GDPR is changing the landscape for data protection in the UK and across
Europe from May this year. For businesses that want to know a bit more about it
you can check out my videos online on our website.
So most businesses Verity, as
we've talked about, are preparing for the changes in relation to their customer
data and the marketing that they're carrying out. But there's also lots to be
concerned about for HR departments and HR professionals particularly around the
data they're holding about potential recruits and their current employees, as
well as former employees, what's your take on this as an employment partner?
Well there are definitely some things that HR teams should be doing now and
really as soon as possible given the impending date. They should be doing this
alongside their GDPR team but definitely giving it attention at the
moment, the first thing is to do a review of all the data you hold - what have you
got and why? Think about this as widely as
possible, so that could include your personnel files,
it could include CCTV data, it could include emails,
it could include any absence records you've got, it's basically any data that
you've got that identifies an individual person that could do with your employees.
And next you've got to identify the lawful basis for processing that data
the following will be useful here; you can rely on it being necessary for
performing the contractual obligations, so your employment contract obligations,
or to enter into that contract. Another ground is compliance with the legal
obligations, say for example, keeping all national minimum wage records or doing
your right-to-work checks. A further ground is if it's necessary for the legitimate
interest of the business, although you do have to be careful to balance that with
the rights of the individual and you have to be able to explain what those
legitimate interests are and whether or not, or to what extent, they override the
interest of the individual. You may also be able to rely on your legitimate
interest as an employer, although you have to be careful with that because it
can be overridden by the rights of the employee and you have to balance it up
and show how you have assessed it and mitigated any of those risks.
And what about consent for processing HR records? That's something that's being
used under the Data Protection Act, will that still work under GDPR?
Basically only in very limited circumstances, this is because consent has got to be freely
given and able to be withdrawn which in an employment situation is not going to
work. So it's extremely likely that any consents that you've got already under
the Data Protection Act aren't going to cover you and you're going to need to
look at this in a fresh light. It's only going to be in very limited
circumstances that you could use consent, so for example, if you have somebody
who's unsuccessful in a job application but you want to keep their CV or file
for a later date, if you ask their specific consent to keep their
information on file and they say yes, that would be a kind of situation where you
could rely on consent because it can be freely given and withdrawn if the person
wishes to do so. That's really helpful and are there any other steps that HR
departments need to take to become compliant with GDPR?
So once you've worked out what data you've got and what your lawful reasons for processing them
are, you basically then have to document this and the way to do it is with
something called a privacy notice and that's gonna need to be prepared for any
job applicants and also for your existing employees and you'd need to
consider those who have left as well or going to leave, do you include that
information within a privacy notice for your current employees, do you create a
new one. The privacy notice has got to set out concisely, transparently and
plainly, what data you've got and the basis that you're processing this.
So it's important once you've got that documentation in place that you also
train the staff on it particularly because they really need to understand
how GDPR works so they can apply it in the right situations, if you just have a
policy that no one reads or understands you're not gonna be GDPR compliant.
Remember you've also got to update your contracts and your handbooks to reflect
the new documentation and to remove any of the old consents.
And what about the rights of employees around accessing their own data that are held by the HR
departments, is there anything changing in that area under GDPR?
So another area to be aware of that's changing is around Data Subject Access Requests,
these can be made by employees or job applicants to know what data
you're holding on them, and the timescale for responding is dropping from 40 days
down to a month and also the individual doesn't need to pay a fee anymore.
So it's important that the HR team knows that that has changed and has processes
in place to be able to deal with them. It's worth being aware that if the data
is sensitive, so for example to do with any of their protected characteristics,
or their health, then there are further legal criteria that you have to satisfy
in order to keep that data. So Jow are there are other steps that businesses
should be looking at more generally around GDPR that would also impact
on HR records that you're aware of?
Yeah absolutely, one of the most important things for businesses to get to grips with is who their
suppliers are in terms of data protection, who is dealing with the data
of your, in this case for HR departments it would be, who's dealing with the data of
the employees that you've got and the applicants we've had. So for HR
departments the kind of contracts that you'll need to think about involve
outsource providers like payroll operators, HR consultants, particularly
important is if you use those two sort of software elements generally to how HR
teams operate and that'll be if you're using a bit of HR software, something
like a Human Resources information system that allows people to book holidays
and record their sick days or that kind of thing. That software provider, that's a
really important contract, where's that stored and what does the contract say
about how that data is being kept secure? So that's the first thing to do, check
who your suppliers are and who's dealing with data and then what are the
contracts actually say? A couple of other things that are important to the
business generally, but that will be really important for HR teams, are the
storage of data. So how is the data being stored? on computers, laptops, personal
devices - have you got it in lots of different offices, all over the place, and
is it easily accessible? So that's are you complying with the storage requirement
but also is it kept secure? So how are you making sure as an HR team that the
data of you're employees is secure this is your and the only the right people have access
to it? So it's a process based step really as in checking all of those
things and then seeing what you need to do to correct any gaps in compliance. The
final thing that is going to impact a business as a whole, as well as HR teams,
is the new requirement for reporting breaches to the regulator. So basically
what businesses need is a data breach response plan, it doesn't
roll off the tongue nicely that term, but that's what you need you need a plan
for if there's a data breach what do we do? How do we let our employees
know? Who do they tell? Who's the data protection officer or do they tell the
head of the HR team? And then how do we discover what actually happened?
Having that plan in advance, and if you can, doing a pretend run - doing a
pretend breach and seeing how well that plan stands up is a really good
insurance policy for your business in the future should you suffer a data
protection breach. And that plan is really important because you're going to
have to report data protection breaches to the ICO, for the first time, that's
mandatory you have to do that and you're also gonna have to report the breaches
to the data subject - which could be awkward or embarrassing if you haven't
planned for how you're gonna do that in advance.