GDPR harmonises data protection legislation within Europe and will update the current regime, which is over 20 years old.
GDPR introduces new rights, larger penalties and new accountability, which means the data controller is responsible for and must be able to demonstrate that they have complied with the relevant processing principles. There are real consequences if it is wrong.
Human Resources are responsible for handling staff data for all employees current and former as well as job applicants. Therefore, HR are at the forefront of GDPR in terms of data compliance.
To deal with the major changes it is important to have detailed policies and procedures in place because information held about employees will be under greater scrutiny than ever before.
The new regulations are providing individuals with greater freedom and access to information that is held about them including the information current and previous employers hold.
Employees should be told what data will be held about them and how it is intended to be used. This should be outlined in a privacy policy and should be available to current employees and any candidates that have applied for a job.
Individuals can request for the data that is held about them to be deleted, so that they can be, in other words, forgotten. The request doesn’t always have to be granted if there are justified reasons for it to be kept. For instance if an employee is dismissed the employer may wish to keep the data on record for a specified amount of time to ensure they have evidence in case they require it again in the future.
This gives employees the ability to request access to all of the data that is held about them by an employer (current or previous), whether it’s their bank details for payroll, email correspondence in relation to a grievance or their initial job application form.
If the individual believes that the information that is being held is incorrect in any shape or form, they can request for the details to be corrected.
This means that an individual can limit the way that an organisation uses their data but is not requesting the erasure of their data. This may be because they have issues with the content of the information you hold or how you have processed their data.
This allows employees to obtain and reuse their personal data for their own purposes across different services under certain circumstances for example, transferring information from one bank to another.
These rights apply in certain circumstances and there will be some instances where the information must be kept or is unable to be amended. Therefore, it is vital that employers have clear policies and procedures in place that outline the collection of data, what the data will be used for, how long it will be kept for and how it will be stored. It is also important to keep a data trail to ensure any change or removal requests are simple to carry out and nothing is missed otherwise there is the risk of a data breach.
Lawson West have an incredibly knowledgeable Employment Team and can provide you with guidance on numerous aspects the GDPR regulations, whether it’s a question regarding writing a privacy notice or dealing with a Subject Access Request, the team is always more than willing to be of assistance. Call the team today on 0116 212 1000 or visit www.lawson-west.co.uk
