Data privacy laws have become more prominent in recent years. As the amount of personal information available online has grown substantially, there has been an enhanced focus on the processing of personal data, as well as the enforcement of such laws.
The United Kingdom passed the Data Protection Act 2018 (“Act”) to implement the General Data Protection Regulation (GDPR) and to allow for continued application of the GDPR, now that the UK has left the European Union. The Act largely mirrors the GDPR and continues in full force post-Brexit.
Firstly, it is important to understand who is the “data controller” under the legislative framework. An organization is a data controller when it determines the purposes and manner in which personal data is processed. “Personal data” refers to “any information relating to an identified or identifiable natural person.” That person is considered a data subject under the UK GDPR and may “be identified, directly or indirectly…by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
Clearly, a lot of employee-related information collected by employers qualifies as personal data, thereby subjecting employers to data privacy regulations. The employer collecting the employee-related data is the data controller, and every HR solution adopted might be qualified as a sub-processing activity.
Regardless of whether an employer utilizes subcontractors to process information, data management processing principles will still need to be followed. This is because the “processing of personal data” is construed broadly and includes physical and automated procedures such as: collecting, recording, organizing, structuring, storing, adapting/altering, retrieving, consulting, using, disclosing by transmission, disseminating, making available, aligning/combining, restricting and erasing/destructing.
Therefore, as controllers of employee personal data collected in the employment context, employers must comply with the following personal data processing principles:
Employers should be able to provide a documented rationale for processing each piece of personal data. Processing can be legally justified if the:
If the employee data qualifies as sensitive personal data, then a narrower set of conditions applies. For example, one such condition is that a data subject has given explicit consent to the processing of his/her sensitive personal data. “Sensitive personal data” is the personal data consisting of information about the data subject’s racial or ethnic origin; political opinions; religious beliefs or beliefs of a similar nature; trade union membership; physical or mental health or condition; or sexual life.
An additional requirement imposed by the UK GDPR (not contained in the EU GDPR) is the requirement in certain cases for employers to have ‘appropriate policy documents’ in place if they are processing special/sensitive categories (e.g. performing criminal background checks), and, an ‘appropriate policy document’ in place which sets out and explains the procedures for securing compliance with the principles in Article 5 of the GDPR and, provide employees with a document setting out the company’s data retention policies.
______________________________________
The authority responsible for enforcement of data privacy law and regulations in the UK is the:
Information Commissioner’s Office
