{"id":57973,"date":"2017-08-23T09:00:06","date_gmt":"2017-08-23T08:00:06","guid":{"rendered":"https:\/\/blogs.dlapiper.com\/iptitaly\/?p=57973"},"modified":"2019-06-24T11:42:53","modified_gmt":"2019-06-24T09:42:53","slug":"article-29-working-party-issues-opinion-on-usage-of-technology-at-work","status":"publish","type":"post","link":"https:\/\/blogs.dlapiper.com\/iptitaly\/2017\/08\/article-29-working-party-issues-opinion-on-usage-of-technology-at-work\/","title":{"rendered":"Article 29 Working Party issues an opinion on usage of technology at work"},"content":{"rendered":"

Privacy risks can arise from the usage of new technologies by employees at work and require a deep assessment especially in the light of the General Data Protection Regulation.\u00a0\"Giulio<\/span><\/p>\n

The Article 29 Working Party, a European advisory body made by European data protection authorities, issued an\u00a0opinion<\/a>\u00a0on the usage of technologies at work which considers both current privacy laws and the upcoming\u00a0General Data Protection Regulation.<\/p>\n

The privacy principles applicable at work<\/h2>\n

According to the Article 29 Working Party:<\/p>\n

    \n
  1. consent cannot and should not be the legal basis of the data processing at work<\/strong>\u00a0\u2013 this is a quite often mistake, the potential consent from employees would not be freely given because of the employment relationship and therefore would not be valid;<\/li>\n
  2. processing may be necessary for the performance of a contract<\/strong>\u00a0where the employer has to process personal data of the employee\u00a0to meet contractual obligations\u00a0<\/strong>\u2013 this means that such legal basis cannot be used to justify data processing activities that go beyond what necessary for the performance of the employment contract;<\/li>\n
  3. legitimate interest can be the legal basis of the data processing<\/strong>, but the chosen method or specific technology must be necessary, proportionate and implemented in the least intrusive manner possible and\u00a0accompanied by mitigating measures to protect employees\u2019 privacy<\/strong>\u00a0\u2013 the balancing test necessary to rely on legitimate interest will be tricky and legitimate interest is definitely not a strong legal basis of data processing as it is open to different interpretations;<\/li>\n
  4. employees should be clearly and fully informed of the processing of their personal data<\/strong>, including the existence of any monitoring \u2013 this is something already provided in Italy by the\u00a0guidelines of the Italian data protection authority\u00a0on the monitoring of the usage of Internet and emails on the workplace. The provision of adequate information on the type of data processing activities performed by means of technologies is not just a recommendation, but an obligation;<\/li>\n
  5. principles of\u00a0privacy by design, by default and of data minimisation shall be followed<\/strong>\u00a0in building technologies that can monitor employees \u2013 this means that such technologies shall by default adopt the most privacy-friendly settings; and<\/li>\n
  6. a\u00a0privacy impact assessment\u00a0has to be run<\/strong>\u00a0when technologies can lead to high risk for individuals such as in case of potential profiling or decisions taken by means of automated systems.<\/li>\n<\/ol>\n

    The potential scenarios occurring on the workplace<\/h2>\n

    The European privacy authorities adopted a very practical approach listing frequent scenarios occurring on the workplace and giving instructions on how they should be handled:<\/p>\n

    1. Processing during the recruitment process<\/h3>\n

    Information about a candidate on social media can be reviewed only if necessary and relevant to the performance of the job which is being applied for, can be performed only on social media related to business (e.g. LinkedIn, but not Facebook) and data should be deleted once it appears clear that an offer of employment will not be made or is not accepted by the individual concerned;<\/p>\n

    2. Screening of employees\u2019 social media profiles<\/h3>\n

    The review of social media profiles of employees, of their contacts\/friends, opinions, beliefs, interests, habits, whereabouts, attitudes and behaviours should not take place and should not be required to employees and applicants.<\/p>\n

    3. Monitoring of electronic devices on the workplace<\/h3>\n

    These technologies not only include the monitoring of emails and of Internet usage, but include among others<\/p>\n