Compliance Considerations Flashcards
What does the GDPR say about employee data (include article)?
Article 88
Member states may, by law or collective agreements, provide more specific rules around the processing of employee personal data.
The rules must include measures to safeguard the data subject’s:
-human dignity
-legitimate interests
-fundamental rights
with particular regard for:
-transparency of processing
-transfer of personal data within a group of undertakings or a group of enterprises engaged in joint economic activity and monitoring system
What are examples of legal bases for processing employee personal data?
Fulfillment of an employment contract: collecting and using bank account information to process salaries
Legal obligation: sharing salary information with tax authorities (this must be an obligation under EU or member state law)
Legitimate interests of the employer: migrating employee information from one data management system to another.
Consent: may be difficult to prove because of the unequal distribution of power between the employer and the employee. The processing of employee data may be unlawful or unfair under local law, even if the employee has consented. Yet, under some local labor laws, employers are obligated to obtain consent from employees to process their personal data.
What is unique about legitimate interest being used as a basis for processing employee data?
The legitimate interest cannot be adverse to employees’ rights and freedoms and it cannot be used as grounds for processing special categories of data.
Public authorities may not rely on this ground.
What must happen when employers process sensitive personal data of employees?
Employers must comply with one of the exceptions specified in Article 9 of the GDPR (exceptions):
- explicit consent (last resort bc employees might feel pressured to provide consent)
- legal claims
Article 9(2) recognizes that employers might need to process sensitive personal data to comply with obligations and rights, such as social security
If employers are required to retain employee data after the end of the employment lifecycle, what should happen?
Generally, the records should be archived and internal access should be limited
What does compliance with works councils look like?
Might include notifying, consulting with, and seeking approval with works councils
What is a works council?
Internal trade union
When internal employees gather together and create a works council.
Most common in Germany
What are the issues with BYOD?
BYOD= Bring Your Own Device
Compliance issues because the employer remains the controller for any personal data processed on the employee’s device for work-related purposes using the work email settings
Opens the door to data protection issues, such as data breaches, which result in large fines.
Also have to manage security of the organization and balance individuals’ personal data.
How can employers effectively manage BYOD?
Have a BYOD policy that explains to employees how they can use BYOD and their responsibilities.
Employers should also know where the data processed via the device is stored, measures required to keep data secure, ensure the methods of transferring from the device to the company’s server is secure, know how to manage data stored on the device once the employee leaves the company or the device is lost or stolen, and provide notice to employees explaining the consequences of BYOD and the information the organization will be able to access (with lawful basis for processing personal data).
What should a BYOD policy include?
The policy should:
- align with the law
- protect personal data
- protect organizational data
- enable employee productivity
- mitigate network risks
What are different types of legal employee monitoring?
Background checks (e.g. from verifying education to checking for past criminal activity). May not be used to create blacklists.
Data Loss Prevention (DLP): tools used to protect IT infrastructure and confidential business info from internal and external threats, but they inevitably process employee personal data since they operate on networks and systems used by employees.
What are the requirements to lawfully monitor employees and what are examples of questions employers can ask themselves?
The employer must make sure that the monitoring is:
- necessary: can you demonstrate that the monitoring is really necessary? (a DPIA might be required under certain circumstances)
- proportional: is the monitoring proportionate to the issue that the employer is dealing with? (linked to GDPR’s principle of data minimization). collective bargaining agreements are useful markers for employers considering the proportionality.
- transparent: have employees been clearly informed of the monitoring that will be carried out? the employer cannot argue that lack of workplace privacy is acceptable because employees have been warned. employers should introduce an acceptable use policy.
- legitimate: do you have lawful grounds for collecting and processing personal data? is the processing fair? this will often mean relying on legitimate interest balancing test.
What is the the Sarbanes-Oxley Act (SOX) and when was it passed?
2002 in the US
Requires companies to have a system in place to receive anonymous complaints about potential wrongdoing, including fraud, misappropriation of assets and/or material misstatements in financial reporting.
Mostly about accounting or auditing fraud-type activities
Where is the tension between the EU and US on whistleblowing schemes?
