1. Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer’s or customer’s property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.
Article 88 GDPR - Processing in the context of employment
2. Those rules shall include suitable and specific measures to safeguard the data subject’s human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.
3. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.
Relevant Recitals
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Paragraph 1 allows Member States, by law or by collective agreements, to provide more specific rules to ensure the protection of rights and freedoms in respect of the processing of employees' personal data in the employment context. It is an opening clause within Chapter IX, so the general regime of the Regulation applies wherever no such rules exist.
Paragraph 1 lists recruitment, the performance of the employment contract including obligations laid down by law or collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of the employer's or customer's property, the exercise and enjoyment of employment-related rights and benefits on an individual or collective basis, and the termination of the employment relationship. The list is introduced by "in particular", so it is illustrative rather than exhaustive.
Yes. Paragraph 1 expressly places collective agreements alongside Member State law as a source of the more specific rules, and Recital 155 adds that this includes works agreements. Agreements between the social partners can therefore perform the specifying function at company or sector level.
Paragraph 2 requires them to include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, transfers of personal data within a group of undertakings or a group of enterprises engaged in a joint economic activity, and monitoring systems at the workplace. Since paragraph 1 frames the rules as serving "to ensure the protection" of rights and freedoms, they operate as specifications of the Regulation's protection rather than a licence to fall below it.
No. Paragraph 1 uses "may", so the clause is permissive, and employers in Member States without such rules simply apply the Regulation directly, in particular the lawful bases in Article 6 and the Article 9(2)(b) condition for special categories in the employment field. Member States that do adopt rules had to notify them to the Commission by 25 May 2018 under paragraph 3 and must notify any subsequent amendment without delay.