Employee Data Collection

What Is Employee Data Collection?

Internal requests are where over-collection actually happens, because nobody in the chain thinks of a staff form as data processing. A manager asks for a quick favour, a coordinator sends it, and several hundred colleagues are asked for tax numbers, family birthdays and health conditions before anyone has written down what the data is for. This exercise plays that morning out in full: the form goes to every profile in the HR platform, including archived ones, with a covering note calling it mandatory. By lunchtime the Data Protection Officer has intervened, eleven people who left the company months ago have sent in sensitive data, a contractor has filed an Article 15 access request nobody can answer, and the supervisory authority has written in. The second half runs the same request again, correctly. One question to the manager produces the purpose that was only ever in her head. Six fields are measured against that purpose until one is required, one is optional behind its own explicit consent, and four are removed entirely. The draft wording goes to the DPO before it is sent rather than after, and the corrected version is compared with the original line by line: voluntariness instead of pressure, a narrow purpose, two separate legal bases, a retention period, named recipients, and the rights and contact details that answer an access request before anyone has to make one. The mailing then goes only to the people it applies to.

What You'll Learn in Employee Data Collection

• Establish and record the purpose of a collection before any data is requested, and ask when the purpose exists only in someone's head
• Apply data minimisation under Article 5(1)(c) by testing each field against the stated purpose rather than against usefulness
• Recognise that marking an unnecessary field optional does not satisfy minimisation, and remove it instead
• Identify dietary, religious and health information as special category data under Article 9 and collect it behind separate explicit consent
• Explain why wording such as mandatory or urgent invalidates consent in an employment relationship, where the power imbalance is already a risk
• List the Article 13 information a collection notice must carry: purpose, legal basis, retention period, recipients, rights and DPO contact
• Involve Legal and the Data Protection Officer while a communication is still a draft rather than after it has been sent
• Scope an internal audience deliberately, and recognise that former employees should not receive staff communications at all

Employee Data Collection — Training Steps

1. A Favour for Dagny

   Monday, twenty past nine. Dagny Sorheim, who runs People Operations and has been in back to back meetings since eight, sends over a form and asks you to get it out to everyone today. It is a two minute job. You would rather clear it now than let it sit in your inbox while you work on the things you actually planned for the day.

2. The Attachment

   The form came from Dagny, so there is no reason to doubt it. Download it and get it moving.

3. A Quick Look

   You give it the glance you give anything a manager forwards: is it the right document, does it have a title, is there anything obviously broken.

4. Rather a Lot of Fields

   It is longer than you expected. Nothing about it looks wrong exactly, it is just a lot of boxes for something that was described as a quick favour.

5. Off to the Platform

   It is a lot of questions, but Dagny asked for it and Dagny presumably knows why. You have four other things waiting. Her email links straight to Almvik People, the platform that sends anything company wide.

6. Signing In

   Almvik People holds a profile for everyone the company has ever paid, and it is the only tool that can reach all of them at once.

7. Everyone Means Everyone

   Dagny said everyone. The platform splits its profiles into groups, and picking through them one at a time is exactly the kind of fiddling that turns a two minute job into twenty. There is a button that takes all of them at once.

8. Attaching the Form

   The mailing has its people. It still needs the thing you are actually asking them to fill in. Almvik People will not send a broadcast with nothing on it, so the form goes on before anything else happens.

9. Sent

   One thing left: the note that goes above the form. People ignore internal mailings, and you have a Friday deadline to hit, so you make it sound like it matters. Then you send it and get on with your morning.

10. The Phone Rings

    You are halfway through the onboarding pack for next week's starters when your phone goes. It is Ines Kovar, the Data Protection Officer, and she has not rung you before.