Processing of Employees Personal Data Recent Developments Prof. Dr. - PowerPoint PPT Presentation

First Sino-German Forum on Social Computing Nanjing, 20 th May 2016 Processing of Employees’ Personal Data – Recent Developments Prof. Dr. Rüdiger Krause Institute for Labor Law Georg-August-University of Goettingen, Germany

Outline • Introduction: ECHR 12.1.2016 Case: Bärbulescu v. Romania • Current Legal Framework of Employee Data Privacy in Europe / Germany • The New (European) General Data Protection Regulation of 27/4/2016

Introduction: ECHR 12.1.2016 (European Court for Human Rights) Case: Bärbulescu v. Romania • Monitoring of the Yahoo Messenger communication of an employee for 8 days by an employer • Dismissal on the grounds of using the Yahoo Messenger for (forbidden) private purposes • Violation of privacy (Art. 8 EHRC)?

Character of the European Human Rights Convention • Convention agreed by members of European Council • Not part of European Law • Monitoring by the European Court for Human Rights (Strassbourg) • Individual complaint possible

ARTICLE 8 EHRC (1) Everyone has the right to respect for his private and family life, his home and his correspondence. (2) There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

Reasoning of the ECHR: • Reasonable expectation of privacy • Primarily protection against public authorities • However: Duty of the state to secure private life in relations between individuals • Fair balance of competing interests • Margin of appreciation by the State • Concrete circumstances of accessing the Yahoo Messenger • No use of content of the communication

Current Legal Framework of Employee Data Privacy in Europe / Germany • National Law: • Federal Data Protection Act (1977) • Applicable also to private bodies (employers) • Section 4 (1) Federal Data Protection Act: The collection, processing and use of personal data shall be lawful only if permitted or ordered by this Act or other law, or if the data subject has provided consent.

Current Legal Framework of Employee Data Privacy in Europe / Germany • Section 32 Federal Data Protection Act (= amendment in 2009) Data collection, processing and use for employment-related purposes (excerpt): An employee’s personal data may be collected, processed or used for employment-related purposes where necessary for hiring decisions or, after hiring, for carrying out or terminating the employment contract. Federal Constitutional Court:(1983): “Right to informational self - determination”

Current Legal Framework of Employee Data Privacy in Europe / Germany • European Law: • Directive 95/46/EC (1995) • Art. 8 CHARTER OF FUNDAMENTAL RIGHTS OF THE EUROPEAN UNION (2000/2009) = Protection of personal data • 1. Everyone has the right to the protection of personal data concerning him or her. • 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. • Art. 8 European Human Rights Convention

The New (European) General Data Protection Regulation of 27/4/2016 (O.J.EU 2016 No. L 119/1) • Proposal in 2012 • Agreement End of 2015 • Now in force, applicable from 25/5/2018 • 99 Articles and 173 Recitals • Art. 6: Lawfulness of processing of personal data • Justification: Consent • Justification: Performance of a contract • Justification: Legitimate interests of the controller (e.g. transmitting of personal data within a group of undertakings)

The New (European) General Data Protection Regulation of 27/4/2016 (O.J.EU 2016 No. L 119/1) • Rights of the data subject • Transparency • Information (identity of controller, purpose of processing, rights of the data subject etc.) • Right of access • Right to rectification • Right to erasure (“right to be forgotten”) • Right not to be subject of automated individual decision- making (with exceptions)

The New (European) General Data Protection Regulation of 27/4/2016 Article 88 – Processing in the context of employment 1. Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer's or customer's property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.

The New (European) General Data Protection Regulation of 27/4/2016 Article 88 – Processing in the context of employment 2. Those rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.

The New (European) General Data Protection Regulation of 27/4/2016 (O.J.EU 2016 No. L 119/1) Article 88 – Processing in the context of employment Open questions: Character as minimum level? Margin for concretization for Member States? Options for collective agreements at the shop floor?