Guest user Created: Apr 18, 2018 Last commented: Apr 18, 2018

The employees data

We are an employee benefits company who have contracts with a number of employers to manage their employee benefits. Their employees data is sent across to us to enroll the employees in benefits and at present the employees do not sign any terms and conditions with us. Under GDPR, we hold no contract with the individuals however we were wondering if we could add a clause into the contract with our clients to state that they provide us with authority to utilize the employees data to provide the benefits documented in the contract of employment held between the employer and employee?

0 0

Assign topic to the user

Select user

Expert

Andrei Hanganu Apr 18, 2018

Answer:

In the case you are describing it seems you are a data controller as regards to the data of the employees of your customers. So basically, you are finding yourself in the situation described in EU GDPR article 14 – “Information to be provided where personal data have not been obtained from the data subject” https://advisera.com/eugdpracademy/gdpr/information-to-be-provided-where-personal-data-have-not-been-obtained-from-the-data-subject/

In this case my opinion is that you need to provide the individual with a privacy notice informing them about who are you and what are you doing with their data.

On the other hand since the employer would be the one sending the personal data to you they will also need at their end to provide a privacy notice of their own stating among others that they will be sharing data with third parties such as yourself.

To find out more about privacy notices check out our webinar “Privacy Notices Under the EU GDPR” https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar-on-demand/

Quote

0 0

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Apr 18, 2018

Expert Advice Community