Last review date: 27 December 2024
Yes.
According to the Swedish Data Protection Act, processing of sensitive personal data within the employment context is permitted on the basis of 9.2 (b) of the GDPR if:
- it is necessary to exercise rights or comply with legal obligations derived from labour law, social security and social protection law
Such sensitive personal data within the employment context is only allowed to be transferred to a third party if:
- it is required by law or if the data subject has given its explicit consent thereto.
Last review date: 27 December 2024
☒ Yes, but this consent is typically more difficult to establish in an employment context (specify details below)
Even though it is not expressly stated that consent cannot be validly obtained in the employment context, it shall be noted that recital 43 states: "consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller". This could be the case in the employment relationship, which is also explicitly mentioned by the Swedish DPA in its online guidance.
That being said, a valid consent can be obtained in the employment context in some cases, e.g., for the purposes of processing personal data in order to manage voluntary extracurricular activities at the workplace.
When asking for consent, the controller must do so in a clear manner. This means that it must explain in detail what the data subject agrees to regarding the category of data that is to be processed, the purpose of the processing and who will conduct the processing. When asking for consent, it must not be bundled with requirements of the data subject. Furthermore, the consent must be voluntary and should allow the data subject to withdraw without negative consequences.
Please refer to the EU Chapter for detailed information regarding EU-wide guidance.
☒ No
No guidance on this specific issue has been produced at a national or European level.