Article 88
Processing in the context of employment

Official
Texts
Guidelines Caselaw Review of
EU Regulation
Review of
Nat. Regulation
Show the recitals of the Regulation related to article 88 keyboard_arrow_down Hide the recitals of the Regulation related to article 88 keyboard_arrow_up

(155) Member State law or collective agreements, including ‘works agreements’, may provide for specific rules on the processing of employees' personal data in the employment context, in particular for the conditions under which personal data in the employment context may be processed on the basis of the consent of the employee, the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.

There is no recital in the Directive related to article 88.

The GDPR

Article 88 of the Regulation allows Member States, either by law or through collective agreements, make adjustments to data protection rules for  employment relationship, including more precise rules for the protection of rights and freedoms.

These rules could be provide for processing to be limited purposes such as recruitment, performance of the employment contract, other obligations established by law or by collective agreements, management, planning and organization of labour, equality and diversity in the workplace, occupational health and safety, protection of property belonging to the employer or client, exercise and enjoyment of rights and benefits related to the employment, individually or collectively, as well as for the termination of the employment relationship.

Those rules must include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place (paragraph 2).

Initially, the second proposed version of the Regulation authorised the Member State to establish, by law, the conditions, in which the personal data relating to employment could be processed on the basis of the employee’s consent. This provision was deleted, as the G29 argued consent of an employee can be considered as expressed explicitly and freely as part of an employment contract characterized by a subordination link (Opinion 15/2011 of 13 July 2011 on the definition of consent, WP 187, p 15;. see also WP 48 on the processing of personal data in the employment context. WP 114 - Working document on a common interpretation of Article 26, paragraph 1 of Directive 95/46/EC of 24 October 1995, is also relevant).

Finally, Each Member State shall notify the Commission of those provisions adopted into its law no later than 2 years after the publication of the Regulation and, without delay, any subsequent amendment affecting them.

The Directive

The Directive did not contain any specific provision in the context of labour law.

Potential issues

The difficulty will doubtlessly arise from the divergences of the regime between the Member States and from a lack of harmonization, as the lowest severity to be applied in a matter could foster a social dumping phenomenon. Therefore, control is provided via the notifications to the Commission, which should help to avoid excessive disparities.

 

Summary

European Union

European Union

Retour au sommaire

Article 29 Working Party

Opinion 2/2017 on data processing at work - wp249 ( 8 June 2017)

This Opinion complements the previous Article 29 Working Party (“WP29”) publications Opinion 8/2001 on the processing of personal data in the employment context (WP48) , and the 2002 Working Document on the surveillance of electronic communications in the workplace (WP55). Since the publication of these documents, a number of new technologies have been adopted that enable more systematic processing of employees’ personal data at work, creating significant challenges to privacy and data protection. This Opinion makes a new assessment of the balance between legitimate interests of employers and the reasonable privacy expectations of employees by outlining the risks posed by new technologies and undertaking a proportionality assessment of a number of scenarios in which they could be deployed. Whilst primarily concerned with the Data Protection Directive, the Opinion looks toward the additional obligations placed on employers by the General Data Protection Regulation. It also restates the position and conclusions of Opinion 8/2001 and the WP55 Working Document, namely that when processing employees’ personal data:

-  employers should always bear in mind the fundamental data protection principles, irrespective of the technology used; -  the contents of electronic communications made from business premises enjoy the same fundamental rights protections as analogue communications;

- consent is highly unlikely to be a legal basis for data processing at work, unless employees can refuse without adverse consequence;

- performance of a contract and legitimate interests can sometimes be invoked, provided the processing is strictly necessary for a legitimate purpose and complies with the principles of proportionality and subsidiarity;

- employees should receive effective information about the monitoring that takes place; and

- any international transfer of employee data should take place only where an adequate level of protection is ensured.

Link

Retour au sommaire

Summary

European Union

European Union

CJEU caselaw

C-34/21 (30 March 2023) - Hauptpersonalrat der Lehrerinnen und Lehrer

1.      Article 88 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that national legislation cannot constitute a ‘more specific rule’, within the meaning of paragraph 1 of that article, where it does not satisfy the conditions laid down in paragraph 2 of that article.

2.      Article 88(1) and (2) of Regulation 2016/679

must be interpreted as meaning that the application of national provisions adopted to ensure the protection of employees’ rights and freedoms in respect of the processing of their personal data in the employment context must be disregarded where those provisions do not comply with the conditions and limits laid down in Article 88(1) and (2), unless those provisions constitute a legal basis referred to in Article 6(3) of that regulation, which complies with the requirements laid down by that regulation.

Judgment of the court

Opinion of the advocate General


C-65/23 (19 December 2024) - K GmbH (Traitement de données personnelles des employés)

1.      Article 88(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that a provision of national law which concerns the processing of personal data for the purposes of employment relationships and has been adopted pursuant to Article 88(1) of that regulation must have the effect of requiring its addressees to comply not only with the requirements arising from Article 88(2) of that regulation, but also with those arising from Article 5, Article 6(1) and Article 9(1) and (2) thereof.

