4

Currently, our team has a number of internal tools that aid the testing and deployment of our products. These are used solely by internal employees, and record actions taken (such as when a file has been viewed).

The recorded data contains identifiable information, such as their Windows username - which can be used to identify a specific individual.

We also process this data, to provide statistics on individual's work, to managers who are also internal.

Does this data, also need to comply with GDPR - or does GDPR only apply to data from the public?

Improve this question

2 Answers 2

Reset to default
4

Yes, it also applies.

However, an employment implies they agree to having employment related data stored and processed (e.g., to be paid). When there are performance related bonuses in the contract, this will likely (but IANAL) imply they agree to performance data being collected and stored appropriately.

Furthermore I would assume most of such data processing (such as knowing who is responsible for a certain change, who created a file, modified it etc.) falls into "legitimate interests" of the employer, as this information may be necessary for operations.

I'd assume (still IANAL) that much of the consequence wrt. GDPR is the right to have your data erased. So a company should be prepared to remove such data when an employee leaves the company, e.g., by clearing the responsible person fields upon request. At least for data where there is no legal requirement to have such data provenance.

But: consult your lawyer for a proper legal opinion!

Improve this answer
2
  • The legitimate interests of the employer probably persist after the employee has left. For example you might find out years later that an ex-employee has been convicted of hacking; you will want to identify the code changes that they made.
    – Michael Kay
    Jun 26, 2019 at 14:55
  • Which would be possible with an archived version, whereas the "live" version does not need the real name but could use a pseudonym.
    – Has QUIT--Anony-Mousse
    Jun 27, 2019 at 5:37
3

Yes, GDPR applies to employee data. There are a few special provisions for employee data, but the fact that a person is an employee does not by itself mean that someone is not a "data subject" as defined in Article 4, item 1.

In fact, one of the special provisions for employees is that member states may make "more specific" rules for the processing of employee data, under Article 88, including "for the purpose[] of ... the performance of the contract of employment[.]"

Your company's lawyer may therefore want to look at what national law has to say about the data recorded by your internal tools.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .