c) Integrity tests should be conducted without causing employees under test to
commit criminal and/or disciplinary deeds.
By interpreting the provisions of the Law 190/2018, the processing of personal
data for integrity testing on employees may only be carried out under the legitimate
interest of employers, unless the interests or fundamental rights and freedoms of
employees that require the protection of personal data prevail.
The personal data processing accessory for integrity testing based on employer’s
legitimate interest will be the employee’s right of opposition, for reasons related to
the particular situation in which it is located, which will have to be guaranteed to
them. Employers will have the obligation to cease processing for integrity tests if it
does not demonstrate that it has legitimate interests that outweigh the rights and
interests of the data subjects to continue the business (i.e. passing the balance test as
described below and adequately documenting it).
In this respect, we mention that the other processing grounds are not a solution for
the processing of personal data related to integrity testing, as follows:
a) Obtaining the consent of the employees in this situation is not a solution because
it will be vitiated, being considered as not being freely expressed in view of the
subordination relationship between the employee and the employer; Performing
these integrity tests is not a necessary requirement for the employment contract
between employers and employees, as an option of the employer;
b) Processing is necessary to fulfil a legal obligation that it is the operator’s
responsibility—we contend that we did not identify such an obligation that
would apply to employers;
c) The results of these integrity tests do not come to protect the employee’s vital
interests, but rather as a means of protecting the employer’s interests;
Conducting these tests is not a public interest task and no exercise of public
authority, most employers (excepting public authorities) being an eminently
private entity that does not perform activities of public interest and has not been
invested with public authority.
In order for the employer to be able to rely on its legitimate interest, it must, first
of all, determine such an interest which, in our view, can be structured in the form
of—ensuring the economic integrity of employer or the property it owns
(e.g. buildings, money, goods, etc.) and the need to prevent or detect any possible
fraudulent actions, corruption, or any other possible violation of applicable law
(including criminal law). By reference to fundamental rights, this interest can also
be subsumed in the form of—the defence of employer’s right of ownership, which,
in the field of labour law, finds expression both in the employer’s right to determine
its way of organization and functioning, determine how to verify the fulfilment of the
obligations of its employees.
Data Protection Regulations: Overview of the Romanian Legislation and. . .
299
commit criminal and/or disciplinary deeds.
By interpreting the provisions of the Law 190/2018, the processing of personal
data for integrity testing on employees may only be carried out under the legitimate
interest of employers, unless the interests or fundamental rights and freedoms of
employees that require the protection of personal data prevail.
The personal data processing accessory for integrity testing based on employer’s
legitimate interest will be the employee’s right of opposition, for reasons related to
the particular situation in which it is located, which will have to be guaranteed to
them. Employers will have the obligation to cease processing for integrity tests if it
does not demonstrate that it has legitimate interests that outweigh the rights and
interests of the data subjects to continue the business (i.e. passing the balance test as
described below and adequately documenting it).
In this respect, we mention that the other processing grounds are not a solution for
the processing of personal data related to integrity testing, as follows:
a) Obtaining the consent of the employees in this situation is not a solution because
it will be vitiated, being considered as not being freely expressed in view of the
subordination relationship between the employee and the employer; Performing
these integrity tests is not a necessary requirement for the employment contract
between employers and employees, as an option of the employer;
b) Processing is necessary to fulfil a legal obligation that it is the operator’s
responsibility—we contend that we did not identify such an obligation that
would apply to employers;
c) The results of these integrity tests do not come to protect the employee’s vital
interests, but rather as a means of protecting the employer’s interests;
Conducting these tests is not a public interest task and no exercise of public
authority, most employers (excepting public authorities) being an eminently
private entity that does not perform activities of public interest and has not been
invested with public authority.
In order for the employer to be able to rely on its legitimate interest, it must, first
of all, determine such an interest which, in our view, can be structured in the form
of—ensuring the economic integrity of employer or the property it owns
(e.g. buildings, money, goods, etc.) and the need to prevent or detect any possible
fraudulent actions, corruption, or any other possible violation of applicable law
(including criminal law). By reference to fundamental rights, this interest can also
be subsumed in the form of—the defence of employer’s right of ownership, which,
in the field of labour law, finds expression both in the employer’s right to determine
its way of organization and functioning, determine how to verify the fulfilment of the
obligations of its employees.
Data Protection Regulations: Overview of the Romanian Legislation and. . .
299