Whether out of actual interest or for reasons of process tactics: In disputes between bosses and employees, the latter are increasingly asserting claims for information under the General Data Protection Regulation. The European Court of Justice has now made an important decision on this.
A large amount of personal data is processed as part of every employment relationship – starting with the name, place of residence and bank details of the employee through to information about further training, employee evaluations, etc. The clinic or practice as “responsible bodies” within the meaning of the General Data Protection Regulation (DSGVO) on the purposes and means of processing personal data of employees. These are “data subjects” within the meaning of the GDPR.
According to Art. 15 of the regulations, the latter also have a right to information about the personal data processed by the head of the practice or the clinic. But how exactly does this information have to be provided? The European Court of Justice (ECJ) has now answered this question (Rs. C‑487/21).
If in doubt, the large folder
The Luxembourg judges held that employers, if an employee provides information Article 15 GDPR requires a reproduction that is true to the original and understandable go must transmit data that it has processed about the person concerned. This can also result in the obligation to provide a copy of entire documents or extracts from databases “if this is necessary so that the person concerned can assert their rights”.
This relatively vague wording leaves the employer some leeway in assessing what information might be required so that the employee can assert his rights under the GDPR – be it because he requests the deletion or correction of certain information. However, in order to create as little (additional) potential for conflict as possible, it is advisable for medical employers to enclose an accompanying letter with their information, which explains what information they considered to be “necessary” in terms of the decision.
Clear rules help with data management
The decision of the ECJ is of great importance for clinics, practices and MVZ, also because violations of the GDPR repeatedly result in claims for damages and/or fines.
In order to always be prepared for any claims for information, those responsible should therefore develop a system according to which they store employees’ personal data. It is also advisable to establish a strict, comprehensible deletion concept. Because information that is no longer available at the time of the right to information (for understandable reasons) cannot and does not have to be given to the employee.