Increasingly, works councils want to hold digital elections. One possibility is to run these elections through employee e-mail addresses. However, is this allowed in the context of employee privacy?
Since May 25, 2018, the General Data Protection Regulation (AVG) has been in effect across Europe. The AVG is the successor to the Data Protection Act (Wbp). The principles are largely the same, although the AVG is stricter and more comprehensive in parts.
Both laws deal with protection of personal data. E-mail addresses, when traceable to an individual, are also personal data. This means that they may only be processed for specified, explicit and legitimate purposes, according to Article 5 of the AVG. It also follows that processing is limited to what is necessary for the purposes for which they are processed (minimum data processing). Data provided by employees may be used for purposes other than those for which they were collected, but only if this purpose is compatible with the original purpose. Whether processing for another purpose is possible depends in part on:
(a) the relationship between the purposes for which the personal data were collected and the purposes of the intended further processing;
(b) the context in which the personal data have been collected, particularly as regards the relationship between the data subjects and the controller;
(c) the nature of the personal data, in particular whether special categories of personal data are processed, in accordance with Article 9, and whether personal data on criminal convictions and offenses are processed, in accordance with Article 10;
(d) the potential impact of the proposed further processing on data subjects;
(e) the existence of appropriate safeguards, which may include encryption or pseudonymization.
An example often given is that address data from payroll may be used to send, for example, a new internal code of conduct, but not to make direct commercial offers to employees or to sell to, say, a health insurance company, which then makes the offers to employees.
A well-known real-life case study involves the Media Market as an employer. It had hung up cameras against shoplifting (goal: stop theft). These camera images were then used for performance reviews with employees (goal: analyze and assess employee behavior). The Dutch Data Protection Authority, the predecessor of the Autoriteit Persoonsgegevens, ruled at the time that these purposes were not compatible and the processing was therefore unlawful.
If an employer has access to the employee's e-mail addresses (private or business), the question is whether they may be used for digital elections of the Works Council. First, the question is what was the purpose of obtaining the e-mail addresses?
Private mail addresses are often collected to create a private account to view paychecks, to access pension information or to conduct communications in the context of illness or reintegration (matters concerning the employee's individual situation). Business e-mail addresses are often intended to inform employees of all matters concerning the company. Viewed this way, the use of private mail addresses for Works Council elections would be incompatible with the original purpose rather than the use of business mail addresses. After all, Works Council elections have sufficient connection with the employment relationship and with matters concerning the company, but much less connection with the individual situation of the employee.
If the starting point is followed that use of private e-mail addresses is incompatible with use for digital Works Council elections, this does not mean that use is impossible. However, a separate processing basis must then be found for the use of private e-mail addresses in Article 6 AVG. This includes the basis 'giving consent'; the employee gives consent for the use of his private email address for Works Council elections. However, this consent must be unambiguous and freely given. There is debate in the literature as to whether an employee, who is dependent on the employer, can freely give that consent. It is better not to use the consent basis in the employment relationship. By the way, it is also a labor-intensive process to obtain and record this consent and the consent can be withdrawn by the employee at any time. Another option as a legal basis for processing is the residual ground: the balancing of interests. Does the employer's interest in using the private e-mail addresses outweigh the privacy interest of the employees? The necessity criterion is important here; is the measure proportionate and are there not less far-reaching options available? The question is whether the employer wins the balance of interests. After all, less far-reaching means are often available (business e-mail addresses, or via a portal, or via intranet, or no digital elections). The chance that the entrepreneur or works council can therefore find its own separate basis for still using employees' private e-mail addresses for Works Council elections does not seem plausible.
In short, based on the AVG, with respect to the use of business e-mail addresses there is no problem in the context of use for Works Council elections, but with the private e-mail addresses there may be. Thus, for safety reasons, they should not be used.
Of course, caution also remains necessary when using business e-mail addresses!
Please note the other requirements of the AVG. Importantly, ...:
- if possible, the Works Council sends the information to be sent to the employer, and the employer then sends it to the employees. This prevents the OR from having access to all mail addresses;
-that the digital systems used for OR elections are properly secured;
-that as few OR members as possible can access personal data and that this data cannot be exported or copied (no Excel files or pdf files, but in a locked database);
-that those in the OR who process employee personal data have signed for confidentiality, if possible with a penalty clause;
-that those in the OR who process employee personal data are trained in the rights and obligations associated with the AVG;
-that when using an external party for the organization of digital elections, a processor's agreement should be concluded if necessary.
This article can also be found in the file AVG and Privacy in the Workplace
More from De Voort Lawyers | Mediators
