HomeInsights & thinkingWhat employers need to know about the General Data Protection Regulation and employee data
What employers need to know about the General Data Protection Regulation and employee data
21 February 2017
The General Data Protection Regulation (GDPR) is a new data protection law for the EU covering the processing of data by businesses.
Whilst we will be leaving the EU at some point, the UK will still need to have equivalent laws to the GDPR. This is because, if businesses want to be able to trade in the EU, they will need to comply with EU rules. We will, therefore, be stuck with it, or something which looks very much like it.
The GDPR comes into force on 25 May 2018 when, by all accounts, we will still be in the EU anyway.
Currently, our Data Protection Act dates from 1998 – when 55% of US households did not own a computer. The current law describes a computer as “equipment operating automatically in response to instructions given for the purpose of processing information”. It’s now 2017, and our existing law is extremely out of date!
Under the GDPR, employee consent, to a business processing their data, must be as easy to withdraw as it is to give. Importantly, consent must be freely given – so, where a contract requires someone to consent to data processing which isn’t necessary for the performance of the contract, that consent may not be valid. Consent needs to be explicit and businesses must be able to prove that the consent has been given.
There will also be requirements to provide more information to employees, eg they must be informed of their rights (such as the ability to withdraw consent) and how long their data will be stored for.
Businesses will still be able to transfer employee data internationally at a group level, although it may be more difficult simply to rely upon employee consent (perhaps given in an employment contract) to do this. Employers will need to check that adequate information has been given to employees about the risks. The GDPR does nothing to address the problems which have arisen recently with the ‘safe harbour’ regime.
Under the GDPR, current and former employees will still be able to make data subject access requests in the same way, but businesses will have to respond within a month, rather than the current 40 days.
In addition, businesses will be legally required to report data security breaches to the authorities, without undue delay, and, where feasible, within 72 hours of becoming aware of the breach. However, a breach will only need to be reported if it is likely to result in a risk to ‘the rights and freedoms of individuals’. This can be difficult to assess, but we have helped clients with this process in the past.
The GDPR is not a radical change in legislation, and of course, if your existing employee consents meet the new conditions you do not need to take any action. However, we recommend that you review your data protection policies and consents before May 2018, to avoid any breach of the GDPR.
We will be running a breakfast seminar on data protection on 28 March at the National Star College. Please visit our events page for more information.
Matthew heads our employment team. He handles the full range of contentious and non-contentious employment law issues for clients. His particular specialisms include complex staff restructurings and employment issues concerning business transfers. Matthew is recommended by independent legal directory Chambers and Partners which describes him as ‘solutions-focused’ and ‘a solid and respected practitioner noted for his technical abilities’. He trained and worked at a City of London law firm.
IR35: The (delayed) new off-payroll working rules apply from 6 April 2021 Traditionally, contractors like being self-employed because they pay reduced National Insurance contributions, and are able to set various…
The Supreme Court has made a unanimous landmark decision that (mostly female) shop workers at Asda supermarkets can be compared to the (mostly male) warehouse workers, ruling that they are…
Employment lawyers Matthew Clayton and Jenny Hawrot summarise the latest developments on the Coronavirus Job Retention Scheme to emerge. Thursday 18 March 2021 From 1 April 2021, clinically vulnerable people in…
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL cookies.
This website uses cookies to improve your experience while you navigate through our website. Out of these cookies, the cookies that are categorised as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyse and understand how you use our website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies but it may affect your browsing experience on our website. You can find our cookie policy here.
Necessary cookies are absolutely essential for our website to function and enable core functionality such as security and accessibility. These cookies do not store any personal information. You can block these cookies by changing your browser settings, but this may affect how the website functions.
We use performance cookies such as Google Analytics to help us count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily. The cookies collect information in a way that does not directly identify anyone. For more information on how these cookies work, please see our cookie policy.