Data Protection in the Employment Relationship

The Act on Protection of Privacy in Working Life regulates primarily an employee’s right to privacy at work. There are also provisions about employees’ data protection in the Personal Data Act and in the Act on Digital Services. The purpose of these laws is to carry out the protection of the employees’ private life in working life, provide regulations regarding collecting and storing of employees’ personal data, testing, and surveillance and observing.

It is highly recommended to pay attention on proper organizing of the employees’ data protection. A possible consequence on breaking the law are fines. The Criminal Code provides regulation on the matter as well.

This article covers only the main principles of data protection at work. The data protection at work and the rights and obligations of the parties to an employment relationship are covered in more detail in section [Protection of Privacy in Working Life].

Collecting Data

The employer may only collect, store or otherwise process personal data directly necessary for the employee's employment relationship. The requirement of necessity cannot be departed from, even with the express consent of the employee. Personal data must be obtained primarily from the employee himself/herself. If the employer collects the data from elsewhere, the consent of the employee must be obtained.

The employer has the right to process information concerning the employee's state of health only from the employee himself/herself, or with the employee’s written consent from other sources. Further, it is required that the information is needed for processing of sick pay or other comparable health-related benefits or to establish whether there was a justifiable reason for absence or if the employee expressly wishes his/her working capacity to be assessed. While contemplating of hiring a job applicant the employer may only ask for health related information which is relevant to the performance of the work.

The Act on the Protection of Privacy in Working Life stipulates when an employer has a right to process applicant’s or employer’s credit information for evaluating his/her reliability.

An employer may ask the Finnish Security and Intelligence Service to carry out a security clearance vetting on employees, if the vetting has a relevance in ensuring information security or protecting vital interests, such as protection of valuable trade secrets or financial interests. Security Clearance Act I shall apply to security clearance vetting. The applicant’s consent is required for the vetting.

If an employee is likely to work with children, the employer is obliged to ask to see a criminal record, which must be no more than six months old. The record must be checked and any obstacles to working with children must be assessed. The date and time of the check must be recorded, but no copies may be taken. It must be returned to the applicant immediately after checking and its contents are confidential.

According to the Co-operation Act, principles and procedures of the company for collecting personal data in recruiting and during employment must be discussed with employees’ representatives in accordance with the co-operation procedure.

The employer does not have a right to copy or in any other away retain the applicant’s criminal records. Personal health information must be kept separate from other information. Access to all personal information must be limited to as few persons as possible.

Collecting, processing, storing and transferring of the personal data are covered in more detail in the section [Protection of Privacy in Working Life]. Furthermore, the criminal background checking and security clearance are covered in more detail in the same section.

Testing

With the employee’s consent, he/she can be tested by means of personality and aptitude assessments to establish his/her capacity to perform work or his/her need for training and other occupational development. Test results must be necessary to the employment relationship. The employer must ensure that the assessment methods used are reliable, the persons conducting the assessment are experts, and that the findings of the assessment are free from errors.

The employer may require the employee to present a drug test certificate during his/her employment relationship if the employer has justifiable cause to suspect that the employee is or has been under the influence of drugs at work or that the employee has a drug addiction. Further preconditions are that the testing is essential for determining the employee’s working or functional capacity and that the employee’s work require special precision, reliability, independent judgement or quick reactions, or involves acting with minors. Commissioning drug tests requires an anti-alcohol / drug program in the workplace.

Testing employees and drug tests are covered in more detail in section [Protection of Privacy in Working Life].

Camera Surveillance

The employer may use camera surveillance for the purposes of ensuring personal security of employees and other persons on its premises, for protecting property, for supervising the proper operation of production process, or for preventing or investigating situations endangering safety, property or production processes.

Camera surveillance may not, however, be used for the surveillance of a particular employee or employees. Neither may camera surveillance be used in lavatories, changing rooms nor social facilities or in offices designated for the personal use of individual employees. The employer may, however, direct the camera surveillance at a particular work station if the surveillance is essential for example for preventing an apparent work related threat of violence.

The purpose, introduction of and methods used in camera surveillance, access control and other technical monitoring of employees are governed by the co-operation procedure stipulated  in the Co-operation Act. In undertakings and in organizations subject to public law not governed by the legislation on cooperation, the employer must, before making decisions on these matters, reserve the employees or their representatives an opportunity to be consulted.

Camera surveillance and other technical surveillance are covered in more detail in section [Protection of Privacy in Working Life].

Opening Electronic Mail Messages

The employer’s right to retrieve and open employee’s email messages is strictly regulated.  The employer has the right to retrieve or open the employee's emails only if the employer has fulfilled his/her obligations regarding necessary arrangements, i.e. planned and arranged for the employee the necessary measures to protect email messages in accordance with measures as defined by the Act. In addition, there are several preconditions for the retrieval of messages, e.g. relating to the work tasks of the employee. There must be a compelling reason for retrieving the messages. Certain requirements must also be fulfilled before the employer can open the messages.

The principles of using the e-mail and networks as well as the processing of the information in the employees’ e-mails and other electronic communications must be governed by the cooperation procedure referred to in the Co-operation Act.

Reading employee’s e-mails and its preconditions are covered in more detail in section [Protection of Privacy in Working Life].

Employee’s Access to Information and Error Correction

The employee is entitled to check what personal data the employer has collected upon him/her. The employee may request personal information concerning himself/herself for review at any time.

The access may be denied only if access to the data would seriously endanger the rights of a third party or harm the prevention or investigation of a crime. If the employer refuses to provide access to the data, a written certificate to this effect must be issued to the employee who may refer the matter to the Data Protection Ombudsman.