Services
Employee Privacy
We write the rules for collecting information about employees and candidates: cameras, monitoring, attendance clocks, mailbox access and CVs. They are built on privacy law and the labour courts’ rulings, so you can manage and supervise without intruding on employees’ privacy more than you need to.
Five questions about monitoring employees
Each of these situations has rules of its own, so it is checked before you start.
| # | Question | What decides it |
|---|---|---|
| 1 | Are there cameras in the office, shop or plant? | Where they may go, what employees are told, who watches, and how long the footage is kept. |
| 2 | Do you need to access an employee’s mailbox? | The type of mailbox: a work mailbox, one also used for personal matters, or a private one. An employer does not enter an employee’s private mailbox, even with consent, except under a court order and in rare cases. |
| 3 | Are you considering a biometric attendance clock? | Employees’ consent is necessary but not sufficient. The Privacy Protection Authority prefers the biometric template to be kept on a card the employee holds, not in a central database. |
| 4 | Do you monitor remote work or employees’ location? | Whether the measure is proportionate. Consent in the employment contract does not make a disproportionate measure lawful. |
| 5 | Do you use a recruitment system that ranks candidates? | What is kept about candidates who were not hired, for how long, and what the system decides without a person involved. |
Deliverables
At the end you receive written policies and procedures, and notices you can give to employees.
| Deliverable | What it contains |
|---|---|
| Monitoring policy | What is checked, by what means and who may access it, and a notice that explains it to employees in advance. |
| Camera policy | Placement, signage, retention period and viewing permissions. |
| Attendance clock review | Whether the measure is proportionate, and which alternative suits your business. |
| Mailbox access procedure | When and how an employee’s mailbox is accessed, including after they leave. |
| Employee and candidate data | What is kept in personnel files and CVs, for how long, and when it is deleted. |
How it runs
The work runs in five steps, and the scope is set in writing before it starts.
- Initial fit call
- A first discussion of the need, scope and priorities.
- Scope letter
- Deliverables, timetable and terms of engagement, in writing, before work starts.
- Collection
- A questionnaire and documents, then two to three conversations with the relevant people on your side.
- Delivery
- The deliverables, then a handover session on the gaps and the order to address them.
- Continuation, if you want it
- Ongoing support or filling the officer role.
- 1. Fit call
- 2. Scope letter
- 3. Collection
- 4. Delivery
- 5. Continuation
Questions people ask
Is the employee’s consent in the employment contract enough?
Not always. Because of the gap in power, the labour courts and the Privacy Protection Authority treat an employee’s consent with suspicion. It is needed for some measures, but it does not make a disproportionate measure lawful. So the first question is whether the measure is necessary, and whether a less intrusive alternative exists.
How long may we keep the CVs of candidates we did not hire?
For as long as they serve a real purpose, which is usually a short period. CVs kept without a purpose add to your exposure in a security incident and in access requests. Set a period, write it into your retention schedule, and delete on time.