Treatment of personal data in employment and employment contracts

Individual rights

A person has rights in relation to the processing of personal data about them. The Data Protection Act is intended to safeguard the legal status of individuals, among other things by creating transparency about the processing and giving them the opportunity to object to it, to name a few.

A person has the right to:

• information about the processing

• to know the data involved

• access to the data

• to object to processing - if an individual objects to processing, they must have good reason, as it has already been assessed that this information is necessary

• having information that is wrong deleted or corrected

Access to data

In some cases, the employer may refuse to give access the employee's data. This is, for example, if obtaining the information is expensive, if the public interest is at stake, or if the information also provides information about other individuals.

Work documents where the employer records their own thoughts and assessments or opinions in connection with collective bargaining negotiations or concerning general conditions in the workplace may be excluded from the right of access, as that is not information that was obtained about an individual in a narrow sense. It must always be assessed separately whether access to information should be granted, but in general it is not possible to deviate from the right of access. There must be good reason for a person being denied access to the data.

Deleting information

Personal data may not be processed if it is for purposes other than the one that was submitted and it must not be stored for longer than necessary. When the preservation is no longer necessary, the information must be deleted or put into a form that does not allow an individual to be identified from it.

The processing must ensure adequate security and that the utmost confidentiality is maintained. It must be ensured that the data is deleted in such a way that it cannot be recovered, for example by deleting all security backups if they have been taken.

Storage of information

Data about an individual does not need to be kept if they did not receive the job, although there may be instances where this is necessary. For example, if the employer wants to keep the person in mind for the next job that will be advertised or if there is a complaint about the hiring so the employer needs to be able to look up any information later.

After the employment contract has been concluded, it may be necessary to store some data, such as the national ID number, bank information, sick leave, information about education. It is necessary to evaluate in each case what information is stored. It can usually be assumed that the employer knows which data he should delete and which data he needs to store. In addition, new information about an individual is constantly being generated, such as daily logs and other information that needs to be stored for a certain period of time.

Storage of information after termination of employment

The continued storage of information on former employees may only take place if the processing permission is met. This means that it may store the information as long as it is deemed necessary.

It may be necessary to keep records after an employee is terminated. For example, it may be necessary to keep a record of the history of personnel matters but also must comply with laws that stipulate that certain data must be kept for a certain period of time. For example, pay information, where the employer must be able to provide the tax office with information back in time if they are called upon. In connection with termination, the employer may also need to keep information if he expects the termination to be appealed. The same may apply if an employee has suffered an accident at work, where the information may be necessary to settle a possible claim for compensation for the accident. The law on public archives may also cause the employer not to delete information.