DPA case 07121-1 / 2020/2260 – Violation Found (Slovenia, 2020)

A company’s director decides to prepare and send by e-mail to the clients a video greeting card. The video should be recorded by the workers at home under mandatory participation. The authority was requested to decide upon the legality of the director’s decision and upon the lawfulness of the processing of the workers’ personal data. Can the employer process employee’s personal data under the legal base of consent of article 6 (1) GDPR? The Slovenian DPA finds itself competent of deciding upon the legal basis and the conditions of a lawful processing. Article 6 (1) GDPR provides the conditions of lawful processing. Slovenia’s national legislation provides that employees’ personal data can be processed only if this is determined by law, or if it is necessary for the exercise of rights and obligations arising from the employment relationship or are related to the employment relationship. Due to the inequality of power in the employment relationship and for the protection of the employee, the processing is only possible in exceptional cases and provided that the individual can refuse consent. The consent of article 4 (11) GDPR will suffice only if it is voluntary, specific, informed and unambiguous. The participation at the greeting video is only possible under voluntary consent, which means only if the employee can refuse without negative consequences.