Employee Data Protection – Legal Obligations and Practices 

Today, running a business without processing your employees’ data is virtually impossible. Data processing covers a wide range of operations performed on personal data, including collecting, recording, structuring, storage, retrieval, erasure, and destruction of the data. In the modern employment environment, all of these actions are unavoidable.

Employee data is processed to calculate payroll and compensation, administer benefits such as health insurance and retirement plans, manage various aspects of human resources management, comply with labor laws and regulations, and more.

If this data falls into the wrong hands, the consequences could be dire, which is why employee data protection has become a priority for many organizations worldwide. It is especially necessary for global companies working with European countries, and need to be compliant to the GDPR data processing agreements, as well as the laws in different countries.

What is employee’s personal data?

Employee personal data refers to any information an organization collects and maintains about its employees. A specific subset of personal data is employee’s personal identifiable information (PII), defined as any information that can be used to identify an individual. This can include a wide range of information, such as a person’s name (first, middle and last name, or any other name by which an individual is known), contact information (home address, email address, telephone number, etc.), and online identifiers (IP address, cookie data, etc.).

Employee personal information protection laws are laws and regulations that govern the collection, use, storage, and sharing of personal employee data.

PII also has a subset, called sensitive PII, which includes the following types of information:

• Financial information: bank account number, Social Security number, etc.
• Medical information: health status, medical history, medications currently being taken, genetic information, psychological and behavioral health information, disabilities, etc.
• Biometric information: facial recognition, iris scan, fingerprints, DNA sequence, voiceprint, etc.
• Demographic information: age, gender, race, nationality, religious affiliation, sexual orientation, etc.
• Employment information: salary, benefits, information about an individual’s performance evaluations and disciplinary actions, etc.
• Criminal history: mugshots, arrests, convictions, sentencing information, probation/parole information, etc.

Legal basis for protecting employee data

Under the General Data Protection Regulation (GDPR), there are six legal bases for processing employee personal data. These are:

1. Consent: The employee has given their consent for processing their personal data for one or more specific purposes. For the consent to be considered valid, it must be:

• Freely given – the individual must have the freedom to give or withhold their consent without fear of negative consequences.
• Specific – the individual must be informed of the specific purposes for which their data will be used and must give their consent for each specific purpose.
• Informed – the individual must be fully informed of their rights, including the right to withdraw their consent at any time.
• Unambiguous – the individual’s consent must be given through clear and affirmative action, such as ticking a box or signing a form.
• Documented – the organization must be able to demonstrate that the individual had given their consent, and must keep records of how and when consent was obtained.

2. Contract: the processing is necessary to perform the employee’s contract. For example, when an employee starts working with an organization, the employer needs to process their personal data to calculate payroll, administer benefits, and provide other services they are entitled to under the contract.

3. Legal obligation: if an organization is required by law to process employee personal data, it can protect it on the basis of legal obligation.

Examples of when processing personal data would be necessary to comply with a legal obligation include:

• When an employer is required by law to keep records of its employees’ personal data, such as their address, age, gender, race, etc.
• When an organization is required by law to retain certain financial records, such as invoices or receipts, that contain personal data
• When an organization is required by law to report certain personal data to government agencies or other regulatory bodies, such as information on employee injuries or certain financial transactions.

4. Protection of vital interests: the processing is necessary to protect the employee’s life. For example, if an employee is unconscious and needs medical treatment, healthcare providers would need to process the individual’s personal data (such as medical history, allergies, etc.) to provide appropriate treatment.

5. Public task: the processing is necessary for the performance of a task carried out in the public interest. For example, a government agency may process employee personal data to fulfill its obligations, such as collecting taxes.

6. Legitimate interests: the processing is necessary for the organization’s legitimate interests or the legitimate interests of a third party, except when these interests are overridden by the interests or fundamental rights and freedoms of the employee.

For example, a company needs to process personal data for the purpose of managing recruitment, hiring, employee development, and performance management. In this case, the company is processing employee personal data to achieve its legitimate business interests, i.e., managing its workforce effectively. Additionally, the company may need to share this data with third parties, such as recruitment agencies and external trainers, to meet its business needs.

What types of employee data can organizations legally process under the GDPR?

Under the GDPR, organizations are allowed to process a wide range of employee data, as long as they have a lawful basis for doing so, and they comply with the principles of data protection by safeguarding privacy and data protection principles with the highest standards.

Examples of employee data that organizations may legally process under GDPR include:

• Contact information, such as name, address, phone number, etc.
• Financial information such as bank account number, Social Security number, etc.
• Biometric information: facial recognition, iris scan, voiceprint, etc.
• Employment information, such as job title, salary, performance evaluations, disciplinary actions, etc.
• Health and safety information, such as records of any accidents or injuries at work.
• Employee benefits information, such as pension plans, health insurance, and other benefits.

