Not all data carries the same risk. Some needs special care. In this lesson we look at the DNI, the data usually held about staff and the special categories in article 9 of the GDPR.
The DNI number and other identifiers
The number on a DNI, NIE or passport is personal data like any other. It is not special category data, but it can be used to steal someone's identity, so it should be handled with care:
- Ask for it only if it is needed. If the name is enough, do not ask for the DNI as well. The minimisation principle applies here just as it does to any other data.
- Do not publish it in full next to the name. For publishing administrative acts that contain personal data, the seventh additional provision of the LOPDGDD requires the person to be identified by their name and surname plus four random digits of their document. It is a good model of caution for lists, noticeboards and notices.
- Do not leave loose copies. A photocopy of an ID card forgotten on a desk or in the printer tray is a data leak waiting to happen.
- Do not use it as a password or access code, and do not send it through insecure channels.
The data usually held about staff
A company processes a lot of data about its workers: identification, bank account, contract, payslip, timetable, holidays, absences and training. Almost all of it is processed because of the contract and legal obligations. Only those who need it for their role should see it: the personnel department and the accountancy firm see payslips, but the rest of the staff do not.
A simple rule: data about a colleague is not discussed, forwarded or published without a clear work reason. Payslips, disciplinary penalties, sick leave and personal problems are not topics for the corridor or for a messaging group.
Special categories of data
Article 9 of the GDPR in principle prohibits processing this data:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data used to identify a person uniquely, for example a fingerprint for clocking in
- data concerning health
- data concerning sex life or sexual orientation
There are exceptions, and at work the most common are obligations under employment and Social Security law (article 9.2.b) and occupational medicine. One example: the company knows about the sick leave (temporary incapacity) and its length, but it does not need to know the diagnosis. Another: trade union dues are deducted from the payslip only if the person asks.
Data about criminal convictions and offences is also strongly protected. Under article 10 of the GDPR, it is processed only under the control of a public authority or where a rule allows it. That is why a company cannot simply ask all its staff for criminal record certificates: only when the law requires it for the activity, for example the certificate of sexual offences for working with children.
Health data and children's data
If you see health data in your job (a medical centre, a care home, a pharmacy, a prevention service) or children's data (a school, an academy), the risk is higher. Follow your company's instructions more strictly and use only the authorised systems.
Remember: the more sensitive the data, the fewer people should see it and the better protected it must be.