Protection of privacy safeguards the fair processing of the information collected, saved and released about you. The employer has the right to collect, store and release personal details, such as contact details, that are necessary for the employment. The employer must not collect personal details from anywhere else than from you unless you have specifically permitted it. If the employer collects information of you elsewhere, they must first ask your permission for it. In addition, the employer must explain why collecting information is important for performing your duties.
The employer must process the personal details appropriately, transparently and securely.
It is forbidden to collect information regarding e.g. race, religion, political opinion, trade union membership and sexual orientation. The employer must not store outdated or unnecessary information.
Consent to acquire information is not needed in the case that an official releases information to the employer to perform an assignment stated by law or acquires on other legal grounds credit or criminal record information to clarify the employee’s reliability.
The employer must ensure appropriate, transparent and secure processing of personal details.
The office of the data protection ombudsman guarantees your rights and freedoms in the processing of personal details. Read more about the topic on the website of the office of the data protection ombudsman.
The Privacy of Health records
The employer can process your health records if they have received the information from you or have given your consent for it. The information concerning diseases or injuries are defined as sensitive information. It can only be processed at the workplace with the employee’s permission.
Processing health records can be acceptable when regarding e.g.:
- wage payment during sickness or clarifying the reason for absence
- a situation when working causes a risk of falling ill
- a situation when an employee wants to clarify their ability to work
Information regarding the state of health must be deleted immediately when there is no longer a reason to process it.
No register of health records can be maintained at the workplace. This is only permitted for a healthcare operator such as occupational healthcare. The occupational healthcare has no right to release the register to the employer. The employer can only receive information from the occupational healthcare concerning the employee’s suitability to their duties.
The employer has the right to collect information on the number or times of sick leaves for example for the payment of wages. This is also information that the employer can release to the occupational healthcare. However, the employer must not collect reasons for absences, i.e. diagnoses in such a register.
The employer has the right to send you to the occupational healthcare if there is justified reason to suspect that your ability to work has deteriorated so that you no longer cope with your duties. The action plan of the occupational healthcare or the instructions compiled at the workplace may include an agreement to receive early support. The solution to a deteriorated ability to work is sought together with the employee, employer and a representative of the occupational healthcare. Health diagnoses and reasons for the lowered ability to work will, however, remain only with you and the representative of the occupational healthcare. The employer is only informed about e.g. the impact of the disease on your work input.
The Privacy of Email
The employer is allowed to read incoming and outgoing messages in the employee’s email address only under specific exceptional circumstances that are clearly defined in law.
The employer cannot read incoming or outgoing emails in the employee’s work email, if:
- the employee can during absence use the automated response in the email to inform the sender of the message about the length of absence and about the person to contact during the employee’s absence
- instead of or in addition to an automated message the employee can also transfer the incoming mail to another address
- incoming messages are transferred to another person’s email so that that person can evaluate if it is necessary for the employer to receive information about the message
Camera surveillance
The employer can use camera surveillance to guarantee security, protect property or control the appropriate operations of the production processes and to prevent or investigate situations that put them at risk. Camera surveillance must not be used to watch employees at the workplace.
No CCTV is allowed in toilets, changing rooms, other staff rooms or employees’ own offices, either. The employer has the right to install camera surveillance to a specific work station with specific grounds as defined in law.
Recordings must be deleted as soon as they are no longer necessary to carry out the intention of the camera surveillance. No later than one year after the recording was ended they must be deleted.