• In the next in our series of blogs covering an employer’s obligations under GDPR, we take a closer look at some of the new employee rights which will be introduced under GDPR.
  • These new rights are causing some concern for many employers and the first step to easing these concerns is to understand the new rights. We have therefore set out below a breakdown of these new rights, which are as follows:
  •  Right to be forgotten:
  •  GDPR will introduce a new right for employees to require their employer to delete their personal data when:
  • the data is no longer necessary for the purposes for which is was collected;
  • the employee withdraws their consent to processing and the employer has no other legal grounds for processing it; or
  • the employee objects to processing and the employer does not have a legitimate business reason for processing which is compelling enough to override the employee’s objection.
  • There will also be an obligation on employers to take reasonable steps to inform third parties that the individual has exercised their right to be forgotten, and to request that they erase any links to, or copies of, personal data belonging to the employee.
  • This new right does not override everything and employers do not have to erase employee data that they require to comply with legal obligations or which is necessary to pursue or defend legal claims.
  • It is easy to see the tension between employer and employee which this new right may cause. Many employees may be suspicious about why their employer needs to retain historic information and put pressure on them to delete it. There may also be a conflict between an employers need to retain thorough employment records and information (i.e. regarding previous disciplinary issues and working arrangements) and good data practice.
  • Right to object to processing:
  • This right will apply in circumstances where an employer is relying on a legitimate business interest as the grounds for processing data.
  • Where this is the case, individuals have a right to object to such processing. When an objection is received, the employers must stop processing the personal data immediately, unless:
  • they can demonstrate compelling legitimate grounds for the processing, which are sufficient to override the interests, rights and freedoms of the individual; or
  • the processing is for the establishment, exercise or defence of legal claims.
  • Employees must be informed of their right to object at the first point of communication and in any Privacy Notice you have in place.
  •  Right to be informed:
  • This right encompasses an employer’s obligation to provide fair processing information, typically through the use of a Privacy Notice and emphasises the need for transparency over how the employer uses personal data.
  • GDPR sets out the information that employers must supply and when the information must be supplied. The information supplied about how the employer intends to process personal data must be concise, transparent, intelligible and easily accessible and should be written in clear and plain language.
  •  Right to rectification:
  •  Individuals are entitled to have personal data rectified if it is inaccurate or incomplete. If an employer has disclosed incorrect personal data in question to third parties, they must also inform the third party of the rectification where possible.
  • The employer must also inform the individual about the third parties to whom the data has been disclosed where appropriate and if an employee submits a request for rectification the employer must respond within one month. This can be extended by 2 months if the request is particularly complex.
  • Until GDPR comes into effect it is difficult to predict how much use employees will make of these rights. However, if an employer has a well drafted Privacy Notice, it will be much more difficult for individuals to complain that their rights have been infringed or that their data has been processed unlawfully.
  • We will be discussing the rights of individuals at our seminar on the implications of GDPR on HR. The seminar is taking place at our offices in Altrincham on Wednesday 21 March 2018, from 8.30am until 10.30am. If you would like to attend, please contact us at employment@mlplaw.co.uk to secure your place.
    Comments(0)

Leave a Reply

  • (will not be published)