General principles

• Pages: 12-15

Protection of workers’ personal data

12

(4.1) The code does not make any distinction between the public and private sector,

as personal data are processed by all employers. The amount and the kind of information

retrieved may differ, but employers in both sectors gather data to assess the suitability of

workers for a specific occupation or to evaluate their performance. The personal dignity

of workers must be safeguarded, whether they work in a factory, an insurance company

or a government office. Rules on the use of personal data must therefore be designed to

protect both the workers of private firms and public servants.

(4.2) The code covers every form of processing, as experience shows that it is

impossible to draw a clear distinction between manual and automated retrieval.

Traditional file-keeping methods are increasingly combined with automated systems;

personnel information systems often store only a part of available data and refer for the

rest to files; and the results of electronic monitoring are frequently kept and evaluated in

a worker’s file. Any attempt to lay down rules for one specific form of processing would

therefore not be in the best interests of workers.

5. General principles

(5.1) The protection of workers depends first and foremost on clear restrictions on

the data collected. The code therefore limits processing to data that are directly relevant

to the employment of the worker. The mere fact that an employment contract is

considered or has already been concluded does not entitle an employer to gather any

information that he or she is interested in. The collection of personal data must, on the

contrary, be seen as an exception which needs to be justified. It is not the worker’s task

to inquire why certain information is wanted or to explain a refusal to provide it, but

rather the employer’s duty to indicate the reasons and to process only as much personal

data as is necessary.

By pointing to the need to establish the relevance of the data collected for the

individual employment relationship, the code defines the conditio sine qua non of any

processing of workers’ personal data. The criterion chosen might at first seem too vague.

But, attractive though it may be to specify all the data that are considered relevant, in

practice attempts to list them are simply futile, unless the enumeration is restricted to a

few data such as name, age, address and sex, the processing of which does not create

problems – at least as long as it is for strictly internal use by the employer and is

consistent with the law. What the employer must know can, in fact, only be determined

against the background of a particular employment situation. Both the amount and the

kind of information which can legitimately be sought change according to the type of

work, the position of the worker or the context of a decision which, for instance, might

affect structural changes within an enterprise. Instead of listing all the data which can be

processed, the code contains rules aimed at ensuring both the openness of the processing

and the awareness of the workers. The reference to the employment relationship is no

more than an indication of the framework within which the processing is generally

justified; the employers’ duty to ensure maximum transparency, so that workers know

the purpose for which any data are being processed, sets a clear and realistic limit on the

practice of data collection. Where workers tend to remain for their entire career with one

employer the reference to the employment relationship covers the processing of data that

are needed in connection with a normal development of a normal career within a

particular enterprise or government agency.