All processing of personal data rests on principles that the GDPR sets out in Article 5. They are the compass for deciding what may be done with information from day to day.
The principles of Article 5
- Lawfulness, fairness and transparency: data is processed lawfully, fairly and in a way that is clear to the data subject.
- Purpose limitation: data is collected for specified and legitimate purposes and is not later used for incompatible ones. Workers' emergency numbers, for example, are not for sending advertising.
- Minimisation: only what is adequate, relevant and necessary is collected. If a registration form does not need the date of birth, it is not asked for.
- Accuracy: data must be correct and up to date. Inaccurate data is corrected or erased without delay.
- Storage limitation: data is kept only for as long as necessary. The period is the one the law sets or, failing that, whatever the purpose requires. When the purpose ends, the controller destroys or anonymises the data (Article 21 of Lei n.º 58/2019).
- Integrity and confidentiality: data is protected against unauthorised access, loss and destruction.
- Accountability: the controller must be able to demonstrate compliance.
When is it lawful to process data?
Article 6 of the GDPR says that personal data may be processed only if there is at least one lawful basis:
- the data subject's consent;
- the performance of a contract to which the data subject is a party, or steps taken at their request before a contract is concluded;
- compliance with a legal obligation;
- protection of a person's vital interests;
- a task carried out in the public interest or the exercise of official authority;
- the legitimate interests of the controller or of a third party, unless the data subject's rights override them.
Much processing in companies rests on the employment contract and the law: paying salaries, reporting to Social Security, recording attendance. There is no need to ask for consent at every step.
Consent in employment relationships
Consent must be freely given, specific, informed and unambiguous, and withdrawing it must be as easy as giving it (Articles 4(11) and 7). There is an imbalance between employer and worker, so consent is not always truly free. For that reason the employer normally relies on another basis, such as the employment contract or a legal obligation. It may process workers' data for the purposes and within the limits of the Código do Trabalho (Article 28(1) of Lei n.º 58/2019).
Article 28(3) of Lei n.º 58/2019 also deals with the worker's consent. The CNPD has declared, however, that it does not apply part of that provision, because it considers it contrary to the GDPR (Deliberation No. 2019/494).
Acting only on instructions and keeping confidentiality
- Anyone working under the authority of the controller processes data only on its instructions, unless required by law (Article 29 of the GDPR).
- The duty of confidentiality binds the DPO, the controller, the processors and all persons involved in any processing operation (Article 10(2) of Lei n.º 58/2019).
- Accessing or using data beyond what the job requires may be unlawful and, in some cases, a crime (lesson 8).
Questions that help
- What for? Is there a clear purpose connected with the work?
- How much? Do I really need all this data?
- Who? Who else needs to see it?
- Until when? Is there a deadline for keeping or deleting it?
Summary: use only what you need, for what it was collected for, and only for as long as necessary.