Labour law & GDPR : the employers’ rights over employee data

Abstract

The General Data Protection Regulation (GDPR), provides rules for the safeguarding of natural persons in relation to the handling of personal information, as well as the free movement of such information. It safeguards fundamental rights and freedoms of natural persons, specifically their right to have their personal information protected, subject however that the free movement of personal information within the European Union should not be hindered or forbidden, as a result of the safeguarding of natural persons in relation to the handling of personal information 1.

The build up to the entry into force of the GDPR in 2018 brought to light the struggle between the rights and duties of data controllers and the rights of data subjects to the protection of the privacy of their data. Such a struggle was also clearly showcased in the context of employment, where discussions focused on the rights of employees on one side and the obligations, namely that of being compliant with the GDPR, of the employer on the other. There continues to be an evident struggle between the rights of employees to limit the handling of the personal information during the lifetime of their employment relationship with an employer, and the legitimate interest of the employer and potentially the wider organisation of which the employer forms a part to process such employee data. Indeed, there is a fine line between what is an appropriate manner in which the employer can process personal data and what is not, and finding the ideal balance between the two, in line with the requirements of the GDPR and taking into account the specific circumstances within which employer operates, is not always straightforward task.

This dissertation will principally focus on the application of the GPPR within an employment scenario and the "struggle" between the rights of employees as opposed to the obligations of the employer. This dissertation is not a complete examination of the manner in which the GDPR has effected all employer-employee relationships across all member states, but a review of the principle rights of employees as data subjects and rights and obligations of employers as data controllers following the coming into force of the GDPR.