sou · GQB318d1 · 2003-01-01 00:00:00 — Bestämmelsen i kompletteras vidare av motsvarande regel i 21 § PUL som förbjuder alla utom myndigheter att behandla personuppgifter om lagöverträdelser automatiserat eller i registerform. Varken enligt eller PUL kan en arbetstagare samtycka till behandling av personuppgifter om lagöverträdelser. Personlighetstester används numera i stor omfattning under anställningsförfaranden. Testerna, som bl.a. syftar till att avspegla den testades personlighet och förutsättningar i olika avseenden, kan medföra risker för kränkningar av den personliga integriteten. De tester som finns på marknaden är dessutom av skiftande kvalitet och testanvändarnas kompetens kan variera. I föreslås därför en bestämmelse som anger att behandling av personuppgifter som hämtas in genom ett personlighetstest bara får göras med samtycke av arbetstagaren. Detta betyder att arbetstagaren behåller kontrollen över de uppgifter som framkommer vid testet. För att ytterligare minska risken för kränkningar av den personliga integriteten föreslås även att arbetsgivaren skall se till att personlighetstester bara utförs på ett betryggande sätt med tillförlitliga testinstrument och av personer med adekvat utbildning. pågår inom psykologi ett kvalitetssäkringsarbete angående tillförlitligheten av testinstrument och testanvändare. Utredningen, som förutsätter att detta arbete kommer att avslutas med förslag och rekommendationer , anser att resultatet av arbetet bör avvaktas innan den föreslagna bestämmelsen träder i kraft. De materiella bestämmelserna i kompletteras av bestämmelser som säkerställer att arbetstagaren får insyn i och kontroll över behandlingen av personuppgifter som rör honom eller henne. Härmed avses den tidigare nämnda bestämmelsen att arbetsgivaren vid behandling av personuppgifter om hälsa, droganvändning eller lagöverträdelser är skyldig att i första hand hämta in sådana personuppgifter från arbetstagaren. Vidare avses de föreslagna bestämmelserna om –förvaring av personuppgifter, –arbetsgivarens skyldighet att informera arbetstagaren om pågående behandling av personuppgifter –arbetsgivarens skyldighet att rätta eller utplåna felaktiga, ofullständiga eller irrelevanta uppgifter, samt –tystnadsplikt för den som i privat verksamhet behandlar eller har behandlat personuppgifter. Överträdelser av lagen sanktioneras genom straff och skade- stånd. Straffansvar gäller dock inte vid helt behandling. Arbetsmarknadens parter har centrala uppgifter när det gäller all lagstiftning som rör arbetslivet och utredningen framhåller att parternas ansvar och engagemang behövs för att skall kunna ge arbetstagare och arbetssökande det avsedda integritetsskyddet. Effektiviteten av bygger i hög grad på ett fackligt engagemang, såväl centralt som lokalt. Utredningen har med utformningen av avsett att främja samarbetet mellan arbetsmarknadens parter när det gäller skyddet för den personliga integriteten i arbetslivet. Den föreslagna lagen innehåller därför flera regler där det inte är på förhand alldeles givet hur de skall tillämpas på en arbetsplats. Avsikten är då att parterna med lagen som grund skall kunna träffa kollektivavtal med bestämmelser som preciserar vad som skall gälla enligt lagen med hänsyn till förhållanden inom skilda branscher eller lokala förhållanden på olika arbetsplatser. För att parterna skall kunna träffa sådana preciserande kollektivavtal krävs det ingen särskild bestämmelse i . Avtalen får nämligen inte stå i strid med lagen utan bara precisera den. Vid tvist om vad lagen innebär i ett visst fall kan sådana kollektivavtal förutsättas få stor betydelse. I erinras även om arbetsgivarens primära förhandlingsskyldighet enligt MBL samt om att lagen om rättsgången i arbetstvister gäller för tvister som rör lagen, varvid organisation kan företräda medlem. Rapid developments in recent years both in information technology and in the field of medicine have substantially enhanced employers possibilities of checking up on employees in different ways. The risk of intrusion on employees personal integrity has consequently increased considerably. This has caused the trade union organisations to call for stronger protection of the personal integrity of employees and job applicants. In connection with a survey of the applicable legislation it was established that there are no cohesive rules for protection of personal integrity in working life. has any legislation been formulated in this respect taking into consideration technical and advances. In accordance with its terms of reference, the committee has focused primarily on issues relating to the risk of violations of employees personal integrity in connection with the use of information technology in working life on the one hand and, on the other, employers monitoring of employees health or use of drugs. In addition, the committee discussed other situations in which the personal integrity of employees may be considered to be seriously at risk. Particular attention has been given to the need for protection of job applicants and for the purposes of this inquiry job applicants and previous employees are placed on an equal footing with employees. found that there is no acceptable, legally binding protection of the personal integrity of employees. However, at both international and national levels there is broad agreement that respect for individuals private lives and protection of personal integrity are human rights which states are under an obligation to guarantee. A guarantee of this nature can only be given through legislation. therefore proposes the introduction of an act of law on protection of personal integrity in working life (). Draft law on protection of personal integrity in working life was instructed under its terms of reference to look into the need for legislation or other measures to strengthen protection of individuals personal integrity in working life. The situations covered by the review include checks and other measures taken by employers in order to obtain different types of information about an employee or job applicant. In this context a danger of intrusion on personal integrity arises when information about individual employees is collected or processed in some other way. therefore concentrated on trying to limit employers rights to process personal data in situations where an employees personal integrity may be considered to be seriously at risk. Act, which applies to all automatic processing and registration, currently provides the best protection in connection with the processing of personal data. found it natural and in practice inevitable that the draft law be based on the Act. Through the Act, the EC Directive on the protection of individuals has been introduced into Swedish legislation1. The fact that the draft law will now be based on the Act means that