Employment investigation report in breach of GDPR?

The General Data Protection Regulation (“GDPR”), which came into effect on 25 May 2018, has certainly stirred things up. The GDPR has enhanced and extended the privacy rights of data subjects – the individuals whose personal data is processed. One of the new rights is the “right to be forgotten”, which gives data subjects the right to have their personal data deleted.

In the past, courts have appeared to be less strict with privacy in employment law matters than the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), and have even taken account of unlawfully obtained evidence in their deliberations. Establishing the truth of the matter took precedence over the breach of an employee’s privacy. We shall have to see whether the GDPR changes this situation.

In a recent ruling, the District Court in Amsterdam issued a judgment on whether the GPDR prevented an employer from using a report from an external investigation agency in an employment dispute.

What was the background here?

During an employment dispute, the employer suspended the employee from her work and sent her a letter confirming that it was arranging for an external investigation agency to investigate her conduct. Once the investigation report was completed, the employer informed the employee that it wanted to terminate her employment. The employer indicated that it was keen to work towards a termination agreement but, if that failed, it would ask the sub-district court to dissolve the employment contract.

In response, the employee filed a complaint against the investigation agency with the Dutch Data Protection Authority. She also filed an official police complaint against the investigation agency in connection with an alleged breach of the Private Security Organisations and Detective Agencies Act (Wet particuliere beveiligingsorganisaties en recherchebureaus, “Wbpr”), because the investigation agency did not hold a licence for detective work.

The employee also asked the employer to delete the report because the personal data it contained had allegedly been gained illegally, partly because the investigation agency did not hold the licence referred to above. The employer did not accede to this request and the parties failed to reach any amicable settlement. The employer then filed an application for dissolution.

In turn, the employee initiated provisional relief proceedings. She sought an injunction against the employer from using the report or processing it any further until a decision had been made on her application to restrict or delete the personal data that the report contained. The employee based her application on the GDPR.

Judgment

The provisional relief judge did not readily agree with the employee that the work done by the investigation agency was “detective work” and that the agency therefore had to hold a licence under the Wbpr. The question to be answered was whether the work done by the investigation agency was covered by the definition in the Wbpr.

The provisional relief judge also held that the employer had asserted, without contradiction, that the report had quite openly been based exclusively on interviews with those involved and data provided by them (particularly by the employee herself) and not on information gleaned from investigative work done by the agency. This meant that the judge could not readily conclude that the report was illegal, within the meaning of the GDPR, simply because of how it had been compiled.

The mere fact that the investigation agency did not hold a Wbpr licence, so far as one was required, did not mean that the employee could demand, on the basis of the GDPR, that the report should be disregarded. After all, it was not the employer that compiled the report and there was no evidence at that point of any unlawful action on the employer’s part in how the report had been compiled.

The provisional relief judge agreed with the employer that the right to be forgotten was not an absolute right. The employee could not simply ask for her personal data to be deleted.

The employer also argued, without contradiction, that the only information it had provided to the investigation agency was the employee’s contact details. It had a legitimate interest in doing this, within the meaning of the GDPR, namely of having an investigation carried out into possible undesirable conduct by the employee in the workplace. The employer had also acted openly in this, as it had notified the employee by letter as to the reasons for engaging the investigation agency. Against that background, there were no indications for a finding at this stage that the employer was acting or had acted in breach of the GDPR, according to the provisional relief judge.

Conclusion

The provisional relief judge dismissed the employee’s claims. The result of this was that the employer could use the investigation report in the context of the termination proceedings.

Eric van Dam (evd@clintlegal.com / +31 20 820 0330)