Technology and processing of personal data performed by the employer

Knowing these aspects allows companies to conduct their business in a compliant manner while avoiding any potential risks and fines that might come their way if they fail to comply with set regulations and enables them to maintain their reputation within the business world intact. This article aims to provide information to businesses that must pay close attention to various aspects of data protection related to the use of technology in the workspace.

According to the information provided by the Data State Inspectorate of Latvia, various individuals often file complaints about possible cases of unlawful video surveillance. There have been various instances when those complaints were filed by employees and aimed at their employer, and thus triggering applicability of not only privacy, but also employment regulation.

If an employer wants to take steps to perform video surveillance at the workspace, there must be a valid reason to do so based on GDPR Article 5(1)(b), where the principle of “purpose limitation” is established. That means that every case of data processing must be performed to reach a specific, clearly defined goal. 

Usually, the applicable legal reasoning for data processing with video surveillance is based on GDPR Article 6(1)(f). Though, business owners must consider that Latvian law also provides various other reasons to perform such actions. For example, a Latvian legal act states that video surveillance must be performed at alcohol and tobacco production facilities to ensure video surveillance at specific places within the work sites that record specific actions. Regarding this obligation, all employers must be cautious not to record a larger area than necessary; otherwise, it could be considered an unlawful breach of the privacy of the employees and an attempt by the employer to unlawfully control its personnel. GDPR Article 6 (1)(c) cannot be used to justify such actions by the employer.

Businesses must also consider various other aspects of the methods being used to perform surveillance on their employees. For example, there may be cases where an employer must perform video surveillance according to the law, but an audio recording of that specific workspace would be prohibited and considered a breach of the employee's privacy. An audio recording and a video recording, even if performed at the same time, are both considered separate cases of personal data processing and in each case, there must be a clear goal and reasoning behind them to perform such actions.

All employers must note that an audio recording that consists of an employee's verbal sounds is considered biometric data, which requires a reason to process that type of data, which is stated in GDPR Article 9(2). Regarding the processing of biometric data by the employer, the employer cannot process such data based just on an agreement between him and the employee that states that such actions are allowed. There must be a legal basis behind such actions that are based on exceptions made in GDPR Article 9(2).

Keeping in mind these specific rules, it will allow businesses to achieve a work environment that is more friendly towards the employees, and also help establish great contacts with like-minded businesses in the field that value their employees' privacy.