EU Regulators Issue An Updated Opinion On Processing Data In The Workplace

On June 29, 2017, the Article 29 Working Party (the EU body representing the data protection authorities (DPA) of each EU member country) issued an updated opinion regarding the processing of personal data in the workplace. Recognizing that employers are rapidly adopting new information technology, the opinion updates the Working Party's 2001 opinion regarding processing data in the employment context and 2002 opinion regarding the surveillance of electronic communications in the workplace. Additionally, the opinion provides guidance for processing employment data under the EU General Data Protection Regulation (GDPR), which becomes effective in May 2018.

The opinion reiterates that employers must have a legitimate legal basis to process employment-related data. The opinion confirms that employee consent cannot be used as the legal basis for the majority of processing because the unequal relationship between employers and employees casts doubt on the voluntariness of the employee's consent. Instead, employers must justify the processing of employee data under other legal grounds such as the performance of an employment contract (e.g., for pay purposes), compliance with legal obligations (e.g., for tax obligations or legitimate interests of the employer, which must be balanced against the fundamental privacy rights of employees).

The opinion provides guidance for processing data in the following, common employment scenarios:

Processing Applicant Data

Employers should not assume that they can process social media information about a candidate simply because the candidate's social media profile is publicly available. Rather, employers may review a candidate's social media information only if necessary and if the candidates are properly notified of the processing in the text of the job advertisement or by other means. Further, an employer cannot require potential employees to "friend" the employer or provide access to the contents of their profiles. Finally, employers are required to delete any data collected during the recruitment process as soon as it becomes clear that the employer will not be making an offer of employment or that the individual will not be accepting an offer.

Processing Social Media Data During or After Employment

Employers may not review or monitor employees' social media profiles to make employment decisions unless the employer can prove that such monitoring is necessary to protect legitimate interests (i.e., monitoring LinkedIn profiles of former employees to enforce non-compete obligations), there are no other less invasive means available, and the employees have been adequately informed about the extent of the monitoring.

Additionally, employers cannot require employees to use a social media profile provided by the employer, even where the profile is related to their jobs (e.g., as it may be for a spokesperson for an organization). Rather, employers must provide employees the option of a "non-work,"...