Employee personal data: what you may collect and how long to keep it

An employer may process only personal data directly necessary for the employment relationship. Define its purpose, access permissions and retention period. Some records, such as working time records, must be retained after employment ends.

The necessity requirement limits what is collected

Under section 3 of the Act, data is necessary when it relates to managing the rights and obligations of the parties to the employment relationship or to the benefits the employer provides to employees, or when it follows from the special nature of the work. A field must therefore be justified by a task or an obligation, not by the fact that it is available or that it might be useful some day.

The practical test runs field by field. Beside every field you write down the employer’s right or obligation that the field serves: paying wages, shift planning, working-time records, occupational safety, or demonstrating a qualification to an authority. A field with nothing beside it comes off the form before it ever reaches the register.

Consent does not justify unnecessary data. The necessity requirement in section 3 of the workplace privacy Act cannot be bypassed through employee consent. Also assess the GDPR legal basis and the requirements in sections 4 and 5 for collecting information and processing health data.

The data is asked of the employee themselves

The employer must collect personal data concerning the employee primarily from the employee themselves (section 4). Obtaining it elsewhere requires the employee’s consent; the exceptions are a statutory disclosure by an authority and situations where the collection is separately provided for in law.

The same section sets two duties to inform, and they fall at different moments. Before data is obtained in order to establish the employee’s reliability, the employer must notify the employee in advance. If, on the other hand, data has been collected from a source other than the employee themselves, the employer must tell the employee about the data received before it is used in decision-making concerning them. The latter also covers oral sources, such as an assessment given by a previous employer over the phone.

At hiring this means the data is asked of the person first and background sources are used only with their knowledge. During the employment it means that a supervisor’s note of what someone else said is personal data just as much as a form field is, if it ends up in the register and affects a decision.

Health data has a procedure of its own

Under section 5, the processing of health data differs from other processing of personal data in four ways.

Basis. Section 5 allows health data processing under specific conditions, for example to pay sick pay or establish the reason for absence. Data is obtained from the employee or elsewhere with their written consent. What is needed depends on the purpose: the dates alone may not establish entitlement to sick pay, but a diagnosis should not be collected just in case.

Named handlers. Health data may be processed only by those persons who, on the basis of that data, prepare or make decisions concerning the employment relationship or implement them. The employer must name these persons or define the tasks the processing belongs to. The naming must be written down, because it has to be demonstrated afterwards.

Keeping it separate. The health data the employer holds must be kept separate from other personal data collected. Separation is achieved either through a register of its own or through access control that limits this data to the named handlers even when it sits in the same system as the rest of the personnel data.

Erasure and periodic assessment. Health data must be erased immediately once there is no longer a basis for the processing referred to in section 5. The basis for and the need for the processing must also be assessed at least every five years. The assessment is an action of its own, and it is worth recording its date and outcome: in five years no one remembers whose sickness absence data was left in the system, or on what basis.

Technical monitoring is a separate procedure

If personal data arises from monitoring carried out by technical means, such as access control, camera surveillance or a punch terminal, the purpose, introduction and methods of the monitoring fall, under section 21, within the dialogue referred to in the Co-operation Act. After that procedure the employer defines the purpose of use and the methods of the monitoring and informs the employees about them. The order of the steps, and what goes into the notice, are covered in the guide Rolling out time tracking.

The GDPR gives the employee rights to their own data

The employer is the controller of the personnel register, and the general principles of the General Data Protection Regulation apply to it in full. Four of them show up directly in everyday HR work.

The employee must be told what data is processed about them, for what purpose and for how long. The employee has the right of access to their own data: on request, the data stored about them must be delivered, and the request is answered during an ongoing employment as well. Inaccurate data must be rectified, and the rectification is best made in the system from which the data is copied onward. Storage limitation means that data in identifiable form is kept only as long as the purpose requires – which is why the retention period has to be defined per data group rather than for the register as a whole.

Statutory retention periods hold part of the material

Part of the personnel material carries a retention obligation of its own, independent of the employer’s own practices. These periods are minimums: the data must be kept at least this long, and after that it is kept only if there is a basis for keeping it.

