Do I have to obtain employees' consent in order to collect their personal data?
The processing of any personal data may impose obligations to the individuals the data is related to, the data subjects. Some jurisdictions only recognize processing personal data as lawful if the data subject has provided express consent. Other jurisdictions require a legal obligation to process the data, and may not require consent. The processing of HR personal data has raised questions and court decisions in a few countries, and interpretations may vary based on data privacy and labor law requirements.
The concept of employee consent has been increasingly criticized because there is doubt as to whether consent can be given freely in the subordinate employee/employer relationship. In Pakistan, there is currently no specific requirement for employers to obtain consent prior to processing employee personal data. There is also no requirement to provide individuals with notice if their personal data is being processed. That said, Pakistan employers generally include a data processing provision in employment agreements.
If the Personal Data Protection Bill 2021 (Bill 2021) passes in its current form, there will be consent and written notification requirements for data controllers (such as employers) processing personal data in the future. Individuals would be given the right to request access to their personal data, correction to their personal data and to be informed whether providing their personal data is required or voluntary.