Violations of Proposed EU Privacy Rules Could Cost Companies Up to Two Percent of Global Revenues

A BEERG-HR Policy Association policy paper describes how a proposed new regulation in the European Union replacing the myriad national laws governing individual data protection with a single set of EU-wide rules would have significant consequences for employment data.  Most significantly, a violation of the regulation could subject a company to a fine of up to two percent of its annual global revenues.  The policy paper, prepared by international law specialist, Malcolm Mason, describes several areas where the proposed regulation would impact the collection of HR data, including:

• A requirement of a “valid consent” by an employee before her/his data can be processed, and such consent may not be made a condition of employment;
• Stricter controls on transfers of personal data from within the EU to countries outside the EU;
• A “right to be forgotten” requiring data controllers to delete personal data relating to a data subject where the individual withdraws consent, objects to that controller’s processing of their information, or where their personal data is no longer needed; and
• A requirement to appoint a “data protection officer” for a two-year term with enhanced job protections.

While the proposed regulation is mainly targeted at social media and Internet trading, it fails to recognize that the nature of the relationship between an employer and an employee is fundamentally different from that between a user and Twitter or Facebook.  As the proposal moves forward, our European ally BEERG will be making the case that employment data should be treated differently from social media data or client/consumer data and subjected to a separate set of rules.

Source: HRPolicy.org