Individual rights

• Pages: 22-24

Protection of workers’ personal data

22

processing. The confirmation could also clarify that the primary responsibility for a

correct processing of the data lies with the third party.

Communication of data is normally understood to mean the transmission of data to

third parties. However, the requirement that processing be restricted to specific purposes

can be fulfilled only if one applies a broader concept which explicitly includes internal

transmissions. Neither private enterprises nor government offices can be regarded as

information units within which personal data may freely circulate. In addition to the

general information to be provided by employers on the processing of personal data

under section 8.3, the code also calls for limiting internal communications. Employers

should give information to individual workers about the purposes for which their

personal data are internally processed (10.5). The code does not, however, expect

employers to inform workers concerned of each communication. In most cases the

communications which are regularly effected and information listing the particular

transmissions of personal data should be sufficient.The code also states that internal

access to such data should be restricted to persons whose specific functions so demand.

Data should be communicated only if they are needed in connection with a particular

task for which the user is responsible (10.6). This also applies to workers’

representatives whose activities, though important, do not entitle them to unlimited

access to workers’ personal data (10.10).

Here again, special rules are needed for medical data. The provisions of the code

reflect the proposals contained in the ILO Occupational Health Services

Recommendation (see box 6).

Finally, the code provides that employers should adopt procedures to ensure that the

internal flow of data is in conformity with the principles of the code (10.11).

11. Individual rights

Instead of following the example of most data protection laws, the code does not

start by affirming the workers’ right to know but the employer’s duty to provide workers

with regular information so that they can appreciate the significance of the data being

processed (11.1). Workers will want to know what happens to their data only if they

have at least a rough idea of the kind of data collected, the purposes for doing so and the

potential users. The more they realize the extent to which they are personally involved,

the more they will be interested in the possible implications of the data collection. The

duty of the employer to inform the workers is the corollary of the workers’ right to know

about the processing of their data.

Reliable information can be obtained only if the right to know is not confined to the

individual worker’s personnel file, but covers all related data, irrespective of where they

are kept and of the means by which they are processed (11.2). An exception must of

course be admitted in the case of security investigations, but even then workers’ access

to the data cannot be excluded or indefinitely postponed. Once the investigation has

been concluded and before any decision affecting a worker is taken, the worker should

be given the opportunity to inspect the data (11.8).

Indirect restrictions – such as asking workers to indicate why they wish to have

access and which data they want to see, imposing costs on them or preventing them

from exercising their right during normal working hours – must equally be avoided. The

specific conditions of work must, however, be taken into consideration. The code