Employee data: from bases to monitoring
The workplace is one of the most data-intensive environments: an employer collects identity, pay, leave, evaluation and often behavioural data about candidates and employees. The Law of Georgia on Personal Data Protection governs this field through its general rules, yet several norms — the list of bases, the employment ground for special-category data, video monitoring and automated decisions — are of particular significance precisely for employees. On this page we explain these rules together.
Processing bases and their justification
Processing is admissible where one of the statutory bases exists: the subject's consent for a specific purpose; performance of an obligation under a contract with the subject or the taking of steps at the subject's request before entering a contract; processing provided for by law; performance of duties imposed by legislation; public availability of the data; protection of vital interests; significant public interest; tasks in the public interest; the legitimate interests of the controller or a third party — except where the subject's overriding interest prevails; and consideration of the subject's application. In the employment context the most frequently operating grounds are the contractual obligation, the statutory duty and legitimate interests. One thing is decisive: the obligation to justify the basis rests on the employer itself — every data flow must have a known basis it stands on.
Special-category data and the employment ground
Special-category data — health, racial or ethnic origin, political views, religious or philosophical beliefs, trade-union membership and others — may be processed only on statutory grounds and with safeguards secured. This list contains a ground specific to the employment context: the processing of special-category data is necessary in the context of employment obligations and relations, including for taking decisions on employment or assessing the work skills of the employee. In other cases written consent, direct regulation by law or another listed ground is required. Health data in an employment context is therefore processable, but only under this specific ground or another lawful basis — not by general necessity.
Video monitoring at the workplace
Video monitoring is admissible for the prevention and detection of crime, public safety, the safety of a person and the protection of property, the protection of a minor, the protection of secret information and examination purposes — where it is an adequate and proportionate means for the purpose. Video monitoring of an employee's work process or space is admissible only exceptionally, where achieving the purpose by other means is impossible or requires disproportionately great effort. Monitoring is impermissible in changing rooms, in places designated for hygiene, or where a reasonable expectation of the privacy of personal life exists. The employer must define in writing the purpose and scope, the duration, the retention period of the recording, and the rules of access and destruction; place a warning sign visibly; and warn the employee in writing of the specific purpose. Every access to a recording must be logged — by time and by user name.
Automated decisions in employment and evaluation
A subject has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal or otherwise significant consequences for him or her. Three exceptions exist: the decision is based on explicitly expressed consent; it is necessary for the conclusion or performance of a contract; or it is provided for by law. On request the employer must take appropriate measures: involving human resources in the decision process and giving the subject the possibility to express a view and to appeal. An employer building monitoring and evaluation systems must therefore be ready to answer a subject's request with a human decision stage.
Information at collection
Before collection, or at the moment it begins, the employee receives minimum information: the identity and contact of the employer, the data of the protection officer where appointed, the purposes and basis of the processing, the mandatory nature of provision and the consequences of refusal, recipients, planned transfers and safeguards, the storage period or criteria, and the subject's rights. The information is written in simple language; written delivery becomes necessary where requested. Properly performed information duty removes half of future disputes.
How we can help
We analyse employee data flows — from recruitment to dismissal: we establish the bases, order the regime of special-category data, draft a video-monitoring policy to the law's requirements and prepare information texts. Contact us — we will assess your processes.
The recruitment stage is particularly sensitive from the perspective of this law: information about a candidate is already an object of protection. Every flow of candidate data must rest on one of the bases — and it is precisely this that determines which data may be collected; where a questionnaire contains health-related fields, the special-category regime and the employment ground come into play; and at collection the information duty is activated — the candidate must know who, for what purpose and on which basis processes the data. For the employer this means that even the CV form and the interview sheet must be thought through these three angles.
Flowing from the video-monitoring regime, one frequently forgotten duty should be noted: access logging. The law requires the logging of every case of access to video recordings, including the time and the user name identifying the person who accessed. In practice this means that the administrator permissions of the monitoring system and the retention of the log are themselves part of compliance, not a mere technical detail. Such an approach also ensures that during an inspection the organisation does not merely assert but can show who accessed a recording and when.