What employers do to comply with GDPR
Data protection regulations in Sweden
There are several reasons why employers should do the right thing when it comes to complying with the GDPR rules. First, the fines can be high, but above all, it is stupid that employees can have a hold on their employer for not following the rules. The Data Protection Regulation consists of 99 articles and 173 reasons. This means that the work with data protection can be done extensively, this text can of course not be exhaustive. But with this guide that you can get through in 10 minutes, you can do it better than most.
I hela EU tillämpas dataskyddsförordningen som stiftades 2016 av Europaparlamentet och Europarådet. Den började gälla 2018. Den förordningen tillsammans med den svenska kompletteringslagen (2018:218) tillämpar vi i Sverige på all behandling av personuppgifter. Det finns fler lagar som reglerar behandling av personuppgifter. Men när det gäller arbetsgivares behandling av personuppgifter så är det främst dataskyddsförordningen som tillämpas, även kallad GDPR (General Data Protection Regulation). Det är i princip samma regler som gäller för arbetsgivare såsom företag utan anställda, med något undantag. Det är IMY som har till uppgift att kontrollera efterlevnaden av dataskyddsförordningen samt ta emot klagomål från allmänheten.
What is personal data?
All information that can identify a currently living person is personal data and is covered by the General Data Protection Regulation. Various pieces of information that can be linked to a person are also considered personal data. For example, photos, personal identification numbers, registration numbers on cars owned by individuals, films, IP addresses and telephone numbers.
Employer's responsibilities
De åtta principerna
Det finns ett antal principer som arbetsgivaren ska ha som gyllene regler i sin behandling av personuppgifter. Dessa är laglighet, korrekthet, öppenhet, ändamålsbegränsning, uppgiftsminimering, lagringsminimering, intergritet/ konfidentialitet och ansvarsskyldighet. Dessa principer finns förklarade på många ställen. Men i korthet så fårpersonuppgifter enbart behandlas med en laglig grund, en av dessa är anställningsavtal. Vidare ska de uppgifter som lagras vara korrekta, det ska ske på ett öppet och transparent sätt, de får enbart behandlas utifrån ändamålen, de personuppgifter som behandlas ska utgöras av ett minimum i förhållande till ändamålet. De ska vidare lagras så kort tid som möjligt. Uppgifterna ska skyddas samt så är den personuppgiftsansvariga, oftast arbetsgivaren som är ansvarig för reglernas efterlevnad.
Plan för inbyggt dataskydd
Vidare behöver arbetsgivaren ha en tanke med hur denne ska tillämpa inbyggt dataskydd i sin verksamhet. Det vill säga lämpliga tekniska och organisatoriska åtgärder för att underbygga principerna, exempelvis pseudonomyisering.
När du slår in ditt personnummer när du går till tandläkaren så brukar de fyra sista siffrorna bli fyrkanter. Det är ett exempel på hur verksamhetsutövaren haft en tanke kring inbyggt dataskydd.
Upprätta personuppgiftsbiträdesavtal med dina leverantörer
De företag som arbetsgivaren samarbetar med och delar arbetstagarnas personuppgifter med såsom revisionsbyrå eller företagshälsa måste arbetsgivaren upprätta personuppgiftsbiträdesavtal med.
Register över behandling
Ett register över hur arbetsgivaren behandlar personuppgifterna behöver upprättas. Denna ska IMY kunna få ta del av om de efterfrågar det. Registret ska bland annat innehåller namn och kontaktuppgifter till arbetsgivaren, vilka uppgifter som behandlas, vilka ändamål som arbetsgivaren vilar sina skäl för behandling på mm.
Plan för att skydda datan
The employer must have a structure and plan for how they work with the security of the personal data they store.
Anmälningsplikt vid incidenter
If an incident occurs, for example a computer is stolen, the incident sometimes needs to be reported to IMY within 72 hours.
Konsekvensbedömningar vid hög risk
The employer needs to carry out impact assessments if the treatment poses a high risk to the employees and document this. If there is a high risk with the treatment, the employer must consult with IMY.
Skyldighet att utse dataskyddsombud vid viss behandling
There are mainly three different areas that require the employer to appoint a data protection officer. These are if the employer's core business and, due to its nature and purpose, requires regular and systematic monitoring of the data subjects or if the employer processes sensitive personal data on a large scale.
