The Article 29 Working Party adopted Opinion 2/2017 on data processing at work on 8 June 2017.

The Opinion builds on Opinion 8/2001 and its 2002 Working Document on the surveillance of electronic communications in the workplace, adapting to the context of present technologies that have changed the field of employee data processing and therefore impacting the privacy and data protection of employees.  The Opinion specifically looks at privacy expectations for employees and the legitimate interest of employers in light of the Data Protection Directive and the General Data Protection Regulation.

In the Opinion, the Article 29 WP confirms a number of golden rules in employee data processing:

• “employers should always bear in mind the fundamental data protection principles, irrespective of the technology used;
• the contents of electronic communications made from business premises enjoy the same fundamental rights protections as analogue communications;
• consent is highly unlikely to be a legal basis for data processing at work, unless employees can refuse without adverse consequence;
• performance of a contract and legitimate interests can sometimes be invoked, provided the processing is strictly necessary for a legitimate purpose and complies with the principles of proportionality and subsidiarity;
• employees should receive effective information about the monitoring that takes place; and
• any international transfer of employee data should take place only where an adequate level of protection is ensured.”