Data Protection at work

All employers should read and follow the ICO guide on the DPA and the GDPR as it applies in the UK. It covers matters such as what personal data is, lawfulness of processing, fairness and transparency, as well as the right to be informed, rights of access, data rectification and erasure. The right to restrict processing and data portability is also covered. 

 

While the guide is aimed at data protection officers and others with responsibility for data protection and primarily aimed at small and medium-sized organisations, it may help larger organisations too. 

 

There are some key themes that employers should be aware of. 

 

Organisations must demonstrate that employees were: 

 

 

Employees must consent freely to specific use, purpose, or processing of data. Employees’ silence or lack of complaint about the processing, consent incorporated as a standard employment contract term or in data protection policies does not meet the standard required. 

 

Employers must record the grounds on which they will be processing each separate category of employee data. 

 

Organisations may process personal information lawfully for six reasons including complying with an employment contract or legal obligation, and protecting the legitimate interests of the employer or a third party. 

 

Unless a relevant exemption applies, data subjects can request and be given a copy of their reference. The obligation depends on whether the request is made of the organisation providing the reference (usually the previous employer) or the organisation who obtained the reference (the prospective employer). 

 

Data protection issues often surround email and internet use. Organisations need a comprehensive internet, social media and communications policy governing permitted data use. 

 

Issuing staff with smart phones, laptops, tablets or USB devices has data protection implications, as can work use of employees’ own devices. ICO guidance suggests employers underestimate the risks associated with use of personal devices for work. Information may be at risk if there are inadequate security measures. An effective policy must cover permissible work use of all devices. 

 

Monitoring should not be intrusive, for example using traffic data (about the routing, duration or timing of messages) rather than accessing email content. Both the DPA and Telecommunications Regulations (see below) must be complied with. 

 

Employers must demonstrate data protection compliance by training, auditing and documenting processing activities, and reviewing HR policies. They should also: 

 

 

Any organisation can appoint a DPO, but organisations must to appoint one if they: 

 

 

DPOs report to the highest management level (usually the board). They must be given adequate resources, have a degree of independence, and protection from dismissal or detrimental treatment in connection with performing their duties. 

 

SARs are written requests from individuals for information covered by the DPA. Organisations must respond for free and without ‘undue delay’, which means within a month. The number of SARs that can be made is unrestricted although some unspecific SARs or those made for non-data protection purposes can be refused. 

 

SARs may be used to obtain preliminary information before an employment tribunal claim, although normal tribunal disclosure requirements entitle employees to more information than SARs. Organisations must comply if SARs arise during disciplinary processes. 

 

Employers should: 

 

When organisations receive SARs, they should: 

 

The ICO has a useful checklist. Breaching the SAR rules attracts fines. 

 

Third parties, such as payroll providers, external HR and recruitment agencies process employee data. The employer must ensure the third party is data protection compliant and: 

 

 

It may be possible to avoid sending personal data, or there may be a legitimate processing reason which avoids the need for employee consent. 

 

Data security must be appropriate to the processing risks. The organisation’s size, the nature of information processed, and the potential harm from security breaches are all relevant. 

 

In addition to clear policies covering security incidents, organisations should: 

 

Organisations with over 250 employees must keep clear, accessible records of all their data processing activities. Smaller organisations only need to record any data processing they do regularly, or any processing of personal data which is sensitive, or could be harmful to, or intrude on the personal life of, the individual. The ICO can inspect records at any time. Data should only be kept for as long as needed to fulfil the purpose. 

 

Organisations should: