Personal data at work, November 2002

On 31 October 2002 the European Commission proposed a new legislative framework for the use of personal data at work. The initiative takes the form of a second formal consultation of representative organisations such as UNICE, ETUC, UEAPME, CEC and Eurocadres (the 'social partners') and is a follow-up to an earlier consultation launched at the end of August 2001. The new proposal takes account of responses to the initial consultation and of a number of studies undertaken by the Commission.

Although two existing Directives (95/46/EC and 97/66/EC) relate to workers' personal data their scope is considered too general and they are not always applied. Consequently the rules concerning the processing of workers' personal data differ between Member States.

The Commission has also highlighted three other issues affecting data protection in the workplace:

• technological advance (e.g. e-mails, electronic files, the emergence of the 'home office' or telework which is increasingly blurring the boundary between work and private life, and cheaper genetic testing technology)

• globalisation (outsourcing of the human resource function of large businesses is new and offers efficiency gains but may be difficult if data protection laws are radically different from one jurisdiction to another)

• post 11 September insecurity (in some jurisdictions, such as the US, businesses may be expected to monitor workers or prospective workers as part of broader government efforts to step up security monitoring)

The Commission's proposed framework therefore seeks to establish 'a set of principles and rules governing treatment of personal data at work in order to provide clear and comprehensive guidance to employers and workers about their rights and obligations in this field'.

Topics addressed in the consultative document include:

Consent: because of the relationship between employers and (prospective) employees, in which it can be 'difficult to refuse, withdraw or modify consent', the Commission proposes that consent on its own is 'an inadequate safeguard for the worker'. This is particularly true where sensitive data is concerned (such as that concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership or health or sex life).

Medical data: because of the 'high sensitivity' of medical data and current disparities in how Member States treat its processing, the Commission wants to see a general EU-level legislative framework introduced.

Drug testing and genetic testing: the Commission's proposal seeks to limit employers' rights to collect and process data on drug and substance abuse and to 'circumscribe the practice by employers of genetic testing and to limit the use of data which result from such testing'.

Monitoring and surveillance: rules concerning employers' rights to monitor workers' behaviour and correspondence (such as using the internet and sending / receiving e-mails) currently vary between Member States and the Commission wants to establish 'a set of transparent and clear-cut EU principles'.

Anna Diamantopoulou, European Commissioner for Employment and Social Affairs, said: 'The EU needs clearer, simpler rules on protection of workers' personal data which take better account of the employer/worker relationship. A clear and simple framework of principles and rules, applicable throughout the EU, will be good for workers and good for business'.

The social partners now have six weeks to comment on the Commission's proposals. If they decide to establish their own EU-wide initiative on data protection at work, they will have nine months to draw up an agreement. Failing such an agreement, the Commission can then propose EU-level legislation.

Links:

European Commission:
	31.10.02:	Data protection at work: Commission proposes new EU framework to European social partners [IP/02/1593]
	Second stage consultation of social partners on the protection of workers' personal data
UNICE:
	Homepage
ETUC:
	Homepage

Eric Davies
KnowEurope Researcher,
Compiled: Friday, 1 November 2002

On 31 October 2002 the European Commission proposed a new legislative framework for the use of personal data at work.