This is the case of Spain,
103 Portugal,
104 Germany,
105 Italy,
106 Czech Republic,
107 Romania,
108 France
109 and Greece.
110 All these countries have specific
statutory provisions on the protection of employee’s personal data, including personal data processed by electronic means.
111
Portugal is illustrative in this regard. The Portuguese Labor Code (approved by
Law no. 7/2009, of 12 February 2009, as amended), provides that employees have
the right to privacy in the workplace.
112 Among other rules, it states that the
employer may not use distance surveillance means at the workplace through the
use of technological equipment, such as closed-circuit television, in order to control
the professional performance of the employee. The use of such monitoring equipment may only serve specific purposes, notably to ensure the safety of people or
goods, or to meet particular demands arising from the specific activity involved.
Furthermore, the data collected by these means are considered sensitive data.
113
There is also extensive Portuguese case law and administrative guidance on topics
related to the processing of employees’ data by electronic means, such as
geolocation of vehicles used by employees, the use of electronic equipment at the
workplace, access control management systems and biometric systems, among many
others.
It should be noted that these domestic law provisions are intended to grant
additional protection to employees or to clarify the legal regime already applicable
under the GDPR or other general provisions on data protection. This means that,
besides these specific provisions, employees enjoy the protection provided by the
general personal data legal framework. The main reason why the European Union
countries have enacted specific legislation or issued guidance in this regard relates to
the fact that an employee is particularly vulnerable at the workplace and in the
employment context in general, given its subordination to the employer, and may
feel pressed to accept restrictions to its privacy rights.
Nevertheless, under certain conditions, the employer may legitimately access
electronic communications of an employee. Such is the case, for example, when
the rules adopted by the latter include that possibility and are notified in advance to
103 See the Spanish National Report, Sect. 2.1.6.
104 See the Portuguese National Report, Sect. 2.
105 See the German National Report, Sects. 2.1.5–2.1.7.
106 See the Italian National Report, Sect. 2.3.
107 See the Czech National Report, Sect. 2.2.
108 See the Romanian National Report, Sect. 3.2.
109 See the French National Report, Sect. 2.
110 See the Greek National Report, Sect. 2.1.4.
111 Some non-European countries, such as Singapore, also cover the protection of personal data of
employees, although there are no specific statutory provisions for these data subjects. See the
Singaporean Report, Sect. 3.5.
112 See article 16 of the Code.
113 See the Portuguese National Report, Sect. 2.
22
D. Moura Vicente and S. de Vasconcelos Casimiro
103 Portugal,
104 Germany,
105 Italy,
106 Czech Republic,
107 Romania,
108 France
109 and Greece.
110 All these countries have specific
statutory provisions on the protection of employee’s personal data, including personal data processed by electronic means.
111
Portugal is illustrative in this regard. The Portuguese Labor Code (approved by
Law no. 7/2009, of 12 February 2009, as amended), provides that employees have
the right to privacy in the workplace.
112 Among other rules, it states that the
employer may not use distance surveillance means at the workplace through the
use of technological equipment, such as closed-circuit television, in order to control
the professional performance of the employee. The use of such monitoring equipment may only serve specific purposes, notably to ensure the safety of people or
goods, or to meet particular demands arising from the specific activity involved.
Furthermore, the data collected by these means are considered sensitive data.
113
There is also extensive Portuguese case law and administrative guidance on topics
related to the processing of employees’ data by electronic means, such as
geolocation of vehicles used by employees, the use of electronic equipment at the
workplace, access control management systems and biometric systems, among many
others.
It should be noted that these domestic law provisions are intended to grant
additional protection to employees or to clarify the legal regime already applicable
under the GDPR or other general provisions on data protection. This means that,
besides these specific provisions, employees enjoy the protection provided by the
general personal data legal framework. The main reason why the European Union
countries have enacted specific legislation or issued guidance in this regard relates to
the fact that an employee is particularly vulnerable at the workplace and in the
employment context in general, given its subordination to the employer, and may
feel pressed to accept restrictions to its privacy rights.
Nevertheless, under certain conditions, the employer may legitimately access
electronic communications of an employee. Such is the case, for example, when
the rules adopted by the latter include that possibility and are notified in advance to
103 See the Spanish National Report, Sect. 2.1.6.
104 See the Portuguese National Report, Sect. 2.
105 See the German National Report, Sects. 2.1.5–2.1.7.
106 See the Italian National Report, Sect. 2.3.
107 See the Czech National Report, Sect. 2.2.
108 See the Romanian National Report, Sect. 3.2.
109 See the French National Report, Sect. 2.
110 See the Greek National Report, Sect. 2.1.4.
111 Some non-European countries, such as Singapore, also cover the protection of personal data of
employees, although there are no specific statutory provisions for these data subjects. See the
Singaporean Report, Sect. 3.5.
112 See article 16 of the Code.
113 See the Portuguese National Report, Sect. 2.
22
D. Moura Vicente and S. de Vasconcelos Casimiro