Hi there, I am hoping that you may be able to help me with a question relating to GDPR in the workplace.
We currently have a situation at work where a colleague has provided us (a business) text messages with another colleague. These messages may be included as evidence within an upcoming grievance.
My question is, can the organisation simply take these messages and use them as evidence, or does this constitute 'processing' under GDPR as they have now been passed from an employee to the business (the employer). Will we need to gain consent from both individuals to use these messages?
I think it is also worth noting that these messages were sent on an encrypted messaging service similar to WhatsApp, on personal devices. We are concerned that the employee who did not provide the messages, may raise possible GDPR compliance issues around processing such data which is identifiable.
Any support on this matter would be greatly appreciated.
Yes, if the organization uses the messages it is considered processing of personal data under the EU GDPR.However, the processing of personal data to defend a right in a legal claim is a legal basis for data processing.In particular, Article 6 par. 1 lett. f) GDPR refers to the legitimate interest of the data controller and defending a right follow in the notion of legitimate interest. So your organization does not need consent to process that personal data.
Article 6 paragraph 2 GDPR has also a link to the Chapter IX of the EU GDPR where, in Article 88 GDPR, there is a reference to data processing in the workplace. Data processing in the workplace and in court trials are devolved to the Member State legislation, so the practical possibility to use the message as evidence in a judicial trial will depend on your specific legal system.For example, in Italy, where I am located, the Italian implementation privacy law the controller could use the message as evidence.
Here is some information about consent and data processing in the workplace: