Use of personal data

• Pages: 21-21

Commentary

21

(8.6) To avoid coding of personal data so that a worker’s protection and meaningful

access are limited, the code calls for transparency in storing and coding data.

9. Use of personal data

(9.1) The “processing” of personal data is defined in section 2.2 in very broad terms

and includes references to collection, storage or communication and “any other use”. In

view of this definition, this section explicitly states that the principles enumerated in

sections 6, 8, and 10 on collection, communication and storage should be respected in

the case of any other use. This is to ensure that data collected and stored according to the

provisions of the code are not otherwise used in ways that do not conform to it.

10. Communication of personal data

External communication of data should respect the principle that workers’ data be

processed only for purposes connected with the specific employment relationship. The

code thus prohibits the transmission of data for commercial or marketing ends unless the

workers concerned have explicitly agreed (10.2). “Commercial purposes” refers to cases

where Workers’ data are sold to other enterprises for their purposes such as marketing

the data. “Marketing purposes” does not cover the cases in which enterprises use

information on the particular qualifications of their workers for their own purposes.

It is clear, however, that workers must accept the communication of personal data

where this is governed by statutory provisions, such as laws on taxation, occupational

safety and health, unemployment insurance and child-support obligations, or in the event

of court proceedings concerning the termination of an employee’s contract [10.1(b)].

The code also states that workers have to accept communications to third parties

that are necessary to prevent serious and imminent threat to life or health [10.1(a)], if

they are necessary for the conduct of the employment relationship [10.1(c)], and if

required for the enforcement of criminal law [10.1(d)].

In all other cases, it must be left to the workers to decide whether their data may be

given to a third party, especially in the case of prospective employers. The code,

consequently, calls for the worker’s informed consent (10.1)’ and points to the

employer’s duty to instruct the recipient that the data may be used only for the purposes

for which they have been communicated (10.4). Workers should be able to seek redress

against the third party if the data are misused.

It is not always easy to distinguish between external and internal transmissions,

especially in the case of communications between enterprises belonging to the same

group. As far as the processing of workers’ personal data is concerned, the determining

factor must be the existing employment relationship and not the legal or economic links

between the enterprises, or the general interests of the group. If data are communicated

to an enterprise other than the immediate employer, the rules governing external

communications apply. The same principle is applicable to different government

agencies within the public sector (10.3).

(10.4) In case of regular communications, a protocol could be established between

the employer and the third party determining the intended uses and confirming the

readiness of the addressees to follow the instructions of the employer about the