The entries in working-time records, the ways of recording them and their retention are covered in their own guide, Working-time records. Under section 29, the annual leave records must show the lengths and the timing of the annual holidays, the number and the timing of the additional days off, and the amounts of the wages and the compensation and the grounds on which they are determined, and on request they must be shown to the person carrying out an occupational safety inspection and to the shop steward, the elected representative or the occupational safety representative. For reports in the reporting channel, section 29 also requires that personal data that is clearly not relevant to handling the report is erased without undue delay.

Co-operation and informing

The collection of personal data at hiring and during the employment must be dealt with in the dialogue referred to in the Co-operation Act (section 4). The dialogue concerns the procedure, not an individual employee: what data is collected, from which sources and for what purpose. When the content of the register changes – a new form field, a new source of data, a new system – the matter belongs in the dialogue before it is taken into use.

The Co-operation Act’s dialogue applies to companies that regularly employ at least 20 people; in companies with 20–49 employees it is conducted in the lighter form set out in section 7 a of that Act. Companies smaller than that have no dialogue obligation, but for monitoring carried out by technical means the employer must, under section 21, give the employees or their representatives an opportunity to be heard before the decision. The duty to inform about the purpose, the introduction and the methods of the monitoring applies to both.

Under section 23, the Act on the Protection of Privacy in Working Life must be kept available to the employees at the workplace. The same place where the Working Hours Act and the shift roster are available will do for this too.

When the employment ends, the material splits in two

The last day is a good moment to go through the register, because some processing bases end on that day and some continue for years. Three groups stand apart.

1. Goes when the basis ends. Access rights and identifiers, access cards, contact details on alarm lists, next-of-kin details, vehicle and equipment assignments, and health data whose basis ended already before the employment did. There is no longer a purpose for keeping these, and for health data section 5 requires erasure immediately.
2. Stays for a fixed period as statutory material. Working-time records, annual leave records, payroll vouchers and other accounting material, and the reports in the internal reporting channel, as set out in the table above. These are not erased on request in the middle of the retention period, because they are precisely the material with which the employee’s own claim is established.
3. Retained for a justified purpose. Employment contracts, terms and termination documents may be needed to establish rights after employment ends. Define the purpose, legal basis and retention period separately.

When the retention basis ends, delete the personal data or anonymise the material. Anonymisation requires that the person can no longer be identified by reasonably available means. Check free text, attachments, unique identifiers and the ability to combine data as well as names. If identification remains possible, the material is personal data and needs a processing basis.

An erasure request does not override a retention obligation. When an employee asks for their data to be erased, material under a statutory retention obligation stays in place until the end of the retention period. It is worth saying in the reply which data is erased right away, which stays and until what date.

Example: the data groups of a personnel register

Below is one employer’s register grouped so that every row has a basis, a handler, a retention period and a fate after the employment ends. The same table works as the frame for a record of processing activities.

The order of the rows also tells you the shape of the group of handlers. Basic details and working-time entries are in the widest use, health data the narrowest. If access rights have been built as a single “HR sees everything” level, the fifth row does not come true, even if the retention periods are in order.

Checklist

• Every data field has a named purpose of use. A field with no employer’s right or obligation appearing beside it is removed from the form and from the register.
• Necessity and the GDPR processing basis are documented separately. Consent requirements for collection are checked.
• The data is asked primarily of the employee themselves. Obtaining it from another source needs consent or a basis laid down in law.
• Notice of establishing reliability is given in advance, and the employee is told about data received from elsewhere before it is used in decision-making.
• The handlers of health data are named or the tasks defined, and the data is kept separate from other personal data.
• The basis for and the need for processing health data have been assessed within the last five years, and the date of the assessment is recorded.
• The purpose of use and the methods of technical monitoring are defined and the employees have been informed about them.
• The collection of personal data has been dealt with in the Co-operation Act’s dialogue, or, in a company with fewer than 20 employees, the employees have been given an opportunity to be heard about the technical monitoring before the decision.
• The retention period is defined per data group and the statutory minimum is marked for the groups it applies to.
• There is a list for the end of the employment: what goes right away, what stays for a fixed period and until what date.
• Anonymisation covers free texts, attachments and card numbers, not just the name and contact detail fields.
• The employee gets their own data on request, inaccurate data is rectified in the source system, and the Act on the Protection of Privacy in Working Life is available at the workplace (section 23).