Data Protection in a Working Relationship in General

Employees’ data protection is regulated by the Act on the Protection of Privacy in Working Life. The purpose of the Act is to carry out the employees’ right to protection of privacy and other basic rights that protect privacy in working life as well. The employer may only process personal data that relates to the carrying out of rights and obligations of the parties to the working relationship, the benefits provided by the employer to the employees or the special nature of the duties, provided, in each case, that it is directly necessary relative to the employee’s working relationship. This requirement of necessity cannot be deviated from through the employee giving their consent.

One goal of the Act is to reduce the use of unreliable aptitude and personality assessment tests. The Act also stipulates the employer's conditions for monitoring the activities of employees by technical means, such as camera surveillance or the monitoring of email and internet traffic.

In addition, the purpose and introduction of, and methods used in, camera surveillance, access control and other technical monitoring of employees, the use of email and other data networks and the processing of information about the employee’s email and other electronic communication must be discussed and brought before the employees in a dialogue under the Act on Co-operation within Undertakings or consultation procedures, depending on the size of the company.

Attention should be paid to the proper organization of employee data protection. Compliance with the law is monitored by the Occupational Safety and Health Administration together with the Data Protection Ombudsman. Violation of the law may result in a fine, for example when an employer conducts an aptitude test without the employee's consent or installs camera surveillance in break rooms. This subject is also regulated by the Criminal Code.