What data can be processed by HR and Payroll in the light of GDPR?

What are the employer’s obligations regarding the processing of personal data?

When hiring an employee, the employer is obligated to inform them about the principles of processing their personal data. These principles, outlined in Article 13 of the GDPR, encompass not only the scope of collected data and the storage period but also the requirement to issue formal authorization if the employee’s position involves direct processing of personal data. The documentation related to these matters should be provided to the employee at the beginning of their employment, although it does not necessarily need to be stored directly in their personnel files.

What are the principles of processing personal data?

In the HR and payroll domain, we adhere to six fundamental principles derived from Article 5 of the GDPR, establishing ethical and legal frameworks for those handling personal data. These include the legality principle, imposing the obligation to process data in accordance with the law, the purpose limitation principle, which requires collecting data only for specific, explicit, and legal purposes, and the minimization principle, demanding processing only of necessary data.

Equally important are the accuracy principle (data must be accurate), the storage limitation principle (data must not be stored longer than necessary), and the principles of integrity and confidentiality (ensuring data security). The accountability principle, requiring the demonstration of compliance with the aforementioned principles, should not be overlooked.

What categories of personal data can be processed?

In employee relations, various categories of data are processed, encompassing both commonly known and special categories such as information about racial origin, religious beliefs, genetic data, biometric data, or the sexual orientation of employees. Knowledge of these aspects may be necessary in HR departments for administering various benefits.

How are employees divided based on access to personal data?

Regarding access to personal data, employees can be divided into three categories:

· Those who have no access to personal data processed by the employer, such as production or service employees.

· Those who have access only to ordinary data, e.g., reception or finance department employees.

· Those who have access to both ordinary and special category data, usually employees in HR, personnel, or payroll departments.

For each of these groups, access rights and associated procedures should be strictly defined and communicated to ensure compliance with the GDPR.

What significance does the security of personal data have in the HR and payroll area according to the GDPR?

Securing the personal data of employees is a crucial aspect related to the GDPR that every employer should pay attention to. Actions such as safeguarding against unauthorized access, data loss, or improper use are fundamental. Employers must implement appropriate technical and organizational measures, such as encryption, access rights management, or regular security audits.

How should one proceed in case of a breach of personal data protection according to GDPR principles?

Despite implementing best practices and safeguards, breaches of personal data protection can occur. In such cases, the GDPR imposes an obligation on the employer to react promptly. The company must assess the risk to the rights and freedoms of the individuals whose data has been breached, and in the case of high risk, notify the relevant supervisory authority and sometimes the individuals affected by the breach.

What are the main principles of processing personal data in the recruitment process according to GDPR?

The recruitment process is another area where employers must be particularly careful in compliance with the GDPR. From announcing a job offer, through collecting CVs, to conducting qualification interviews, all actions must be carried out with respect for the principles of personal data protection. For example, employers cannot demand information from candidates that is not directly related to the advertised job position.

How does the GDPR regulate workplace monitoring?

The issue of workplace monitoring has also become more complicated with the introduction of the GDPR. On the one hand, employers may be interested in monitoring for property protection or ensuring safety, but on the other hand, they must respect the privacy rights of their employees. This requires a balanced approach and often consultation with data protection authorities to ensure that monitoring systems are properly implemented without violating GDPR regulations.

Why is it worthwhile to use BTLA services in employee data management?

The GDPR has introduced significant changes in employee data management, requiring greater transparency and protection of personal data. This challenge demands continuous attention and adaptation of practices to maintain full compliance with current regulations.

BTLA is a partner who not only understands GDPR but also offers comprehensive support in HR and payroll, ensuring full compliance with applicable regulations.