In practice, the Office for Personal Data Protection (hereinafter the "Office") often comes across cases of data controllers with contractual relations established with international entrepreneurs who require transmission of employees´ personal data to the management or other specialised departments of those international companies.
The Office shall review such cases of personal data transfer not only in the sense of the application of Article 27 of Act No. 101/2000 Coll., on the protection of personal data and on amendment to some acts, as amended (hereinafter the "Act"), but also in view of other legislation governing the processing of employees´ personal data, also including their potential transmission abroad. Therefore, it is necessary to take into account particularly the provisions of labour law and to assess whether such transfer of personal data complies with the purposes stipulated therein.
In some cases of personal data transfer, in particular, if it is subjected to international treaties the ratification of which has been approved by the Parliament of the Czech Republic (e.g., Convention No.108 for the protection of individuals with regard to automatic processing of personal data published in the Collection of International Treaties No. 115/2001), or if they are covered by decisions of an institution of the European Union, it is not necessary to seek a permit of the Office for such transfer of personal data.
If an application for a permit to transfer personal data to other countries is filed, it is obligatory to launch an administrative proceeding pursuant to Article 27 of the Act in order to examine the application for the transfer of personal data. In assessing the statutory conditions applicable to such transfer of personal data, therefore, it is essential to review both legality and efficiency of such transferred personal data, their extent, and/or format, because it involves transfer of personal data to other parties, which usually have no relationship (including no employment relationship) with the employees (data subjects) of a certain employer established in the Czech Republic.
International business entities, which are interested in economic results achieved by some local companies, may receive economic summaries containing anonymous data relating to certain employees, and they may also receive – as part of contractually guaranteed cooperation (i.e., in particular make random collections of) individual data about specific employees in relation to their performances. Any potential economic interest of such international entities, however, is not relevant in respect of the legal position of employees employed in the Czech Republic because, in keeping with the Labour Code, the employer is always authorised to assess employees’ conduct and evaluate their performances (both of those activities undoubtedly also involve processing of personal data). Therefore, controllers intending to transfer personal data of employees abroad should be recommended to take into consideration also the following criteria:
The issue of transfer of employees´ data abroad is limited not only by the conditions stipulated in the terms and conditions as per Article 27 of the Act but also by the fact that the said processing of the employees´ data must be in keeping with certain additional provisions of the Act because they often are activities, which have been governed by special legislation. It must also be in keeping with the rules stipulated in that legislation, and those additional rules must be viewed as specifications of the principles of personal data protection as stipulated in the Act. Therefore, it should not happen that any allegedly "legal" transfer of personal data for such processing abroad takes place, which, however, runs counter to the conditions of such processing as stipulated in the laws of the Czech Republic (legal provisions and decisions of authorities of the European Union).
As long as labour law is considered to be part of private law, it should be stated that, in the given case, the purpose and any potential restrictions applicable to handling employees´ data have been stipulated in legislation. They are both cases explicitly stipulated in the Labour Code, e.g., the provision of Article 60, as well as some general cases allowing for processing certain paperwork in relation to special legislation, e.g., personnel matters and wages (namely for the purposes as characterised by the very name of such case). Also, it is possible to mention in this connection applications of certain special legislation, which may not explicitly stipulate handling of personal data but which have such handling of personal data is necessarily inherent in them; here, too, we talk about activities whose nature specifies the purpose of processing of personal data as required by the Act.
Employees' personal data do not serve exclusively certain matters related to employment relations between employees and their employers but they also may represent background materials for other activities, e.g., assessment of works rationalisation efforts, labour efficiency and future trends within the employer’s business. In such cases, though, it is necessary to make such employees´ personal data anonymous because such processing of personal data serves the purposes of achieving economic goals of the employers. Processing non-anonymous data, although they may be in direct relation to employees but serve in the first place to immediate economic purposes of the employers, obviously is over and above the framework (purpose) of the handling of employees' personal data as stipulated in the legislation.
Undoubtedly, some cases of the handling of employees´ personal data, particularly in areas which have not been governed or directly restricted by the legislation, may only be performed with the employees’ consent. In any such cases, however, also other provisions of the Act must be complied with, including the requirement that any such specific case of personal data handling must have a clear purpose. It is obvious that such a consent by the employee cannot heal any potential conflict between the employer’s requirements and the rules and purposes stipulated in the legislation. Last but not least, such consent can be considered as being outside acts in keeping with labour law since it needs not be conditioned thereby. At the same time, it is necessary that employers keep their employees informed about any such processing of their personal data abroad, namely in such manner so that it is obvious that their consent with such personal data processing for the purposes of such transfer has been voluntary, and that they are free to refuse to give it.
In many cases, such transfers of personal data to other countries are required because such processing is performed by certain specialised or professional offices situated with so-called "parent" companies located abroad, which are regarded as processors by the Act. Then, it is essential to comply in particular also with the provision of Article 6 of the Act, that is, to enter into an agreement between the controller and the processor. The said processor, however, is not authorised to process the relevant personal data for any other purposes and for any other controller (however, it is allowed to make the data anonymous for such other purposes).
Often, transfers of personal data abroad are performed for the purposes of increasing qualifications of certain selected groups of employees, and if they are dispatched for abroad business trips. In such cases, one of the conditions pursuant to Article 27 of the Act has usually been complied with. However, if such employer should also process personal data of an employee's family members in connection with such international secondment, usually if the employee and his/her family should re-settle there, it also is essential to seek those family members' consent.
In conclusion, it should be pointed out that the identified areas of issues also apply to cases of processing of personal data which do not fall under the category covered by personal data transfer permits issued by the Office because those cases are subject to the Office’s supervision (including sanction). Therefore, the above-described criteria should also be considered in case of any transfers of employees´ personal data abroad.
Mode No graphics is currently switched on. Therefore you see the web page with no decorative graphics as well as any advanced formatting. If your browser supports CSS2, you can switch a graphic mode on.