which means that the employee can reject it without suffering any negative consequences.