Question 1

Can an employer rely on consent to collect data from its own staff?

Accepted Answer

It can, but consent is fragile in an employment relationship because of the power imbalance between the employer and the employee. Consent has to be freely given, which means a person must be able to refuse without any disadvantage. That is realistic for something genuinely voluntary, such as a gift or a social event, and unrealistic for anything an employee reasonably fears they are expected to complete. Any wording that suggests an obligation, such as mandatory or urgent, removes the freedom the consent depends on.

Question 2

Is it acceptable to collect a field that is not needed as long as it is marked optional?

Accepted Answer

No. Data minimisation under Article 5(1)(c) limits collection to what is adequate, relevant and necessary for the purpose, and an optional field is still collected, still stored, still capable of being breached and still something you have to account for in an access request. If the stated purpose does not fail without the field, the field should not appear on the form.

Question 3

Why do dietary requirements and allergies need special treatment?

Accepted Answer

Because they reveal health information, and dietary restrictions frequently reveal religious or philosophical belief as well. Both are special categories under Article 9, which begins by prohibiting their processing. Explicit consent under Article 9(2)(a) is one of the narrow exceptions, and explicit means the person was told what this specific data is and agreed to it separately. Bundling it into a single tick alongside ordinary fields does not meet that standard.

Question 4

What has to be in the notice when data is collected directly from people?

Accepted Answer

Article 13 requires the identity of the controller, the purposes and the legal basis, the recipients or categories of recipients, the retention period or the criteria used to set it, the individual's rights including the right to withdraw consent as easily as it was given, the right to complain to a supervisory authority, and the contact details of the Data Protection Officer where one is appointed. It must be provided at the time the data is obtained, not on request afterwards.

Question 5

Why should the Data Protection Officer see a draft rather than the finished communication?

Accepted Answer

Because after it is sent there is nothing left to fix. Once a message reaches several hundred mailboxes, the data starts arriving, and the only remaining options are deletion, notification and explanation. A review that takes a few minutes while a message is still a draft avoids all of that, and it is also what Article 38 envisages by requiring the DPO to be involved properly and in good time in all issues relating to the protection of personal data.

Question 6

What is the risk of sending an internal request to every profile in an HR system?

Accepted Answer

Systems retain profiles for former employees and contractors for their own separate purposes, such as payroll history or references, and those profiles are usually still reachable by a mailing tool. Sending a staff request to all of them means asking people the request does not apply to, and any data they return is collected with no purpose and no basis. Audiences should be scoped deliberately for each communication rather than defaulted to everyone.

Збір даних працівників

Що таке Збір даних працівників?

Що ви дізнаєтесь у Збір даних працівників

Збір даних працівників — Кроки навчання

Послуга для Dagny

Вкладення

Побіжний погляд

Забагато полів

До платформи

Вхід

Усі — це справді всі

Прикріплення форми

Надіслано

Дзвонить телефон