Last review date: 15 January 2025
Yes.
The potential legal bases for data processing in the employment context are:
Provided especially in Art. 6 and 9 GDPR (please see previous sections). The Act on Processing of Personal Data does not contain any specific provision with regard to data processing in the employment context.
Act No. 262/2006 Coll., the Labor Code, regulates the protection of employees' privacy. It prohibits the employer from requiring and further processing information that is not directly related to the performance of work and to the employment relationship. The employer is expressly prohibited from processing most of the special categories of personal data unless there is a substantive reason for such processing based on the nature of the work to be performed and it is proportionate, or it is provided for by law.
Without a compelling reason based on the special nature of the employer's activity, the employer may not invade the employee's privacy in the workplace and common areas of the employer by subjecting the employee to open or hidden surveillance, tapping and recording of their telephone calls.
In an employment relationship, consent is typically more difficult to establish (please see below). The Office for Personal Data Protection states in this regard that the employee's consent as a legal title for the processing of personal data by the employer will not be frequent. Consent must be given freely, which, as a result of the imbalance between the parties in an employment relationship, will generally not be the case.
According to the Office for Personal Data Protection the employer usually processes:
- employees' personal data to negotiate and fulfill the employment contract and to fulfill its statutory obligations, i.e., based on Article 6 (b) and (c) GDPR; and
- special categories of employees' personal data for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, i.e. based on Article 9 (2) (b) GDPR.
Last review date: 15 January 2025
Yes, but this consent is typically more difficult to establish in an employment context (specify details below)
The national legislation does not elaborate on consent in the employment context in any way, so the requirements under the GDPR apply. In particular, consent must be freely given.
Pursuant to recital 43 of the GDPR, "consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller", which could be the case in the employment relationship.
The European Data Protection Board has stated in its Guidelines on Consent under the GDPR, that it "deems it problematic for employers to process personal data of current or future employees on the basis of consent as it is unlikely to be freely given". Thus, "given the imbalance of power between an employer and its staff members, employees can only give free consent in exceptional circumstances, when it will have no adverse consequences at all whether or not they give consent".
The Office for Personal Data Protection states in this regard that the employee's consent as a legal title for the processing of personal data by the employer will not be frequent. Consent must be given freely, which, as a result of the imbalance between the parties in an employment relationship, will generally not be the case.
Last review date: 15 January 2025
Please refer to the EU Chapter for detailed information regarding EU-wide legislation.
No