The employer must have permission to use the employee’s private contact details

In one of the recent publications on the website Office of Personal Data Protection (hereinafter: UODO), the office reminded that employers may not use their private telephone numbers and e-mail addresses without the employees’ consent, even in case of contacts in professional matters.

This is particularly important at this time, when some workers are taking holidays and some are working in the remote working system due to the ongoing COVID-19 epidemic. The employer may therefore need to contact an employee who is outside the office.

Legal basis for obtaining private employee contact details

In accordance with the position of the UODO, invoking a legitimate interest of the employer [art. 6(1)(f) GDPR] is a legitimate interest of the employer, e. g. to contact the employee in order to cancel his or her holiday will not be a sufficient basis for processing personal data in the form of a private telephone number and email address.

As a general rule, an employer wishing to keep in contact with an employee outside the workplace (to the extent permitted by law) should equip the employee with appropriate tools, including a company phone and a company email address. In such a case he will not have to ask for the employee’s consent for contact – the basis for processing personal data will be his legitimate interest in the form of e. g. to manage personnel working in home office mode.

An employer who for various reasons does not provide such tools must rely on the goodwill of the employee. The employee is not legally obliged to have a telephone number and email address, and their transmission to the employer for the purpose of professional contacts must be preceded by obtaining his voluntary consent.

What about the contact details already obtained from employees?

It should be remembered that the very fact of obtaining the employee’s contact details e. g. during recruitment or in connection with participation in the Employee Capital Plan, does not give the right to contact the employee for professional purposes.

If the employee’s phone number is in the employer’s database because it was given on another occasion – for example, if the employee has informed the HR department by phone about an unplanned absence from work, it will still be necessary to revoke the employee’s consent to its use for another purpose, e. g. contacts while working in home office mode.

How do you get permission from an employee?

In the communication, the UODO indicated that consent for the use of private contact details by the employer should be given in writing, indicating the extent to which contact will be made.

Such a position seems to be too restrictive, both in the light of the provisions of the GDPR and of art. 22^1a of the Labour Code governing the consent of employees.

The consent of the employee should be clear and demonstrable by the employer. However, this does not always mean that a written statement must be received. Clear action of the employee e. g. Sending your contact details to a dedicated mailbox or supplementing your IT system employee profile may also constitute consent.

However, the employer should take care of this:

1. consent was not given by silence (e. g. the need to object to the use of contact details),
2. the form of consent made it possible to demonstrate that consent was actually given,
3. prior to giving his or her consent, the worker has received information enabling him or her to give it knowingly (including the purpose of the processing, the duration of the processing and the voluntary and revocable nature of the consent),
4. Withdrawal of consent must be as easy as granting it (so you cannot e. g. collect approvals in the form of an action by the employee and require its withdrawal by means of a statement sent by registered letter to the employer).

In addition, the employer cannot treat less well those employees who have not given their consent e. g. allow the home office only to those employees who agree to contact their private phone number. Such action would not provide for voluntary consent.

Finally, it is worth remembering that consent to the use of an employee’s private contact information does not give the employer the right to disclose it to others, including other employees.