Have you applied for Worker Consent?

All companies, whether they are multinationals or a small neighborhood store, are equally obliged to comply with the obligations set out in the European Data Protection Regulation(EU Regulation 2016/679, GDPR) and the Organic Law 3/2018, on the protection of personal data and guarantees of digital rights(LOPDGDD).

Based on this premise, it is important to emphasize that in this regulatory framework, the principle of express consent governs, being the only valid way to comply with legal requirements, leaving behind the tacit consent in force in other times.

Thus, Recital 32 of the GDPR states that:

“Consent must be given by a clear affirmative act reflecting a freely given, specific, informed, and unambiguous expression of the data subject’s free, specific, informed, and unambiguous agreement to the processing of personal data relating to him or her, such as a written statement, including by electronic means, or an oral statement.”

and is complemented by what is expressed in Recital 42 when it states:

“Where processing is carried out with the consent of the data subject, the controller must be able to demonstrate that the data subject has consented to the processing operation.”

With this, we find that any processing will be lawful if the data controller (the company) has previously obtained the consent of the persons concerned (workers) for such processing (among other grounds for lawfulness) and can prove it (arts. 5 and 7 of the RGPD, art. 6 LOPDGDD).

Cases of employee consent

In the labor field, as in any other, it is important to comply with the principle of lawfulness of the processing, there are certain situations in which, unavoidably, we must have the express consent of the workers to carry out the processing of their personal data.

Some of the situations in which the company must expressly seek the consent of the workers are:

Use of the worker’s image:

The image is a personal data par excellence, since it makes us identifiable, so if the image of a person (photographs or videos) is published, he/she must give his/her consent for his/her image to be used by the company.

Use of biometric data for workday registration:

Biometric data (e.g. fingerprint or facial recognition) are considered special category data (art. 9.1 GDPR) and are as sensitive as health data.

Transfer of your data to third parties:

Some companies may offer their employees certain benefits with third party companies (e.g. discounts on telephony, health services, etc.), having to obtain the consent of employees specifically for each of the services or actions offered by the company with third parties.

Use of private e-mail and WhatsApp:

In principle, corporate e-mail is the appropriate means of communicating with employees on work-related matters. However, the employee may provide the company with his or her private email address or number to communicate via instant messaging, provided that this is a voluntary action and by means of express consent, which may be revoked at any time.

If, on the other hand, the company has provided the employees with corporate telephones, it will not be necessary to obtain such consent since the employee’s privacy would not be violated since the telephone number that would be disclosed in the WhatsApp group is not the employee’s personal number.

International data transfers:

This circumstance must be brought to the attention of the employee and the purposes of the international transfer, as well as the countries receiving such transfers, must be explained to him/her.

However, before transferring your data, you should analyze whether the destination countries have sufficient or similar guarantees to those of the EU and, if not, sign the standard contractual clauses established for this purpose by the GDPR.

Business Adapter® at your service

We have exposed some cases where it is necessary to request the consent of workers for the treatment of very specific purposes, although we can find other cases.

If you have any doubts about when to request workers’ consent, please contact us by email: info@businessadapter.es, you can also call 96 131 88 04, or leave your message in this form:

[su_button url=”https://businessadapter.es/contacto” target=”blank” background=”#f6f903″ color=”#181818″ size=”7″ center=”yes” icon_color=”#000000″]Contact us, we will be pleased to help you.[/su_button]