Almost every job involves information about people. Someone at reception writes down a visitor's name. Someone in a shop takes a delivery address. Someone in human resources keeps contracts and absence records. The data protection rules therefore apply to people at work, and not only to the company's management. Together they are called personal data protection, and most people simply say GDPR (in Portuguese, RGPD).
The rules in Portugal
- The GDPR is Regulation (EU) 2016/679. It applies directly in Portugal.
- Lei n.º 58/2019, of 8 August (Law 58/2019), ensures the implementation of the GDPR in the national legal order. It deals, for example, with the age of consent, video surveillance, employment relations, health data, fines and crimes.
- The Comissão Nacional de Proteção de Dados (CNPD), the National Data Protection Commission, is the national supervisory authority (Article 3 of Lei n.º 58/2019). It monitors compliance with the rules.
- The Código do Trabalho (Labour Code, Articles 16 to 22) has its own rules on private life and monitoring at work. They appear in lesson 4.
The GDPR applies to processing carried out wholly or partly by automated means, such as a computer or a mobile phone. It also applies to paper, when the data form part of an organised filing system, for example a folder arranged by name. Purely personal or household activities are left out, such as the address book you keep at home.
What is personal data?
Personal data is any information relating to an identified or identifiable natural person (Article 4(1) of the GDPR). Examples:
- name, address, email and telephone number;
- tax number, health service user number and citizen card number;
- photographs and recordings in which the person can be recognised;
- IP address and location data;
- someone's salary, absences, appraisals and job description.
The information does not have to be secret. A work email such as first.last@company.pt also identifies a person. Anyone who can be identified, directly or indirectly, is a data subject. Anonymised information, which no longer allows anyone to be identified by reasonable means, falls outside the GDPR.
Who is who
- Data subject: the person the data relates to, such as a customer, a candidate or a colleague.
- Controller: whoever decides the purposes and means of the processing. At work, this is normally the employer.
- Processor: whoever processes data on behalf of the controller, for example a payroll company or a software hosting provider.
- Data protection officer (DPO): the person who advises on and monitors compliance, where the company has to appoint one or chooses to.
A worker is not normally the controller: they process data on the employer's behalf and according to its instructions (Article 29 of the GDPR). Even so, the worker is the one who does the processing day to day, so their actions count.
What is "processing"?
Processing is any operation on personal data: collecting, recording, organising, storing, consulting, sending, comparing, disclosing, deleting. Even reading a record on screen is processing (Article 4(2)). So looking at a file out of curiosity is already an operation subject to the rules.
Children
For information society services offered directly to children, processing based on consent is lawful only from the age of 13. Below that age, consent must be given by the legal representatives (Article 16 of Lei n.º 58/2019).
Summary: personal data is anything that identifies a person. The rules apply to whoever works with it. If in doubt, treat the information as personal and ask.