1

I'm located in the EU.

My employer recently became a contractor for an american company. We deal with software.

A requirement of the american company was that on all machine of the people working under that project, basically spyware must be installed (they track everything). I can use the laptop given to me by my employer for personal use as well (written in the contract), however there is no explicit clause for any gathering of personal information in that contract and I have not signed anything.

This seems quite illegal, especially with the GDPR stuff in the EU. Unfortunately I could not find any concrete law statements on a similar issue. Can someone point to me such sources?

Improve this question
3
  • IANAL, but my guess would be that already for purely professional use there are tight limits to what tracking is allowed. But "track everything" itself can IMHO range from totally inadmissible to providing the legally required audit trail in some highly regulated environments (though in that case I'd guess private use would not be allowed). So all bets are still off...
    – cbeleites unhappy with SX
    Jan 25 '19 at 1:02
  • Did your employer inform you about this tracking software, before it was installed? And does that include details what data is transferred?
    – wimh
    Jan 26 '19 at 17:59
  • It would be justified to shoot off a Subject Access Request to the american company, to have it in writing what information they collect and for what purpose? Of course your employer may not like you if you do so since it is a fair amount of work unless their GDPR systems are in place.
    – Per Digre
    Feb 1 '19 at 15:37
-1

You won't find any concrete statements of law. As you know, the GDPR reads like a policy document. Go figure...

Your employer would probably rely on: 1. Articles 6(1)(c) (its contract with the American company), and 6(1)(f) (legitimate interest) for the right to process the data in the way they they do 2. making a proper disclosure under Article 12(1).

But employers can go too far. Any legitimate interest needs to be justified, after going through a horrific (nicely phrased) "balancing exercise". They can't do anything they like in terms of (1) collecting personal data, or (2) processing it (sending it offshore, to a non-pious data protection country. The pious ones are listed here).

Also, assuming you're in the UK, you could check out International Transfers under the GDPR.

Footnote - the EU regulator used to be Working Party 29. Now its the more impressively named European Data Protection Board. So that you don't need to find out the hard way, the EDPB is a slow updating their website. So you need to go to the Working party 29 Website. Which is "archived". it's the "Opinions" you're interested in.

But if you're really serious, you'd go to source - Opinion 2/2017 on Data Processing at Work, and check out the guidance in your own EU country through its Supervisory Authority.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.