Protection of privacy safeguards the fair processing of the information collected, saved and released about you. The employer has the right to collect, store and release personal details, such as contact details, that are necessary for the employment. The employer must not collect personal details from anywhere else than from you unless you have specifically permitted it. If the employer collects information of you elsewhere, they must first ask your permission for it. In addition, the employer must explain why collecting information is important for performing your duties.
The employer must process the personal details appropriately, transparently and securely.
It is forbidden to collect information regarding e.g. race, religion, political opinion, trade union membership and sexual orientation. The employer must not store outdated or unnecessary information.
Consent to acquire information is not needed in the case that an official releases information to the employer to perform an assignment stated by law or acquires on other legal grounds credit or criminal record information to clarify the employee’s reliability.
The employer must ensure appropriate, transparent and secure processing of personal details.
The office of the data protection ombudsman guarantees your rights and freedoms in the processing of personal details. Read more about the topic on the website of the office of the data protection ombudsman.
Tests in connection with job interviews:
In connection with e.g. recruitment you may be tested in personal and aptitude assessments. This is to find out about your qualifications to perform the duties. During the employment you may be tested to find out about needs for training and other vocational development. The person’s consent is always required for personal testing.
The employer may request a drug test from the applicant. Taking the test, however, requires the applicant’s consent. A drug test can be requested when the applicant is supposed to do work that requires accuracy, reliability, independent discretion or good responsiveness and in which performing one’s duties under the influence of drugs or with a drug addiction may:
- put the employee’s or another person’s life, health or occupational safety at risk;
- compromise national defence or government security;
- cause dangerous driving;
- increase the risk of significant environmental damage;
- risk the protection, availability, integrity and quality of information received in duty, and hence cause harm or damage to the general interests protected by confidentiality regulations or jeopardize the protection of privacy or rights of the registered; or
- put a business secret at risk or cause the employer or their customer more than minor economic damage, if the compromising of a business secret or the generation of a financial risk cannot be prevented by other means.
The employer also has a right based on the applicant’s consent to process information when:
- the applicant is supposed to perform duties that require special confidentiality, that involve working outside of the premises controlled by the employer and whereby performing the duties under the influence of drugs or with a drugs addiction can cause significant financial damage to the employer’s customer or jeopardize their personal safety;
- the applicant is supposed to perform duties that permanently or essentially involve the upbringing, teaching, nursing or other care for a minor or other work in personal interaction with a minor, and without the participation of other people; or
- the applicant is supposed to independently and without supervision perform such duties that provide access to narcotics or to a higher than small amount of such medicine that can be used to intoxicating purposes.
The rules above are also applied if the employee’s duties change during the employment so that they meet the preconditions above for the employer’s right to process information marked on the certificate regarding a drug test.
The employer can view the credit information if the duties involve a possibility to pursue illegal financial advantage. Such duties include e.g. duties that involve making decisions regarding financial commitments, granting credits and controlling them, processing customers’ or the organization assets or having access to protected business or professional secrets.
The Privacy of Health records
The employer can process your health records if they have received the information from you or have given your consent for it. The information concerning diseases or injuries are defined as sensitive information. It can only be processed at the workplace with the employee’s permission.
Processing health records can be acceptable when regarding e.g.:
- wage payment during sickness or clarifying the reason for absence
- a situation when working causes a risk of falling ill
- a situation when an employee wants to clarify their ability to work
Information regarding the state of health must be deleted immediately when there is no longer a reason to process it.
No register of health records can be maintained at the workplace. This is only permitted for a healthcare operator such as occupational healthcare. The occupational healthcare has no right to release the register to the employer. The employer can only receive information from the occupational healthcare concerning the employee’s suitability to their duties.
The employer has the right to collect information on the number or times of sick leaves for example for the payment of wages. This is also information that the employer can release to the occupational healthcare. However, the employer must not collect reasons for absences, i.e. diagnoses in such a register.
The employer has the right to send you to the occupational healthcare if there is justified reason to suspect that your ability to work has deteriorated so that you no longer cope with your duties. The action plan of the occupational healthcare or the instructions compiled at the workplace may include an agreement to receive early support. The solution to a deteriorated ability to work is sought together with the employee, employer and a representative of the occupational healthcare. Health diagnoses and reasons for the lowered ability to work will, however, remain only with you and the representative of the occupational healthcare. The employer is only informed about e.g. the impact of the disease on your work input.
The Privacy of Email
The employer is allowed to read incoming and outgoing messages in the employee’s email address only under specific exceptional circumstances that are clearly defined in law.
The employer cannot read incoming or outgoing emails in the employee’s work email, if:
- the employee can during absence use the automated response in the email to inform the sender of the message about the length of absence and about the person to contact during the employee’s absence
- instead of or in addition to an automated message the employee can also transfer the incoming mail to another address
- incoming messages are transferred to another person’s email so that that person can evaluate if it is necessary for the employer to receive information about the message
When does the employer have the right to read an employee’s email?
The employer can read the employee’s personal work email if the measures mentioned in the previous chapter are provided for the employee and they have not utilized the opportunities. In addition to this, a few other conditions must be met before the employer can get to read the employee’s emails:
- The employer must primarily try to contact the possible sender of the message.
- The required information in the employee’s email must be urgent, which is evident from the issues at hand that will not proceed without the information in the email.
- Personal emails must not be opened.
- The sender and title of the email must show that the message is essentially relevant to running the operations in the organisation.
In case the employer shall open the employee’s personal work email, this must be done with the administrator of the IT system. A written report on the reading of the emails must be given to the employee as to why and what messages have been sought by whom and when.
The employer can use camera surveillance to guarantee security, protect property or control the appropriate operations of the production processes and to prevent or investigate situations that put them at risk. Camera surveillance must not be used to watch employees at the workplace.
No CCTV is allowed in toilets, changing rooms, other staff rooms or employees’ own offices, either. The employer has the right to install camera surveillance to a specific work station with specific grounds as defined in law.
Recordings must be deleted as soon as they are no longer necessary to carry out the intention of the camera surveillance. No later than one year after the recording was ended they must be deleted.