Workplace privacy and surveillance in Finland: Personal data handling - Part 1

Employers are permitted to process employees´ personal data only when it is necessary for fulfilling the employment relationship. This includes data required to perform contractual duties, offer employee benefits or meet the special requirements of the employee’s position. Under the Finnish Data Protection Act (Tietosuojalaki, 5.12.2018/1050​)​​, personal data should only be collected for specific, legitimate purposes related to the employment contract.

Even if an employee consents, the processing of personal data must still comply with the principle of necessity. Employers cannot collect or process data that is not directly relevant to the work or is not needed for legal, contractual or operational purposes.

For example, if the employee’s role requires specific certifications, employer can process data related to that certification, but cannot store unnecessary information beyond that. This limitation ensures that employees’ privacy is respected and their personal data is not exploited.

In Finland, employers do have the right to oversee work performance and ensure that employees are fulfilling their responsibilities. However, this right does not extend to indiscriminately monitoring employees’ internet usage or collecting personal data related to online activities. The monitoring of internet usage must be justified and directly tied to work-related tasks.

An employer cannot collect or view identifying data from an employee’s internet browsing without violating privacy regulations. Even with consent, employer is not allowed to monitor the specifics of an employee's online behavior as this infringes on the right to confidential communication.

Employers are allowed to set rules regarding internet usage in the workplace, such as restricting access to certain websites or prohibiting personal browsing during work hours. However, these rules must be clearly communicated to the employees. The employer must also ensure that any restrictions are reasonable and do not violate employees' fundamental rights.

Employers can publish certain employee details on their website, such as names, job titles, photographs and contact information, if it is necessary for the employer’s business operations. For example, an employee whose role involves interacting with clients or being publicly accessible might be listed on the company's site.

However, the publication must be justified and employees must be informed about the purpose and necessity of sharing their personal data. Even if explicit consent is not required for publication, the employer should ensure that employees are aware of why their information is being shared and provide an opportunity to review this decision. 

If the employer wants to inquire about the employee’s past performance, it must have the employee’s explicit consent.

The employee’s consent must be voluntary, specific and informed, and the employer should be able to demonstrate that consent has been given. Additionally, the employer must ensure that any data collected is necessary for the current employment and related to fulfilling the obligations of the employment contract. Employers are also required to limit the collection of personal data to what is absolutely necessary for the intended purpose.

In Finland, protecting employees´ privacy and adhering to data protection regulations are central to ensuring fair and transparent workplace. Employers have the right to process employee data, monitor work performance and share certain information publicly, but these actions must always comply with the principles of necessity, proportionality and transparency. By understanding Finnish data protection laws, both employers and employees can navigate their rights and responsibilities, fostering a respectful and legally compliant work environment.