NEWSFLASH | Supervision at the workplace

A draft law n°7184 establishing the National Commission for Data Protection and implementing the General Data Protection Regulation (GDPR) was published on September 12, 2017 (the “Draft Law”).

Proposals for amendments by the group of government delegates have been made on March 8, 2018 a.o. with a view to addressing data protection issues in connection with the supervision of employees at the workplace. These amendments are made in the context of Article 88 of the GDPR allowing Member State to provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context.

Current situation

The matter is governed by Article L.261-1 of the Labour code, currently providing that in order to implement a supervision system at the workplace, a prior authorisation by the Commission Nationale pour la Protection des Données (CNPD) will be required.

The CNPD verifies if all legal requirements are satisfied, a.o. whether the processing is legitimate and if the monitoring in the workplace is proportionate to the purpose that is pursued by the employer.

According to Article L. 261-1 of the Labour Code, such processing is only lawful if it is required to :

1. ensure the compliance of health and safety provisions; or
2. ensure the protection of property of the undertaking; or
3. monitor the production process of machinery; or
4. monitor on a temporary basis the production process or employees’ performance to the extent that such supervision is required to determine the employees’ remuneration; or
5. implement and monitor a flexible-time arrangement.

The Joint Works Council (to be replaced by the staff delegation after the next social elections) has a co-decision right in the event of implementation of supervision measures foreseen under points 1, 4 and 5.

Notwithstanding the right to information to the concerned employees as provided for by general data protection legal provisions, the employer must comply with a prior information requirement to :

• the concerned employees ;
• the Joint Works Council, as the case may be ;
• the staff delegation ;
• the Inspection du Travail et des Mines.

The draft law provides that the supervision at the workplace may be implemented in compliance with the GDPR by the employer as a controller.

The draft law introduces a twofold regime depending on the grounds that render the processing lawful and whether such ground of lawfulness is subject to a co-decision requirement:

(a) If such processing is based on the requirement to:

• ensure the compliance of health and safety provisions;
• monitor on a temporary basis the production process or employees’ performance to the extent that such supervision is required to determine the employees’ remuneration; or
• implement and monitor a flexible-time arrangement.

the following conditions will apply:

• the implementation of a flexible-time arrangement requires that it is agreed, as well as its periodicity, its content, terms and conditions and, modification, in a collective bargaining agreement, company agreement, any inter-professional agreement on social dialogue, or by comment consent of the employer and the staff delegation/employees.
• The co-decision process with the Joint Works Council (to be replaced by the staff delegation after the next social elections) as required by the law must be complied with.
• In the event the parties fail to find an agreement, any party may refer the matter to the CNPD for preliminary opinion as to the compliance of the contemplated supervision measures. The CNPD must issue an advice within one month.
• The employees’ consent does not render the processing lawful.
• Notwithstanding the right to information to the concerned employees as provided for by general data protection legal provisions (information requirement on an individual basis), the employer must comply with a prior information requirement (information requirement on a collective basis) to
  • the concerned employees,
  • the Joint Works Council, as the case may be,
  • the staff delegation,
  • the Inspection du Travail et des Mines.

(b) If the processing is based on any other grounds for lawfulness as provided for by Article 6 of the GDPR, the staff delegation, as the case may be, or, the concerned employees, may apply for a preliminary opinion with the CNPD as to the compliance of the contemplated supervision measures. The CNPD must issue an advice within one month. Such request will have suspensive effects.