DPA case 07121-1/2020/519 – Order (Slovenia, 2020)

An employee asked the IP to issue an opinion about the personal data that an employer is expected to collect from employees during the period that they work from home. The employee claimed that the first 14 days the employer asked them to provide a report of their working activity at home. After the first 14 days, if they wanted to continue working from home, the employer asked them to download a specific app which would track their activity on the internet and seems very invasive. The IP found that the "monitoring report" implies processing of the employee's personal data and a legal basis would be needed according to Article 6 GDPR and the principles of Article 5 GDPR should be respected. The employer who decides that his employees will work from home is entitled to monitor and supervise the performance and to that end, in accordance with Article 48 ZDR-1, process information might include personal data. It should follow from the principle of data minimisation what personal data should be processed. The employer should collect only the data that is necessary, appropriate and proportionate to the purpose of monitoring the employee's performance at work. To this end any automated and systematic collection and further processing of e.g. screenshots of employees' computers displaying the contents of their screen at a particular moment would not meet the criteria. As for the app, its characteristics are not mentioned in the request submitted by the employee, but in general such apps can be used in very different ways, depending on the settings selected by the administrator and/or user. The IP emphasises that the employer must comply with his information obligations according to Articles 13 and 14 GDPR and the principle of transparency.