Employee data: from bases to monitoring
The workplace is one of the most data-intensive environments: an employer collects identity, pay, leave, evaluation and often behavioural data about candidates and employees. The Law of Georgia on Personal Data Protection governs this field through its general rules, yet several norms — the list of bases, the employment ground for special-category data, video monitoring and automated decisions — are of particular significance precisely for employees. On this page we explain these rules together.
Processing bases and their justification
Processing is admissible where one of the statutory bases exists: the subject's consent for a specific purpose; performance of an obligation under a contract with the subject or the taking of steps at the subject's request before entering a contract; processing provided for by law; performance of duties imposed by legislation; public availability of the data; protection of vital interests; significant public interest; tasks in the public interest; the legitimate interests of the controller or a third party — except where the subject's overriding interest prevails; and consideration of the subject's application. In the employment context the most frequently operating grounds are the contractual obligation, the statutory duty and legitimate interests. One thing is decisive: the obligation to justify the basis rests on the employer itself — every data flow must have a known basis it stands on.
Special-category data and the employment ground
Special-category data — health, racial or ethnic origin, political views, religious or philosophical beliefs, trade-union membership and others — may be processed only on statutory grounds and with safeguards secured. This list contains a ground specific to the employment context: the processing of special-category data is necessary in the context of employment obligations and relations, including for taking decisions on employment or assessing the work skills of the employee. In other cases written consent, direct regulation by law or another listed ground is required. Health data in an employment context is therefore processable, but only under this specific ground or another lawful basis — not by general necessity.