Employers’ obligations under US data privacy laws

Employers have a variety of obligations under US data privacy laws, depending on the specific law and the type of personal information they process. Examples of these obligations include:

• Under the Health Insurance Portability and Accountability Act (HIPAA), healthcare providers are required to protect the privacy of employees’ medical records and other personal health information. This includes implementing administrative, physical, and technical safeguards to prevent unauthorized access, use, or disclosure of this information.
• Under the Electronic Communications Privacy Act (ECPA), employers are generally prohibited from intercepting employees’ electronic communications without their consent, unless the employer can demonstrate that it has a legitimate business reason for doing so.
• Under the Gramm-Leach-Bliley Act (GLBA), which regulates the collection and sharing of financial information, employers are required to protect the privacy of employees’ financial information by implementing appropriate safeguards and not disclosing this information to third parties without the employee’s consent.
• Under the California Consumer Privacy Act (CCPA), employers are required to disclose what personal information they collect, how they use it, and the rights of California residents to access and request the deletion of their personal data.

How to protect your employees’ data

There are several steps organizations take to protect their employees’ personal data, and avoid payroll leakage including:

Implementing data protection policies

Data protection policies outline the types of personal information collected, how it will be used, and whom it will be shared with. These policies must be reviewed and updated regularly to ensure compliance with changing laws and regulations.

Implementing security measures

Organizations implement security measures to protect personal information from unauthorized access, destruction, alteration, or unauthorized use. This can include encryption, firewalls, multi-factor authentication, and more. (see our security 101 guide)

Conducting regular security audits

Regular security audits ensure that data protection policies and security measures are followed, and any vulnerabilities are identified and addressed.

Conducting employee training

Employees are trained on the company’s data protection policies, as well as best practices for protecting personal information. The training must be repeated regularly to ensure that all employees are aware of their responsibilities.

Managing employee access rights

Strict access controls are necessary to ensure that employees can only access the personal information required for their job responsibilities.

Managing third-party vendors

Third-party vendors that collect, store, or process employee personal data must be evaluated to ensure that they have appropriate data protection policies and practices in place.

Creating an employee privacy policy

An employee privacy policy is a document that outlines the organization’s rules and procedures for processing its employees’ personal information. It is an important tool that helps companies protect employees from unauthorized access, use, or disclosure of their personal data; ensure compliance with data privacy laws and regulations; identify and manage risks associated with employee data protection; and build trust between the company and its employees.

Creating an employee privacy policy involves the following steps:

Listing all your data resources

The first step is identifying and cataloging all the different sources of personal information about employees that a company holds. This process helps companies to understand the types of personal information they collect, where it comes from, and how it is used. Examples of data resources include employee files, HR systems, surveillance systems, email systems, cloud-based services, and more.

Explaining the goal of collecting data

This step is crucial to establish trust and transparency with employees and to ensure compliance with data protection laws. The goal of collecting data should be clearly defined and communicated to employees. For example, if the goal is to collect data for HR purposes, such as maintaining employee records or conducting background checks, this should be clearly stated in the policy.

Assessing the impact of collecting data on privacy

This step involves evaluating the potential risks and negative consequences that may arise from collecting and using personal information, and taking appropriate measures to mitigate or prevent those risks.

The impact of collecting data on privacy should be evaluated by considering factors such as the sensitivity of the information being collected, the potential for misuse of the information, and the potential for harm to employees if the information is mishandled or accessed by unauthorized parties. The policy should also outline the security measures that will be implemented to protect personal information and the process for handling any data breaches or policy violations.

Documenting and replying to feedback

This step involves recording feedback and suggestions from employees and providing appropriate responses to their concerns. Feedback should be solicited from employees to ensure that their perspectives are considered and incorporated into the policy. This can be done through surveys, focus groups, or other methods. The feedback should be recorded, and a summary should be provided to the employees to show that their concerns have been addressed.

It is also essential to reply to feedback in a timely manner and to provide clear explanations for any decisions that were made in response to the feedback. This will help ensure that employees understand the reasoning behind the policy and feel that their input has been valued.

Being transparent about the benefits of data privacy

Transparency helps employees understand how their personal information is being used and protected, which can increase their confidence in the company and make them more willing to share their data. It also helps to prevent misunderstandings and potential legal issues, by making it clear what the company’s data privacy policies are and how they align with relevant laws and regulations. Upgrade your employees’ data privacy.

Upgrade your employees’ data privacy

Here at Papaya Global, we pride ourselves on having the highest standards for the most sensitive data – your employees’ personal information. Our secure cloud platform protects employees personal information by meeting every standard set by GDPR, CCPA, and other data privacy regulations. In addition, our in-house privacy team provides guidance on all data protection matters. Schedule a demo to learn more.