Last review date: 27 December 2024
The potential legal bases for data processing in the employment context are:
The Norwegian Personal Data Act provides for legal bases for the processing of personal data based on Art. 88 para. 1 GDPR.
Processing of sensitive data is regulated in section 6 of the Norwegian Personal Data Act. According to this, sensitive personal data may be processed when the processing is necessary for exercising specific rights and obligations within the field of employment law.
Pursuant to the Working Environment Act, a company's access to an employee's e-mail account etc. is only permitted if it is either necessary to safeguard the company's business or other legitimate interests, or in the case of justified suspicions that the employee's use of the e-mail account or other electronic equipment constitutes a material breach of the employee's obligations or may provide grounds for notice or dismissal. The Working Environment Act and relevant Regulations provide several requirements in relation to the above, including a duty to notify the employee, and the employee's right to be present during a review.
Pursuant to the Working Environment Act, video surveillance (including the use of fake equipment) must only be performed when necessary to prevent hazardous situations, and to safeguard the safety of the employees and others, or when there is a specific need for such surveillance. The Working Environment Act and relevant Regulations provide several requirements in relation to the above, including a duty to clearly provide information about the relevant surveillance.
Last review date: 27 December 2024
☒ Yes, but this consent is typically more difficult to establish in an employment context (specify details below)
Pursuant to recital 43 "consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller", which could be the case in the employment relationship.
The Norwegian Data Protection Authority recommends not to rely on consent in an employment context, but there may be exceptions (where it is clear that a refusal to consent will not have negative consequences).