2.      Article 88(1) of Regulation 2016/679

must be interpreted as meaning that, where a collective agreement falls within the scope of that provision, the margin of discretion that the parties to that agreement have to determine whether the processing of personal data is ‘necessary’, within the meaning of Article 5, Article 6(1) and Article 9(1) and (2) of that regulation, does not prevent the national court from carrying out a full judicial review in that regard.

Judgment of the Court 

Retour au sommaire Retour au sommaire
Regulation
1e 2e

Art. 88

1. Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer's or customer's property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.

2. Those rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.

3. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

1st proposal close

Art. 82

1. Within the limits of this Regulation, Member States may adopt by law specific rules regulating the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.

2. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by the date specified in Article 91(2) at the latest and, without delay, any subsequent amendment affecting them.

3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1.

2nd proposal close

Art. 82

1. Member States may by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer’s or customer’s property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship. (…)

2. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by the date specified in Article 91(2) at the latest and, without delay, any subsequent amendment affecting them.

3. Member States may by law determine the conditions under which personal data in the employment context may be processed on the basis of the consent of the employee.

Directive close

No specific provision

Artículo 89. Derecho a la intimidad frente al uso de dispositivos de videovigilancia y de grabación de sonidos en el lugar de trabajo.

1. Los empleadores podrán tratar las imágenes obtenidas a través de sistemas de cámaras o videocámaras para el ejercicio de las funciones de control de los trabajadores o los empleados públicos previstas, respectivamente, en el artículo 20.3 del Estatuto de los Trabajadores y en la legislación de función pública, siempre que estas funciones se ejerzan dentro de su marco legal y con los límites inherentes al mismo. Los empleadores habrán de informar con carácter previo, y de forma expresa, clara y concisa, a los trabajadores o los empleados públicos y, en su caso, a sus representantes, acerca de esta medida.

En el supuesto de que se haya captado la comisión flagrante de un acto ilícito por los trabajadores o los empleados públicos se entenderá cumplido el deber de informar cuando existiese al menos el dispositivo al que se refiere el artículo 22.4 de esta ley orgánica.

2. En ningún caso se admitirá la instalación de sistemas de grabación de sonidos ni de videovigilancia en lugares destinados al descanso o esparcimiento de los trabajadores o los empleados públicos, tales como vestuarios, aseos, comedores y análogos.

3. La utilización de sistemas similares a los referidos en los apartados anteriores para la grabación de sonidos en el lugar de trabajo se admitirá únicamente cuando resulten relevantes los riesgos para la seguridad de las instalaciones, bienes y personas derivados de la actividad que se desarrolle en el centro de trabajo y siempre respetando el principio de proporcionalidad, el de intervención mínima y las garantías previstas en los apartados anteriores. La supresión de los sonidos conservados por estos sistemas de grabación se realizará atendiendo a lo dispuesto en el apartado 3 del artículo 22 de esta ley.

 

Artículo 90. Derecho a la intimidad ante la utilización de sistemas de geolocalización en el ámbito laboral.

1. Los empleadores podrán tratar los datos obtenidos a través de sistemas de geolocalización para el ejercicio de las funciones de control de los trabajadores o los empleados públicos previstas, respectivamente, en el artículo 20.3 del Estatuto de los Trabajadores y en la legislación de función pública, siempre que estas funciones se ejerzan dentro de su marco legal y con los límites inherentes al mismo.

2. Con carácter previo, los empleadores habrán de informar de forma expresa, clara e inequívoca a los trabajadores o los empleados públicos y, en su caso, a sus representantes, acerca de la existencia y características de estos dispositivos. Igualmente deberán informarles acerca del posible ejercicio de los derechos de acceso, rectificación, limitación del tratamiento y supresión.

 

Artículo 91. Derechos digitales en la negociación colectiva.

Los convenios colectivos podrán establecer garantías adicionales de los derechos y libertades relacionados con el tratamiento de los datos personales de los trabajadores y la salvaguarda de derechos digitales en el ámbito laboral.

 

Disposición final decimotercera. Modificación del texto refundido de la Ley del Estatuto de los Trabajadores.

Se añade un nuevo artículo 20 bis al texto refundido de la Ley del Estatuto de los Trabajadores, aprobado por Real Decreto Legislativo 2/2015, de 23 de octubre, con el siguiente contenido:

«Artículo 20 bis. Derechos de los trabajadores a la intimidad en relación con el entorno digital y a la desconexión.

Los trabajadores tienen derecho a la intimidad en el uso de los dispositivos digitales puestos a su disposición por el empleador, a la desconexión digital y a la intimidad frente al uso de dispositivos de videovigilancia y geolocalización en los términos establecidos en la legislación vigente en materia de protección de datos personales y garantía de los derechos digitales.»

