GDPR in the Workplace
The General Data Protection Regulation (GDPR) places significant obligations on Irish employers in relation to how they collect, use and protect employee data.
Employer Data Obligations
Irish employers need to have adequate data protection training, policies, procedures and protocols in place, to secure employee data rights.
Employee Data Protection Rights
Irish employees have a right to access their work-related data, as well as a right to be informed as to who and how that data is collected and processed.
Employee Data Access Requests
Irish employers must have protocols in place to respond to employee data access requests within 1 month, or 3 months if the request is complex.
Privacy in the Workplace
Employer Monitoring of Employee Emails
The monitoring of employee emails, internet use or phone calls constitutes ‘processing’ of data. Therefore, employers need to balance their legitimate interests with the right to privacy of their employees.
Workplace Data & Privacy Policy
Irish employers need to have adequate data protection training, policies, procedures and protocols in place, to ensure who, how and when, employee emails, internet use and phone calls will be reviewed or recorded.
Monitoring Employee Data Use
Irish employees must ensure that the monitoring of employee emails, internet use or phone calls, goes no more than is necessary, under the professional circumstances, and is carried out in the least intrusive manner possible.
Employee Data & Privacy Rights
Irish employees may be entitled to bring a complaint to the Data Protection Commission if they feel their employer has undertaken excessive or disproportionate monitoring of emails, internet use or phone calls.
GDPR in the Workplace
Data Protection Principles
Employer processing of employee data must be lawful, fair and transparent, minimal, accurate, stored for no longer than necessary, confidential, and exercised with accountability.
Employee Consent to Data Processing
Irish employees must ensure that they have a legal basis or the consent of their employees to process their data. That consent must be ‘freely given, specific, informed and unambiguous’.
Employee GDPR Complaints
Irish employees may be entitled to bring a complaint to the Data Protection Commission if they feel their employer has breached the provisions of the General Data Protection Regulation.
Employer Data Obligations
Employer Data Obligations
Irish employers must be transparent as to how they are using their employees data, safeguard that data and ensue such data is being processed in accordance with the GDPR principles.
Data Protection Principles
Employer processing of employee data must be lawful, fair and transparent, minimal, accurate, stored for no longer than necessary, confidential, and exercised with accountability.
Employee Data Training
Irish employees should ensure their employees receive adequate training on what employee data will be collected, and how and why that data will be processed.
Employee Data Rights
Employee Training & Information
Irish employers need to ensure all employees have adequate data protection training and are aware of company data & GDPR policies and procedures.
Employee Data Access Requests
Irish employers must have protocols in place to respond to employee data access requests within 1 month, or 3 months if the request is complex.
Employee Data Breach Compensation
Irish employees have a right to compensation for non-material damage caused by the unlawful processing of their data by their employer.
Data in the Workplace – Liability and Compensation
Right to Receive Compensation
Any employee who has suffered material or non-material damage as a result of an infringement of their data rights may have the right to receive compensation from their employer for the damage suffered.
Employer Data & GDPR Liability
Any Irish employer involved in processing employee data shall be liable for the damage caused by processing which infringes employee GDPR rights, unless it can prove it was not responsible for the damage.
Data Protection Action
An employee may, where they consider that their rights under GDPR have been infringed, bring an action against their employer in the civil courts. A data protection action shall be deemed to be an action founded on tort.
Compensation & Remedies
If successful in pursuing an action, an employee may be granted a injunction or compensation for damage (including material and non-material damage) suffered, as a result of the infringement of their rights by their employer.