The nine fundamental rights of the employee
Information om behandling och vid incidenter
When the employee starts work, he has the right to receive information about how the employer will use his personal data. This is why the personal data policy has been created. The information that must be included is stated in Article 13 of the Data Protection Regulation. If the employer receives the employee's information from someone other than the employee, for example a recruitment agency, he also has the right to receive a personal data policy, the content of which is stated in Article 14.
Tillgång
The employee has the right to find out what personal data the employer handles. A so-called register extract. In addition to what personal data is being processed, the employee must also find out what the personal data is used for, how long it will be saved, where it comes from, whether the personal data is shared with someone else, for example an accounting firm, whether the data is used for automated decision-making or profiling, etc. However, this right is not absolute. There are exceptions if, for example, the employee makes the request frequently or if the request would negatively affect the rights and freedoms of other people, which should, however, be rare in a normal workplace. However, there may be such situations, for example to protect whistleblowers.
Rättelse
If the personal data is incorrect, the employee has the right to have it corrected and also to have it supplemented if this is consistent with the purpose of the processing.
Radering (rätten till att bli bortglömd)
There are several conditions that must be met for an employee to have the right to have their data deleted. This may be the case, for example, if the employment has ended and the employer's original purpose for the processing is no longer relevant. However, just because an employment has ended does not mean that there is no basis for having the data deleted for that reason. For example, the employer still needs to be able to administer pensions and store employment contracts.
Begränsning av behandling
Restriction, as it sounds, means that processing is limited to individual areas and purposes. For example, while correction is in progress.
Dataportabilitet (att arbetsgivaren skickar vidare uppgifterna)
For example, if the employee changes jobs, the employer is obliged to facilitate the transfer of personal data to the new employer at the employee's request. However, this only applies to data that the employee has provided to the employer and if it is technically possible.
Invändning
For the majority of the data that the employer processes, it can use the legal basis of a contract. If the employer also applies the legal basis of balancing interests to process individual data for other data, the employee has the right to object to that processing. The employer then has an obligation to demonstrate that his interest outweighs that of the employee, otherwise the processing must cease.
Automatiserade beslut
In the vast majority of cases, automated decisions and profiling based on personal data should not occur within the framework of employees and employers. An exception could be in connection with the employee having saved too many vacation days, where these are paid to the employee. In that case, however, there is an exception if it is necessary to be able to fulfill the fulfillment of a contract, which is the employment contract.
Control of IT systems, camera surveillance and GPS tracking of company cars
There is a specific part of employment law around employee privacy that is linked to GDPR. It is in the nature of things that employers sometimes need to monitor the workplace and its employees. The purpose does not have to be to monitor employees to ensure that they behave, but there are usually more legitimate reasons such as safety, work environment or to comply with other laws and regulations, such as GPS in cars in the form of electronic driving logs. But what is important to keep in mind here is that this is also personal data that is covered by the rules.
Specific GDPR rules for employer whistleblower handling
The Whistleblower Act (2021:890) contains specific rules regarding the handling of personal data. What stands out is that only those who are authorized to receive, follow up and provide feedback on reports are allowed to have access to the personal data being processed. Access to personal data should be limited to what each person needs to be able to fulfill their job duties. The maximum period for which an employer may store the information is two years.
Data protection rules in collective agreements
Collective agreements may contain rules regarding the processing of personal data, both central and local.
Does it feel big? Start with the privacy policy
Establishing a personal data policy is what I recommend smaller employers start with. It is your outward facade regarding the processing of personal data and what an outsider immediately notices whether you have any thoughts at all regarding the processing of personal data. The second is to document all your considerations. In accordance with the principle of accountability, it is the employer's responsibility to be able to prove to IMY that they comply with the GDPR.
Good luck, and don't forget to get in touch if you have any questions.
Kind regards,
Christoffer Lewinowitz
Employer lawyer
With us, the first call is free!
We believe it should be easy as an employer and manager to do the right thing. The distance to ask for help must be short, which is why an initial consultation is always free with us. We will hear from you within 24 hours.
Security agreement for employers...
The subscription includes:
A good complement to the company's legal expenses insurance. Labor disputes are usually an exception in business insurance. For terms and conditions, application and price list, click here.