Employee data is available and circulated widely in many companies. Internally, for instance, many employers select one high performing employee to be ‘Employee of the month’ to incentivize productivity and performance within their company. Externally, employee data is often published on the website of a company, for instance, by uploading a photograph and contact details. The following questions can be asked: Are employers entitled to share data of employees with other colleagues or the public, and if so, what are the circumstances under which this is possible?
Internal data disclosure
In general, there are no restrictions on employers displaying ‘best performance’ results in the workplace if these are based on an assessment of individual employees. However, there are a few things that employers should keep in mind.
Basically, an employer needs a legal basis to process an employee’s personal data. If regularly rewarding employees for high performance, an employer can justify processing the data on the basis of legitimate interest and for the purpose of ensuring the efficient and effective operation of the workplace. Employers must, however, demonstrate that their interests override the interests or fundamental rights and freedoms of the individual.
Employers should ensure that they do not publish the ‘Employee of the month’ award and evaluation results in a way that identifies both the person doing the best job and the employee doing the ‘worst’ job based on the assessment. Publishing details of an employee with the perceived poorest performance cannot be justified by a legitimate interest as it is too intrusive to an employee’s privacy. For example, poor performance can result from personal circumstances that may also include information about an employee’s health or religious affiliations.
In sum, employers can share the results of ‘Employee of the month’ awards if there is not a less intrusive way to ensure the efficient and effective operation of the workplace and only if an employer guarantees that the results will not identify the ‘poorest performing’ employee.
External data disclosure
Generally speaking, the employer-employee relationship is an imbalanced one in which the employer yields more power than the employee. Consent to the processing of personal data has to be freely given. In an imbalanced relationship in which a certain level of dependency exists, it may often be unlawful if the employer seeks consent to publish a photo and description of the employee.
There might be situations in which processing an employee’s personal data based on the employee’s consent is lawful, especially if it’s in the interest of the employee.
A common example of companies externally disclosing employee’s personal data is to publish their photograph on their website, often for marketing or promotional purposes. Taking, using and publishing photographs of employees involves the processing of their personal data.
Therefore, a legal basis for that processing is necessary. In that context, it would be appropriate to ask employees for their consent, placing special importance in being transparent and providing the opportunity to object. The employee must not feel pressured to provide consent and a genuine choice must be available to the employee without suffering any detriment if consent is declined. Consent has to be “freely given, specific and informed”. Thus, a form that generally allows the employer to take, use and publish photographs of employees is not compliant.
Simply use our free consent form template for your employees!
In sum, an employer may disclose employee’s data externally, if based on valid and freely given consent. Due to an imbalance of power in employment relationships, consent must not be tied to other conditions, the consent must be given in a free, specific and informed manner, and a real choice must be available for the employee without his or her being disadvantaged for deciding to withhold consent.
