News

Just one small update! Under the GDPR it will be necessary to carry out an impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons.

Processing staff personal data shouldn’t result in a high risk to rights and freedoms, unless:

• You process information relating to criminal convictions and offences;
• You use information to profile and predict behaviours of staff, for example by screening job applicants against a credit reference database;
• You process sensitive personal data or data about vulnerable people;
• You use information to profile staff, which may result in exclusion of or discrimination against individuals;
• You carry out monitoring of staff who are not aware that there data is being collected or how it will be used, or it is difficult for the staff to avoid being monitored (e.g. because CCTV is installed in public spaces).

If you fall into any of the above categories, then you should consider conducting an impact assessment to balance the needs of the business to collect the data against the rights and freedoms of the individual and to consider whether you need any additional measures to limit who has access to that data, to safeguard that data and to ensure that the data is confidentially destroyed at an appropriate time.

For more information please contact Hannah at Hannah Strawbridge@eatonsmith.co.uk