GDPR on employee data

Question

I am making a web-based project management tool that stores employee salaries.

What are the implications with GDPR to store this info?

Do we need consent from them?

Answer 1

What are the implications with GDPR to store this info?

They are many. GDPR is broad and complex. The other answers cover this pretty well.

There are probably also privacy implications that may not be covered by GDPR. In addition to GDPR, you also need to consider whether the use of employee data in this application is governed by national legislation in each country where the company operates.

As others have noted, you may want to consult a lawyer.

Do we need consent from them?

This is rather easier to answer. The GDPR requires (under Article 6) that data processing be lawful. There are several conditions that satisfy this requirement, of which only one is consent of the data subject:

Article 6

Lawfulness of processing

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

...

The last one probably covers the requirements of an employer who wants to use employees' salary information to make business decisions:

...

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data....

So the answer to whether you require consent depends on the purpose of the tool. But for the most part it is hard to imagine any "interest or fundamental right or freedom" of an employee that would override the employer's "legitimate interest" in using salary information for planning.

For a more rigorous determination of this question, again, you should talk to a lawyer, who will take into account not only the text of the regulation but also any relevant judicial findings. The lawyer will also need a more detailed description of the application, its purpose, and the data that it processes.

Answer 2

Just remember that my information must not be shown to anyone who doesn't have a good reason to see it, so your software mustn't do this while working as designed, and you must make sure that your software can't be hacked to do this.

Consent doesn't really come into it. I'm in a business relationship with the employer, therefore the employer needs to know some data about me, whether I consent or not. For data that the employer doesn't need to know, they generally shouldn't ask for my consent but just not store that information.

Answer 3

If the employees are EU residents, or if the company handles data of EU residents, or if the company is located in the EU, the GDPR applies. It covers much more than just getting consent, and in fact consent may not be necessary.

• You have to document your data processing and to show those documents to the authorities on demand. You may have to designate a Privacy Officer in your company and ensure that this employee has the necessary information for the job.
• If you use third parties for data processing, you have to verify that they are GDPR-compliant and make contracts to ensure it stays that way.
• You may have to report certain incidents.
• You must use data only for legal purposes. Explicit consent is one way to get the permission to use data, there are others.
• You must be prepared to answer questions about the data you hold, and to delete data on demand, unless there is a legal reason to keep it. (For instance, one cannot simply tell a webshop to "delete an account" if some of the data must be kept for tax purposes.)

I am not a lawyer and I cannot provide legal advice, but to me it seems that you do need a lawyer to answer your questions.