GDPR Related National Laws & Modifications
The European Union’s General Data Protection Regulation (GDPR) sets a common standard for protecting personal data across the EU. It also allows member nations some flexibility to create additional provisions and limitations. Some examples, which may impact HR teams, include the ability for EU member states to:
- provide “specific rules to ensure the protection of…employees’ personal data in the employment context” (Art. 88);
- limit the transfer of “specific categories of personal data to a third country or international organization” if the country (or international organization) is deemed not to have adequate protections in place (Art. 49, (5)); and,
- “determine the specific conditions for the processing of a national identification number or any other identifier of general application” (Art. 87).
Derogations in Hungary
Hungary has updated the Labour Code to align with GDPR requirements.
Under the Hungarian Labour Code, there are additional rules and regulations relating to processing personal employee data. Employers in Hungary can only request personal employee data if that data is necessary to:
- establish, perform, or terminate employment; or,
- litigate a claim relating to the employment relationship.
Employers also have limitations on what can be collected from employees:
- Personal Documents: Employers can require the presentation of personal documents (ID, address card, diploma, etc.) but cannot make copies of the employee’s documents.
- Biometric Data: The processing of biometric data is very limited and can only be processed when necessary to protect life/limb/health or significant interests that are protected by law (ex., safeguarding nuclear materials).
- Criminal Records: Employers can only request an employee’s criminal record if specifically required under statute or, if the employer can prove a legitimate interest and has set up the rules for processing criminal record data in writing prior to the request.
Separately, employees, Works Councils and Trade Unions, also have rights and restrictions under the Labour Code.
- Works Councils and Trade Unions are allowed to request employee personal data to exercise their rights, as outlined in the Labour Code. Employers must seek the opinion of the Works Council 15 days in advance of implementing new data processing measures or policies which would affect a large group of employees (note that trade unions may initiate consultations on the data processing measures);
- Employees are not permitted to use company IT equipment for private purposes, unless there is an agreement with the employer.
