Investigation into misconduct employee does not contravene the GDPR
On 21 March the District Court of Amsterdam brought in a verdict in a case that was brought by an employee against her former employer and a research company that was involved by the employer.
Well-founded complaints caused the employer to investigate the conduct of the employee. The employee demanded (among other things) damages and destruction of all personal data that was collected about her. The court adjudicated that the employer had a legitimate interest in conducting research, i.e. the prevention or limitation of psychosocial workload. According to articles 3 of the Working Conditions Act (Arbeidsomstandighedenwet, “Arbowet”) and 7:611 of the Dutch Civil Code (Burgerlijk Wetboek) employees have to take measures to prevent undesirable behaviour on the job. The violation of the employee’s privacy was justified by the employer’s statutory duty to provide a safe and healthy working environment for its employees.
Unwanted conduct of employee towards co-worker
In April 2018 a co-worker of the employee filed a complaint with the employer concerning the conduct of the employee. The co-worker complained that the employee was continuously sending him swearing messages that are attacking and insulting. The employer confronted the employee with the complaints and decided to have an independent company investigate the unwanted conduct of the employee. During the investigation the employee is suspended. At first, the employee cooperated with the investigation; she was interviewed, provided copies of WhatsApp conversations. Shortly after this she stopped cooperating and by e-mail (i) she stated that she did not give consent for the processing her personal data, (ii) she asked to inspect the collected personal data and (iii) she asked limitation of the collection of her personal data, based on article 18 of the General Data Protection Regulation (GDPR). On 23 August 2018 the research report was published, of which the employee received a copy. The outcome of the research was that the complaints are justified. The employment contract of the employee has been terminated as of 1 February 2019 on the basis of disturbed relations. The employee demands, among other things, inspection of her collected personal data, if necessary limitation of the collection of her personal data and destruction of all the collected data.
Legal framework for balancing employer’s interest to conduct research and employee’s privacy
The judgment of the District Court of Amsterdam clarifies which steps an employer has to take before investigating:
1. Does the employer have a basis for collecting personal data?
The collection of personal data is only lawful when it is based on article 6(1)(a-f) GDPR. When investigating the conduct of an employee the legal ground for the data collection will usually be the necessary processing in order to protect the vital interests of the employer and others (such as, in this case, the other employee). The legitimate interest in this case was the duty of the employer to ensure the safety and health of its employees (article 3 Working Conditions Act). The District Court of Amsterdam ruled that since the employer had received a complaint about unwanted conduct from an employee, the employer had a legitimate interest in commissioning an investigation into the conduct of the employee. The court did not find it important that the employee had withdrawn her consent for the collection of her personal data, because the legal ground for collecting data was the legitimate interest of the employer and not the employee’s consent.
2. Does the legitimate interest outweigh fundamental rights, interests or freedoms of the involved person?
The legitimate interest of the employer (and its employee) can only be a valid legal basis for data collection if this interest outweighs fundamental rights, interests or freedoms of the employee, taking into account reasonable expectations of the involved person based on its relationship with the data controller (the employer in this case). The court balances the interests of the employee and the employer: the the employee’s right to privacy (article 8 ECHR) versus the duty of the employer to ensure the safety and health of its employees (article 3 Working Conditions Act) and the duty to act as a good employer (article 7:611 Dutch Civil Code). The court finds that in this balance an infringement of the right to privacy is allowed, if this meets the requirements of subsidiarity and proportionality.
3. Are the requirements of proportionality and subsidiarity met?
In assessing the proportionality, the court involved the statutory duty of the employer to further investigate the justification of the complaints about the employee. The court takes into account that the unwanted conduct by the employee – sending WhatsApp messages and e-mails to the private e-mail address of the employee – also happened outside working hours and in the private sphere. The suspicion of unwanted conduct was stated concretely in the formal complaints and it appeared that the unwanted conduct happened repeatedly, over several months. Under this circumstances the employer reasonably commissioned an investigation, including the processing of personal data.
Assessing the subsidiarity, the court found it important that prior to the investigation the employer conducted interviews with the employee. The court also adjudicated that the employer handled the personal data of the employee appropriately by having an independent company investigate the employee’s conduct, instead of investigating it himself. It was in the interest of the employee to investigate the complaints in an independent manner. Other, less radical, means to realize the goal of the investigation were not available. Therefore, the court concludes that the requirement of subsidiarity is met.
All claims of the employee were denied.
From this case it is clear that employers have a statutory duty to act when they are confronted with justified complaints about the conduct of employees (based on Article 3 Working Conditions Act and Article 7:611 Dutch Civil Code). At the same time, this statutory duty provides employers with a legal basis under the GDPR for commissioning or conducting research. In this regard, it is important to act according to the requirements of proportionality and subsidiarity; the complaints have to be justified and one has to act carefully. There should be no less radical means available.
For more information on this subject, contact your regular Loyens & Loeff advisor or Lucas Hoogervorst.
firstname.lastname@example.org / +31 20 578 54 11