Introduction – GDPR and Personal Devices
A recent case in Poland highlights the pitfalls of employees using personal devices to process work-related information.
The Warsaw University of Life Sciences (SGGW) was found to have exposed the personal data of students and prospective degree candidates back in November 2019. Up to 100 students may have had their information exposed after data was stored on an employee’s personal device, which was later stolen. The university was not aware that the employee was processing students’ personal data on a non-work device, a statement from the UODO reads.
Employers Obligations under GDPR
The General Data Protection Regulation (GDPR) places significant obligations on Irish employers, in relation to how they collect, use and protect employee data.
Irish employers need to have adequate data protection training, policies, procedures and protocols in place, to secure employee data rights.
Any Irish employer involved in processing employee data shall be liable for the damage caused by processing which infringes employee GDPR rights, unless it can prove it was not responsible for the damage.
An employee may, where they consider that their rights under GDPR have been infringed, bring an action against their employer in the civil courts. Although not quite as developed in this jurisdiction, a data protection action shall be deemed to be an action founded on tort.
If successful in pursuing an action, an employee may be granted a injunction or compensation for damage (including material and non-material damage) suffered, as a result of the infringement of their rights by their employer.
GDPR and Personal Devices – Takeaway for Employers
In the present case, the president of the Polish National Personal Data Protection Office (UODO), the equivalent of the Date Protection Commissioner, fined the institution PLN 50,000 ($13,000) for a breach of GDPR rules.
Irish employers must be transparent as to how they are using their employees data, safeguard that data and ensue such data is being processed in accordance with the GDPR principles.
