Last review date: 18 December 2024
Yes.
The PDPL identifies the following legal bases that specifically apply in an employment context:
- the processing is necessary for the purposes of occupational or preventive medicine in order to assess the employees' ability to work, for medical diagnosis, for health or social care, for treatment, health insurance services or for management of health or social care systems and services in accordance with the applicable legislation in the UAE; or
- the processing is necessary for the purposes of the controller or data subject carrying out its obligations and exercising its legally established rights in the field of employment, social security or under the laws of social protection, to the extent permitted by such laws.
More generally, in an employment context the employer may process an employee's personal data when the processing is necessary for compliance with the applicable law to which the controller (i.e. the employer) is subject.
Last review date: 18 December 2024
☒ Yes, same as for data subjects outside the employment context.
Unlike the GDPR, under the PDPL there is no reference to the fact that consent must be "freely given." This removes one argument that arises in respect of compliance with the equivalent requirements of the GDPR, whereby the unequal bargaining power of the parties in an employment context fails to satisfy this requirement. The pending implementing regulations may provide further clarity as to the context in which consent can be relied on as a valid means of legitimizing processing.