Companies must not know much about employees. Will GDPR affect your work?

In May, the new European name known as GDPR will come into force. This sets new and strict rules for the protection of personal data. Lawyer Lucie Kalaov from bvp Braun Partners explains what this means for the employees themselves.

The employer must process the personal data of his employees in order to meet the obligations arising from the end of the republic. So what does the employer have and what does he not have?

How can the employer collect information about job applicants and employees?
First of all, I must not forget the basic norm of the first work, ie at the end of the work. In it, we will now find guidelines for employers, how they give them and how they are not allowed to process job seekers and their employees.

On the other hand, how can an employer not process information about his employees?
Those that are not directly related to the performance of work and the employment relationship or to the concluded agreement outside the employment relationship. Such includes information on sexual orientation, origin, membership in a trade union of an organization, membership in political parties or movements, membership in a church or non-religious society.

What gives about thotenstv?
Data on pregnancy, family and property relations and the criminal integrity of the interim employer may be processed only if there is a valid reason for doing so in the nature of the work to be performed. Or in cases where it stipulates. The employer may not obtain prohibited information from tetch persons either. In the event that the employer violates the violation, it may be fined by the labor inspectorate and up to several million crowns.

What are the biggest mistakes of your employer?
It is unlikely that the employer fulfills its information obligation to its employees. Acquired data on them can also be used for other people, exceeding the statutory framework, without the knowledge of their employees and often without a valid first title. The processed data are thus very often insufficiently organized and technically secured.

Control over the compliance obligation when dealing with personal data in the employment-first relations of the performance for the protection of personal data and the Labor Inspectorate. Sanctions for violations of GDPR can be. Therefore, the vice-employer is honestly preparing for the future right.

The word is circulating on the Internet that employers, who have less than 250 employees, are not covered by the GDPR.
But that is not true. These employers have only a lion in the obligation to enter the records of the processing, namely to go only in uritch cases.

to the fact that companies will have to create a new city – to employ a trustee, ie such a coordinator for the protection of personal data?
The processing of personal data for the purpose of the implementation of the employment relationship does not establish the obligation to appoint a trustee. However, the commission may appoint voluntarily.

If the employer is not sure whether he can determine the data on the employee to process, will he remember when to get his consent to the processing for sure?
I would definitely not recommend such a procedure. Consent is a separate first title for the processing of personal data, which should be applied in a situation where the employer does not have another first title for the processing of personal data.

Would consent bother?Nyn s nm firmy e adu vc v oblasti nakldn s osobnmi daji?
The employer would thus mislead the employee about his elements, which are related to the processing of personal data. Consent must always be revoked. If the employer gives the composition of another first title, for example the composition of the obligation determined by the law, then in such a case the employee can revoke the possibility.

Moreover, the agreement would probably not fulfill any of the requirements required by the GDPR. In most cases, the consent would not be given freely, or the employee would depend on his employer. The employee may feel that he has to give consent, otherwise his employment may be endangered. The employer should therefore not require consent to the processing of personal data from employees.

Heath IM Provement