Every processing needs a lawful basis. Article 6(1) GDPR lists six. The employer (the controller) must choose the one that fits the specific processing, and must inform people about it.
Six lawful bases
- Consent of the data subject.
- Contract: the processing is necessary to perform a contract or to take steps before it is concluded. For example, an employment contract and the payment of wages.
- Legal obligation: the law requires the controller to process the data. For example, insurance contributions or keeping payroll records.
- Vital interests of a person, for example saving a life.
- Public interest or the exercise of official authority.
- Legitimate interest of the controller or a third party, as long as it does not override the rights and interests of the person. The controller must weigh the interests carefully. Public authorities cannot use it when performing their tasks.
Consent: only when it is truly free
Consent must be freely given, specific, informed and unambiguous, and it must be possible to withdraw it at any time just as easily (Article 7). Silence or a pre-ticked box is not consent.
In an employment relationship, consent is problematic. The employee depends on the employer, so their consent may not be truly free. The employer should not rely on consent for things it needs for the employment to work. There it should use the contract, the law or legitimate interest. Consent suits voluntary matters, for example publishing an employee's photo on the company website.
Age of a child for consent
Article 8 GDPR concerns information society services offered directly to a child. The Regulation sets the age at 16, and Member States may lower it. The Czech Republic lowered it to 15 (§ 7 of Act No. 110/2019 Sb.). A child under 15 needs the consent of a legal representative.
Special categories of data
Article 9 GDPR protects particularly sensitive data. Processing it is in principle prohibited unless an exception applies. This is data about:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- health
- sex life or sexual orientation
- genetic and biometric data used to identify a person uniquely
The exceptions are narrow. For employers the most important one applies where processing is necessary to carry out obligations and exercise rights in the field of employment and social security law. Explicit consent or the protection of vital interests are also possible.
Example: an employer may process data on an employee's incapacity for work, because it needs it for sick pay and for its duties under sickness insurance. It does not need the diagnosis and must not ask the employee for it, unless the law requires it.
Data on criminal offences
Data on convictions and offences (Article 10 GDPR) is processed only where the law allows it. In employment this also applies under the Labour Code: the employer may require information on a clean criminal record only where there is a substantive reason arising from the nature of the work and the requirement is proportionate, or where the law provides so (§ 316(4)).
What to remember
- Without a lawful basis, data must not be processed.
- Consent at work is often a weak basis, and it must be possible to withdraw it at any time.
- In the Czech Republic the age for a child's consent is 15.
- Health data and other special categories need a special exception.