 

Disposición final decimocuarta. Modificación del texto refundido de la Ley del Estatuto Básico del Empleado Público.

Se añade una nueva letra j bis) en el artículo 14 del texto refundido de la Ley del Estatuto Básico del Empleado Público, aprobado por Real Decreto Legislativo 5/2015, de 30 de octubre, que quedará redactada como sigue:

«j bis) A la intimidad en el uso de dispositivos digitales puestos a su disposición y frente al uso de dispositivos de videovigilancia y geolocalización, así como a la desconexión digital en los términos establecidos en la legislación vigente en materia de protección de datos personales y garantía de los derechos digitales.»

---

Article 89. Right to digital disconnection in the workplace.

1. Public workers and employees shall have the right to digital disconnection in order to guarantee, outside the legally or conventionally established working time, respect for their rest, leave and vacation time, as well as their personal and family privacy.

2. The modalities for exercising this right shall take into account the nature and purpose of the employment relationship, shall promote the right to reconcile work and personal and family life, and shall be subject to the provisions of collective bargaining or, failing this, to the agreement between the company and the workers' representatives.

3. The employer, after hearing the workers' representatives, shall draw up an internal policy aimed at workers, including those in managerial positions, defining the modalities for exercising the right to disconnection and the training and awareness-raising actions for personnel on the reasonable use of technological tools to avoid the risk of computer fatigue. In particular, the right to digital disconnection will be preserved in cases of total or partial remote work and at the employee's home in connection with the use of technological tools for work purposes.

Right to privacy against the use of video surveillance and sound recording devices in the workplace.

1. Employers may process the images obtained through camera or video camera systems for the exercise of the functions of control of workers or public employees provided, respectively, in Article 20.3 of the Workers' Statute and in the civil service legislation, provided that these functions are exercised within their legal framework and with the limits inherent thereto. Employers shall inform in advance, and in an express, clear and concise manner, the workers or public employees and, where appropriate, their representatives, about this measure.

In the event that the flagrant commission of an unlawful act by workers or public employees has been detected, the duty to report shall be deemed to have been fulfilled when there is at least the device referred to in Article 22.4 of this Organic Law.

2. In no case shall the installation of sound recording or video surveillance systems be allowed in places intended for the rest or recreation of workers or public employees, such as changing rooms, toilets, dining rooms and the like.

3. The use of systems similar to those referred to in the previous sections for the recording of sounds in the workplace will only be allowed when the risks to the safety of the installations, goods and persons derived from the activity carried out in the workplace are relevant and always respecting the principle of proportionality, the principle of minimum intervention and the guarantees provided for in the previous sections. The suppression of the sounds preserved by these recording systems shall be carried out in accordance with the provisions of section 3 of article 22 of this Law.

 

 

Article 90. Right to privacy in the use of geolocation systems in the workplace.

1. Employers may process data obtained through geolocation systems for the exercise of the functions of control of workers or public employees provided, respectively, in Article 20.3 of the Workers' Statute and in the civil service legislation, provided that these functions are exercised within their legal framework and with the limits inherent to it.

2. Beforehand, employers must expressly, clearly and unequivocally inform workers or public employees and, where appropriate, their representatives, about the existence and characteristics of these devices. They must also inform them about the possible exercise of the rights of access, rectification, limitation of processing and erasure.

 

Article 91. Digital rights in collective bargaining.

Collective bargaining agreements may provide for additional guarantees of rights and freedoms related to the processing of workers' personal data and the safeguarding of digital rights in the workplace.

 

Thirteenth final provision: Amendment of the revised text of the Workers' Statute Law.

A new article 20 bis is added to the revised text of the Workers' Statute Law, approved by Royal Legislative Decree 2/2015, of October 23, with the following content:

"Article 20 bis. Workers' rights t o privacy in relation to the digital environment and to disconnection.

Workers have the right to privacy in the use of digital devices made available to them by the employer, to digital disconnection and to privacy from the use of video surveillance and geolocation devices under the terms established in current legislation on the protection of personal data and guarantee of digital rights."

 

Fourteenth final provision: Modification of the revised text of the Basic Statute of the Public Employee Law.

A new letter j bis) is added to Article 14 of the consolidated text of the Basic Statute of the Public Employee Law, approved by Royal Legislative Decree 5/2015, of October 30, which shall be worded as follows:

"(j bis) To privacy in the use of digital devices made available to them and against the use of video surveillance and geolocation devices, as well as to digital disconnection under the terms established in the current legislation on the protection of personal data and guarantee of digital rights."

Old law close

Article 6.2.- Consent of the data subject.- Organic Law 15/1999 on the Protection of Personal Data.-

Consent shall not be required when the personal data are collected for the exercise of the functions proper to public administrations within the scope of their responsibilities; when they related to the parties of a contract or preliminary contract for business, employment or administrative relationship, and the data are necessary for its maintenance or fulfilment.

close