GDPR and personal data at work

steampowered

Annual leave information is certainly "personal data" within GDPR.

GDPR doesn't mean the data can never be disclosed. It simply means that the use/disclosure of the data must be legally justifiable in line with data protection principles, which in an employment context means that the use of the data must be required for legitimate purposes.

It is legitimate for all team members to have access to annual leave records, as people might need to know when others are on annual leave to plan their workloads.

Giving everyone access to historic compassionate leave/sick leave information however is unlikely to be considered proportionate.

In particular, if the data includes information about health (e.g. sick leave information), that is a "special category data" under GDPR which has particularly stringent requirements and merits special protection which will be breached if the data is generally available to staff (see https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/).

Marvel1

Jsacker said:

KatrinaWaves said:

I think some people are on commission for ACAS. 

And I think some people are trolls. 
(edit: though I'm loving the forum post-Blatchford! It's actually much more chilled out overall and even your trolly comment is half-assed here!)

Previously known as Sangie