The main aspects of the legality of the processing of personal data in an employment relationship

The vast majority of us are in an employment relationship and leave their personal data to employers for personnel records. The employer, in turn, collects such data and processes it. It would seem a standard situation. But, in conjunction with the FZ-152 "On personal data," everything becomes not so obvious.

What are the grounds for legitimate processing employers have?
')
Labor relations in our country are regulated by the Labor Code of the Russian Federation, based on its requirements, and we will consider various aspects of the relations of the employer with employees and / or applicants.

Job seekers

Processing applicants' personal data for filling vacancies within legal relations regulated by the Labor Code of the Russian Federation involves obtaining the consent of applicants for filling vacant posts for processing their personal data for the period when an employer makes a decision on hiring or denying employment.

The exceptions are cases when a recruitment agency acts with the person with whom the person has entered into a relevant agreement, as well as when the applicant independently places his resume on the Internet accessible to an unlimited circle of persons.

If an applicant’s resume is received via e-mail or facsimile channels, the employer must additionally carry out activities aimed at confirming the fact that the specified resume was sent by the applicant himself.

For example, such events include the invitation of the applicant to a personal meeting with authorized employees of the employer, feedback via e-mail, etc.

When a CV drawn up in an arbitrary form is sent to the address of the employer, in which it is impossible to unambiguously identify the individual who sent it, this CV is subject to destruction on the day of admission.

If the personal data of applicants is collected through a standard application form approved by the operator, this standard form must comply with the requirements of clause 7 of the Regulations on the peculiarities of personal data processing carried out without the use of automation tools, approved by an order of the Government of the Russian Federation of September 15 2008 N 687, and also contain information about the period of its consideration and the decision to accept or refuse to work.

A typical form of an applicant's application form can be implemented in electronic form on the organization's website, where consent to the processing of personal data is confirmed by the applicant by putting a mark in the appropriate field, unless the employer requests information that requires consent in writing.

In case of refusal in employment, information provided by the applicant must be destroyed within 30 days, with the exception of cases stipulated by the legislation on the state civil service, where the period of storage of the personal data of the applicant is determined within 3 years.

Obtaining consent is also a prerequisite when an employer sends requests to other organizations, including at previous workplaces, to clarify or obtain additional information about the applicant.

Exceptions are cases of concluding an employment contract with a former state or municipal employee. In accordance with Art. 64.1 of the Labor Code of the Russian Federation, an employer, when concluding an employment contract with citizens who have filled state or municipal service positions, the list of which is established by the regulatory legal acts of the Russian Federation, within two years after their dismissal from state or municipal service must report such an agreement the representative of the employer (employer) of a state or municipal employee at the last place of his service in the order established poured regulations of the Russian Federation.

Obligation to obtain consent also does not apply to the processing of personal data of applicants who have submitted documents for filling vacant posts of the civil service, since the list of documents submitted is determined by the Federal Law “On the Civil Service of the Russian Federation” and paragraph 7 of the Provision on the competition for the vacant position of a public civil Service of the Russian Federation, approved by Decree of the President of the Russian Federation of February 01, 2005 No. 112, and the form of the questionnaire, before olagayuschaya made by the applicant personal data, approved by the Federal Government from 26.05.2005 N 667-p.

Personnel reserve

Maintaining a personnel reserve for today is not regulated by labor legislation. In this case, the processing of personal data of persons included in the personnel reserve can only be carried out with their consent, except for cases of existing employees in the personnel reserve, the relevant provisions are defined in the employment contract.

Consent to the applicant's entry into the personnel reserve of the organization is made out either in the form of a separate document or by putting the applicant in the corresponding field of the electronic form of the applicant's application form, implemented on the organization's website on the Internet.

It is obligatory to familiarize the applicant with the conditions for maintaining the personnel reserve in the organization, the period of storage of his personal data, as well as the procedure for excluding him from the personnel reserve.

It should be noted that the Federal Law of July 27, 2004 N 79- “On the State Civil Service of the Russian Federation” provides for the formation of a personnel reserve (federal personnel reserve, personnel reserve of the federal state body, personnel reserve of a constituent entity of the Russian Federation and personnel reserve of a state body of a constituent entity of the Russian Federation ). Thus, consent to the processing of personal data of civil servants, as well as other persons, is not required when maintaining a personnel reserve by the government.

Workers

Consent

Part 3 of Article 9 of the Personal Data Act states:

" The obligation to provide evidence of the consent of the subject of personal data to the processing of his personal data or proof of the grounds specified in paragraphs 2 to 11 of Part 1 of Article 6, Part 2 of Article 10 and Part 2 of Article 11 of this Federal Law is imposed on the operator "

And according to clause 1 of Article 6 and Article 9 of the Law on Personal Data, the processing of personal data is carried out with the consent of the employee. So it makes sense for the employer to collect evidence of the employee’s consent in advance in order to have solid evidence in case of disputes.

The employee’s consent to the processing of personal data should include:

• Surname, name, patronymic, address of the employee, details of the document proving his identity, including the date of issue and information about the issuing authority.
• Upon receipt of consent from the representative - his surname, name, patronymic, address, details of the document proving his identity, including the date of issue and information about the issuing authority, details of the power of attorney or other document confirming the powers of the representative.
• Name or surname, name, patronymic and address of the employer.
• The purpose of processing personal data.
• The list of personal data to be processed.
• The last name, first name, patronymic and address of the person or the name of the organization that processes personal data on behalf of the employer, if it is assigned to such person or organization.
• The list of actions with personal data for which the employee has given consent, a general description of how to process them.
• The period during which the employee's consent to the processing of his personal data, and the method of withdrawal of consent.
• Signature employee.

