In advance of our recent seminar, we received an enquiry from one of the attendees about the implementation of the new EU General Data Protection Regulation (GDPR) in May 2018.  More specifically, they were wondering whether they needed to update their employment contracts to include a new form of consent from staff for the processing of their personal data.  

This raises a very interesting point. As it happens, for some time now there has been considerable doubt over the validity of consents given by employees in relation to the processing of their personal data.  

For consent to be meaningful, it must be ‘freely given’.  Yet the consents given by employees almost always form a compulsory part of the contract of employment. As a result, the employee has little opportunity to negotiate or indeed refuse to give the consent requested.  

Given that the requirements for valid consent from data subjects are being ‘beefed up’ still further under the GDPR, the prospect of achieving a valid consent after May 2018 seems to be very small indeed. In the circumstances, employers will need to consider what alternative justification they may have for processing their employees’ personal data. They will also need to issue their employees with a valid ‘privacy notice’. 

Amongst other things, this notice must clearly document 

(i) the types of personal data they will process, 

(ii) the reasons for which they will process this data and 

(iii) the legal basis on which they are doing so. 

This ‘privacy notice’ needs to be quite detailed and will require careful thought. We are in the process of drawing up a template ‘privacy notice’ for those businesses who need one.

If you would be interested in finding out more, please contact us at employment@stevensdrake.com