Protection of Personal Data in Employment Relationships

[shukla7789]

Hiring an employee involves a series of formalities. Although, as a general rule, Brazilian law waives the need for a written employment contract, other legal requirements fall on the employer, such as registering the employee in e-social and making the appropriate entry in his/her employment record (CTPS). In addition, in several cases a written contract is required. This is the case, for example, with fixed-term, intermittent or apprenticeship contracts. In all of these scenarios, the employer will be faced with the need to collect and process the employee's personal data, such as date of birth, ID, CPF, CTPS and PIS numbers, address, marital status, filiation, etc.

Compliance with certain labor and social security obligations will also require the employer to have access to additional – often sensitive – employee data. This is the case, for example, with biometrics, for access to the employer's premises or timekeeping; health data, measured in occupational exams; and information on family situation, based on which the family allowance may eventually be paid.

The home office regime , which has become quite common during the pandemic, has popularized virtual meetings, in which employees may have their image and voice recorded. This is yet another cash app database in which personal data will be collected and processed. This raises a series of questions about the protection of personal data in employment relationships, in light of the General Data Protection Law – LGPD (Law No. 13,809/2018).

Under article 7, I, of the law, the processing of data with the consent of its owner is legitimate. For this reason, clauses through which the employee expresses his/her agreement with the processing of his/her personal data by the employer are increasingly common in employment contracts. Remember that, under article 8, caput and §1, consent must be provided in writing, in a clause separate from the other contractual clauses, or by another means that demonstrates the owner's expression of will.

However, it is worth noting that there are legal hypotheses in which the processing of personal data may also be carried out independently of consent, among which the following stand out, as they are relevant to this analysis: when necessary for the execution of a contract or preliminary procedures related to a contract to which the data subject is a party, at the request of the data subject; and when necessary to meet the legitimate interests of the controller (article 7, items V and IX).

This means that the processing of personal data collected during the recruitment and selection process, during the hiring phase or during the employment relationship is independent of the express and specific consent of the employee, only when necessary to comply with the legal duties imposed on the employer. In other cases, it is essential to obtain and formalize the consent of the data subject. A chart showing the birthdays of the month, for example, can only be processed with the written consent of each of the employees listed therein.