The US focuses on protecting the identity of the whistleblower while the EU focuses on protecting the personal data of the employee accused of wrongdoing
In the US, we encourage anonymous reporting. In the EU, they strongly discourage anonymous reporting (concerned about malicious reports being made). So in the EU, they promise confidentiality, but they usually ask the whistleblower to identify themselves as part of the whistleblowing report. Of course, the EU would not ignore a serious report that is submitted on an anonymous basis, but they are not encouraged.
*In some countries, DPAs will consider a whistle blowing scheme illegal if it mentions the ability to make anonymous reporting
What should be considered for whistleblowing schemes?
Transparency: a whistle-blowing policy that explains to people their ability to report violations and also how their info will be treated in the context of a whistleblowing report.
Security and confidentiality
Retention: If the report cannot be proven, then the report should be deleted after a short period of time (3-6 months).
Different rules on who can be reported (data subjects) depending on the country (some countries believe the only types of people who should be allowed to be the subjects of whistle-blowing reports should be the ones who are capable of serious organizational harm)
Data transfers
What are the types of reports permissible under EU whistleblowing law?
Auditing and fraud (as under SOX in the US)
Health and safety violations
Discriminatory activities
*Diversion across member states. Some member states have wide variety of activities permissible for reporting and others will limit it strictly to just Sarbanes-Oxley accounting and auditing fraud-type activities.
What is unique about whistleblowing reports in the EU and the privacy rights of the subject of the report?
Individuals have privacy rights–to access and correction and deletion–and those apply to whistleblowing reports.
If an individual has been the subject of a whistleblowing report, you have to tell them they’ve been subject of a report (but you can wait until you’ve secured evidence for the investigation first).
They can have access to the report and to seek any corrections to it that they think are inaccurate (but you still have to protect individuals’ rights so you can black out names/the whistleblower for a period of time)
What is surveillance?
Observation of an individual or group.
May be covert or carried out openly, conducted in real time or by access to stored material.
What does the GDPR say about surveillance (include article)?
Article 23
Allows EU or Member State law to restrict the rights of the data subject. Such a restriction must:
1) Respect the essence of the fundamental rights and freedoms
2) Be a necessary and proportionate measure in a democratic society
Who may conduct surveillance and when is it permissible?
Public and state agencies for national security or law enforcement
Private entities for their own purposes
When public and state agencies conduct surveillance, what must they consider?
They must conduct surveillance in a manner that respects individual rights enshrined in the Charter of Fundamental Rights, specifically the right to a private and family life (Article 7) and protection of personal data (Article 8)
What is Recital 66 of the Law Enforcement Data Protection Directive (LEDP Directive)?
It recognizes that although the processing of personal data must be lawful, fair, and transparent, this should not prevent law enforcement authorities from carrying out activities (e.g., covert investigations and video surveillance) to:
prevent, investigate, detect, and prosecute criminal offenses
How can private entities conduct surveillance?
It must be based on legitimate purposes
In addition to the GDPR, it must comply with national laws concerning confidentiality, privacy, data protection and other civil rights; e.g., employment law
How are personal data from electronic communications categorized?
As content data: the content of the communication
Metadata: “data about data” or information generated as a consequence of a communication’s transmission
Examples of metadata
CC/Bcc
Message delivery time
Message creation time
Priority of message
To/from
Reply message time
What is content data protected by?
The right to freedom of expression
What is metadata protected by?
The GDPR because it can be used to identify an individual, so it falls within the GDPR’s definition of personal data
What is the ePrivacy Directive’s official title? What else is it known as?
Directive 2002/58
Cookie Directive
Privacy and Electronic Communications Directive
What does the ePrivacy Directive do?
It sets out rules governing the processing of location, content, and traffic data over a public electronic communications network or publicly available communications system. In other words, data passing over public telephone or internet carriers, or services that use a public communications network.
What is required for the collection of an individual’s precise location-based data?
Opt-in consent (with exception of carriers who need the data to provide the service)
What does article 5(1) of ePrivacy Directive say?
Confidentiality of the content of communications must be ensured and cannot be intercepted or disclosed to third parties unless there is consent from all users
What does Article 15(1) of ePrivacy Directive say?
Member states can introduce some exemptions if necessary for very limited purposes, such as national security and law enforcement.
Access to traffic data is limited. However, telecommunications carriers can process for the purpose of conveying communication and for some limited marketing activities with the user’s consent. Otherwise, it’s very restricted.
