Employee data
Employers process personal data on s past, present and potential for recruitment, salary, benefits, personnel files, sickness records, monitoring, appraisals and severance. The hard part is that data protection law sits on top of widely varying member state employment law. Article 88 GDPR lets member states make more specific rules for processing employees' data, and any such national law must be notified to the European Commission.
Employers collect data at every stage of the relationship and sometimes must collect it to comply with employment law or to protect employees (as seen during the COVID-19 pandemic). Because local rules differ so much, the mix of data protection and employment law makes compliance complicated.
- Countries with strong employee-rights law (e.g. , ) often require works council consultation.
- Some states have dedicated employee-data laws (e.g. Finland) or specific workplace-surveillance laws (e.g. Germany).
- Article 88 GDPR permits more specific national rules - these must include suitable and specific safeguards for human dignity, legitimate interests and fundamental rights.
National rules under Article 88 must pay particular regard to transparency, transfers within a group of undertakings, and monitoring systems at the workplace - and the member state must notify the European Commission.