When receiving consent to the processing of personal data, it is necessary to keep in mind that:

• all personal data of the employee should be received from him;
• the decision of the employee to provide his personal data must be voluntary;
• making a decision on the provision of its data, the employee agrees to their processing;
• consent must be specific, informed and conscious.

When consent is not required

Consent is not required in cases where:

• Processing is necessary in order to fulfill the contract concluded with the employee or the duties, functions and powers assigned to the employer. Such cases include requests from authorized state bodies, the transfer of information to the FSS and the FIU, etc.
• this is provided for in the collective agreement, agreement, as well as local regulations of the employer, adopted in the established art. 372 TK RF order;
• The duty of processing is stipulated by law, including for publishing and posting personal data of employees on the Internet. For example, a medical organization is obliged to inform citizens in an accessible form, including using the Internet, about their medical staff, their level of education, qualifications;
• processing information about the state of health of an employee relates to the possibility of performing his labor function. Such processing is allowed, for example, in relation to information about the health status of teachers;
• the processing of personal data of special categories is carried out by prosecuting authorities, provided that such data were obtained in cases established by RF legislation;
• the personal data of the employee’s close relatives are processed in the amount stipulated by the personal T-2 card , as well as upon receipt of alimony, making social payments, admission to state secrets, etc .;
• the processing of personal data is related to the performance by the employee of his job duties;
• the processing of personal data is carried out for the purposes of the employer's organization of access control to the territory of its office buildings and premises;
• personal data of the employee is transferred to third parties in cases when it is necessary in order to prevent threats to the life and health of the employee, as well as in other cases stipulated by federal laws;
• processing of personal data is carried out in relation to the dismissed workers, for example, in the framework of accounting and tax accounting;
• if the data is obtained from documents (information) presented at the conclusion of the employment contract in accordance with Art. 65, part 4 of Art. 275 of the Labor Code of the Russian Federation.

For a better understanding, we recommend studying the version from the recommendations of Roskomnadzor . It more broadly discloses the points listed above. Below we give only excerpts from the text of recommendations on the issue of obtaining the employee’s consent to provide PD at the request of authorized bodies and from organizations that do not have authority.

The employee’s consent is not required upon receipt, within the framework of established powers, motivated requests from prosecution authorities, law enforcement agencies, security agencies, and state labor inspectors when they exercise state supervision and control over compliance with labor legislation and other bodies authorized to request information about employees in accordance with with the competence stipulated by the legislation of the Russian Federation.

A motivated request should include an indication of the purpose of the request, a reference to the legal basis of the request, including confirming the authority of the body that sent the request, as well as a list of requested information.

In the case of requests from organizations that do not have the appropriate authority, the employer must obtain the employee’s consent to provide his personal data and warn those who receive the employee’s personal data that this data can only be used for the purposes for which they are communicated, and also to demand from these persons confirmation that this rule will be (was) observed.

It should be noted that the transfer of employee personal data to credit institutions that open and maintain payment cards for payroll accounting is carried out without his consent in the following cases:

a) the contract for issuing a bank card was concluded directly with the employee and in the text of which provisions are provided for the transfer of the employee’s personal data by the employer;
b) the employer has a power of attorney to represent the interests of the employee when concluding a contract with a credit institution for issuing a bank card and its subsequent maintenance;
c) the appropriate form and system of remuneration is spelled out in the collective agreement (article 41 of the Labor Code of the Russian Federation).

5. Processing employee's personal data in the implementation of access control to the territory of office buildings and premises of the employer, provided that the access control is organized by the employer independently or if the said processing complies with the procedure stipulated by the collective agreement, local acts of the employer adopted in accordance with Art. 372 Labor Code of the Russian Federation.
When attracting third-party organizations for personnel and accounting, the employer is obliged to comply with the requirements established by Part 3 of Art. 6 of the Federal Law "On Personal Data", including obtaining the consent of employees to transfer their personal data.

Dismissed workers

Regarding the processing of personal data of laid-off workers, it is necessary to clarify the following.

The employer has the right to process the personal data of the dismissed employee in cases and within the time provided for by federal law. Such cases, including, include the processing of personal data in the framework of accounting and tax accounting.

So, according to the sub. 5 p. 3 Art. 24 of the Tax Code of the Russian Federation establishes the duty of tax agents (employers) for 4 years to ensure the safety of the documents necessary for the calculation, withholding and transfer of tax.

Article 17 of the Federal Law of November 21, 1996 N 129- “On Accounting” defines that organizations are obliged to keep accounting records for periods established in accordance with the rules of the organization of state archives, but the minimum storage period cannot be less than five years.

Thus, taking into account the provisions of paragraph 2 of Part 1 of Art. 6 of the Federal Law “On Personal Data”, the consent of the dismissed employees to the processing of their personal data in the above cases is not required.

Upon expiration of the deadlines determined by the legislation of the Russian Federation, personal files of employees and other documents are transferred to archival storage for a period of 75 years. At the same time, the organization of archival storage, acquisition, accounting and use of archival documents containing personal data of employees, the Federal Law "On Personal Data" does not apply, and accordingly, the processing of this information does not require compliance with the conditions associated with obtaining consent to the processing of personal data. data.

PS By the link you can download our White Paper on the Federal Law No. 152.
This is a book that was published to help eliminate confusion in the processing of personal data and clearly describe the process of bringing personal data to IP in accordance with the laws of Russia. The topic is revealed from scratch. It helps to meet the needs of a wide range of readers.