BELGIUM Law and Practice Contributed by: Benjamin Docquir and Margo Cornette, Osborne Clarke
Although the GDPR aims to harmonise the rules on the protection of personal data within the EU, it provides an exception in the field of employ - ment relationships due to the characteristic rela - tionship between employer and employee. It is therefore possible to establish specific rules for the processing of employees’ personal data, both at the sector and company level, for exam - ple through collective labour agreements. It is important to note the following. • Consent: It is difficult to obtain valid consent in an employment context due to the imbal - ance, and it can be withdrawn (preventing further processing). Instead, employers might consider other legal bases such as the perfor - mance of a contract, compliance with a legal obligation or legitimate interest. • The processing of sensitive data is subject to a stricter regime. There are also special rules around the processing of personal data relat - ing to criminal convictions and offences. • Concerning recruitment: (a) Background checks are legal to some extent but subject to strict regulations. This includes that the background checks be conducted in relation to the informa - tion that is relevant to the position for which the person is applying; the infor - mation cannot be obtained through any alternative means, such as directly asking the candidate during the interview, when there are reasonable doubts about the accuracy of the information provided by the candidate; the candidate has been informed in advance that background checks will be conducted; and the candi - date will be receiving a privacy notice pro - viding them with an insight into how and why their personal data will be processed. (b) Copy of a criminal record – You should
not ask for a candidate’s criminal record unless it is supervised by public authori - ties or required by specific legislation for certain professional activities (eg, taxi drivers, private detectives, police officers, security personnel or certain financial and insurance roles), even with the candi - date’s consent. You should only request a copy of the criminal record if legally re - quired for the professional activity. If you do not meet these exceptions, and the candidate consents, you may ask them to show the extract without taking notes or storing a copy. Showing an extract does not constitute personal data processing, and candidates cannot be compelled to show their criminal record. • There are specific considerations to take into account in relation to a dismissed employee’s professional mailbox: (a) access to a terminated employee’s professional mailbox must comply with GDPR rules and be based on a legitimate aim, such as following up on urgent mat - ters; (b) access should be limited to what is strictly necessary, like setting up an out- of-office message or identifying urgent professional emails; (c) employers must transparently outline the conditions for accessing the mailbox after employment ends, possibly through an IT policy; (d) access should also be time-limited; and (e) the terminated employee should have enough time to delete private data from their professional mailbox, even if person - al use is prohibited by the employer. • Employee monitoring is always a balancing exercise between the employee’s right to pri - vacy and the employer’s right to take meas - ures that ensure the smooth running of the
24
CHAMBERS.COM
Powered by FlippingBook