While in the previous part of our text we dealt with the protection of employee privacy and processing of employee personal data before the employment starts, we will now focus on the personal data protection related rights and obligations arising in the course of the employment. European regulation, in particular the GDPR, plays a major role in this area. In addition, the Czech Labour Code also briefly regulates employers’ rights and obligations regarding the monitoring of employees at the workplace. The Czech Office for Personal Data Protection has also ruled on the topic in several of its decisions.

Do I need consent to process employee data?

Employers’ attempts to obtain employees’ consent to the processing of their personal data are unnecessary and, in some cases, counterproductive. Employers process employees’ personal data as part of the negotiation and performance of the employment contract and for the purpose of fulfilling their legal obligation, i.e., in accordance with Articles 6(1)(b) and 6(1)(c) of the GDPR. Employers, acting as personal data controllers, are obliged to collect and process personal data only to such an extent which is appropriate to the purpose of the processing. Therefore, employers must always carefully assess which personal data they actually need for the performance of the employment contract and their statutory legal obligations. If an employer intends to process other personal data than those necessary for the purposes stated above, they must do a ‘balancing test’ to assess whether they have a legitimate interest in processing such data. If the intended processing does not pass the balancing test, employees may be asked to grant their consent to the processing. However, since employees are the weaker party to the relationship, employers must ensure that the consent is given freely and that employees do not feel in any way compelled to grant it. At the same time, the employer must be ready for the possibility that an employee will withdraw the consent, which the employer must accept, even if it should necessitate changes in the employer’s internal HR processes.

What are the privacy and data protection issues inherent in alcohol / drug testing?

According to the Czech Labour Code, an employer may test an employee for drugs or alcohol almost without limitation. A test can also be taken as a preventive measure and without cause, provided that it is carried out by personnel authorised by the employer. If an employee refuses to take a test, it is up to the employer to evaluate the situation and decide on the consequences, however, in in most cases, the refusal will qualify as a violation of an obligation imposed by the Labour Code. The employer may then address the situation by giving the employee a written warning of termination, or depending on the circumstances, impose even more severe sanctions. As far as the test results are concerned, employers are obliged to treat them confidentially, which in particular means that they should only be accessed on a strict need-to-know basis and should be kept only for a necessary period of time. At the same time, testing should be carried out with due regard for the employee’s dignity and personal integrity.

How can I legitimately monitor employee´s email, internet usage and social media?

Employers are entitled to monitor, to a reasonable extent, employees’ compliance with the prohibition to use equipment provided by the employer for private purposes. Therefore, the Czech Labour Code allows employers to monitor, in a reasonable manner, employee activities to ensure that computers or telephones are used for work. Systematic monitoring is however generally not allowed.

An employer may only systematically monitor employees’ internet activities if it can sufficiently justify such monitoring by the specific nature of its business. In such a case, the employer is obliged to inform the employee properly about the scope, form and manner of the monitoring. Hidden monitoring is prohibited, which is in line with the stance taken by the CJEU in its rulings on the matter. The monitoring must also respect the employee’s personal rights and must not interfere with the employee’s privacy beyond what is strictly necessary, since the right to privacy has also been established in relation to the employee’s workplace.

Employers are not authorized to read or save employees’ private emails delivered to the employees’ work email addresses. On the other hand, an employer may require that an employee should delete private emails or only attend to them after the employee’s  working hours. According to the Czech Office for Personal Data Protection, an employer may only monitor the number of emails received and sent, or, if the employer suspects a violation of its interests by the employee, the email header.

Therefore, employers’ options to monitor their employees’ internet activities are rather limited. The nature and extent of any monitoring must always be proportionate to the declared purpose and objective of the monitoring.

What are the limits of using artificial intelligence in employment?

Czech legislation does not address the use of artificial intelligence in employment relationships. Therefore, Article 22(1) of the GDPR is crucial, which states that everyone has the right not to be subjected to decisions based solely on automated processing of personal data – this applies in particular during the recruitment process. In general, the Czech legal system still lacks an explicit regulation of liability for damage caused by the use of artificial intelligence. Artificial intelligence is also related to the use of biometric time and attendance systems. In the past, the Czech Office for Personal Data Protection generally allowed their use in the workplace, but later changed this position with reference to Article 7 of the GDPR and now considers them as disproportionate in relation to the scope and purpose of the processing, which also applies even if the employee agrees to their use but does not have the option to choose an alternative time and attendance/entrance system.  

What are the data protection issues in whistleblowing?

At the time of writing (September 2022), the European Directive 2019/1937 on the protection of whistle-blowers has not yet been implemented in the Czech Republic. The implementing whistle-blower protection act is still in the legislative process, which means that the European whistleblowing legislation could not yet be tested in practice. In general, the Czech public is rather reluctant to grant protection to whistle-blowers and the few publicised whistle-blower cases have drawn negative rather than positive attention. There are only a few decisions of the labour law chamber of the Supreme Court which qualify the termination of employees who have brought unfair practices of their employers to the light as unlawful dismissal. Moreover, even in these cases, the Supreme Court emphasized the employee’s obligation to act in the employer’s interest, which should be reflected in the limits which apply to the exercising of the employee’s rights, including, for example, the freedom of speech and the right to petition. It will be interesting to see whether and to what extent this case law will evolve following the implementation of the European whistleblowing legislation in the Czech legal system.