the basic principles of relevance and finality that governed the formulation of the EC Directive on the protection of individuals and the Act will also apply to the protection of personal integrity act. These principles which permeate the draft law, mean in short that –the personal data collected must be adequate and relevant in relation to the purposes for which they are processed, –the purposes must be specified, explicit and legitimate, and –personal data may not be processed for purposes that are incompatible with the intentions for which they are collected. In relation to the Act, the draft law envisages a special act which means that where appropriate its provisions will 1 The Directive 95/46/EC of Parliament and of of individuals with regard to the processing of personal data and on the free movement of such data. take over the provisions set out in the Act. However, this law will not be limited to developing and specifying the rules in the Act of special interest to working life. It will have somewhat broader scope. In connection with employers processing of personal data relating to employees, there is a danger of violations of integrity even if the data is processed entirely manually. therefore proposes that the law shall also apply to entirely manual processing of personal data. This means that processing of all documented personal data, including written notes on loose pieces of paper, shall be covered. The draft law also covers methods for carrying out different measures that may involve violations of personal integrity. It is proposed, for example, that personal data primarily be collected from the employee him/herself. Only in cases where this is not possible may an employer, with the employees consent, collect information from some other source. Furthermore, in order to protect employees personal integrity as far as possible, the draft law specifies the way in which examinations, drug tests and personality tests may be carried out. It is proposed that the law on protection of personal integrity in working life apply to both the public and private sectors of the labour market. Its aim is to strengthen not just the protection of employees integrity but also protection of the integrity of job applicants and previous employees.2 The scope of protection of personal integrity in working life provided by the draft law is evident from the combination of the different provisions proposed by the committee. Use of information technology in working life The increased use of information technology in working life involves greater risks than previously of intrusion on employees personal integrity and compared with the situation previously, the risks are of a somewhat different nature. Technical equipment available today gives employers greater chances of carrying out checks and this can easily be done without the employee in question being aware that he/she is being monitored. 2 Where applicable, employee also refers to job applicants and previous employees in this summary. The use of information technology involves risks to the personal integrity of employees, above all in two types of situation. One situation which has been given much attention, inter alia, in the media, concerns whether an employer has the right to read private e-mails or other private information that is available electronically. The other situation concerns the employer's use of logging functions that automatically collect data on employees behaviour and activities. Private e-mail and other electronic data begins by establishing that employers have the right to preside over the use of their technical equipment. Thus, the employer determines whether and to what extent an employee may use the equipment for private purposes. Most large companies and public authorities now have guidelines and policies for private use of e-mail and the Internet and as a rule seem to allow their employees to use the employers computer for private purposes to a limited extent. However, the private use of these facilities appears to be largely unregulated in the rest of the labour market. Use of the employers computer by an employee means that private electronic data may be stored in that computer. As a rule data is in the form of sent and received e-mail messages but may also be in the form of other types of files, for example text or image files. The committees review of the applicable legislation shows that employers have extensive possibilities of carrying out checks by accessing these data. However, in accordance with established practice in working life, these checks may not contravene laws, good practice or be improper otherwise. Since a measure that involves an employers reading private electronic data constitutes the processing of personal data under the Act, the provisions of that Act must also be observed. The draft law includes a provision intended to define and limit the employers right to read this type of private electronic data. However, it has proved impossible to guarantee an absolute protection of employees integrity with regard to private e-mails or other private electronic data by means of general legislation applicable to all areas of working life. Regulation of this nature would have far too negative and unpredictable consequences for employers and hence for the whole of society. As a point of departure, the draft law proposes the introduction of a prohibition against the employers reading employees private e-mail or other private electronic data. To ensure that the employer can use his IT tools in a rational way, the prohibition refers only to deliberate intrusion, that is to say the employer must be aware that it is the employees private data. An employee shall also be able to consent to the employers reading such data. Furthermore, exemptions from the prohibition are proposed when it is necessary for the employers operations that he/she read private electronic data. The situations to which this applies have not been defined, on the other hand they have been exemplified in a that presupposes a restrictive application of the possibility of granting exemptions to the prohibition. As an example it is stated that special heed shall be paid to whether the security of information is in jeopardy or whether the employee on reasonable grounds may be suspected of being guilty of an offence in connection with use of the employers equipment or of such disloyal behaviour that there are impartial grounds for dismissal or cause for contractual liability for damages. The proposed provision applies irrespective of whether or not the employee had the employers permission to use his computer for private e-mails or other private electronic tasks. In practically all use of information technology, the activities initiated are logged. The so-called electronic traces collected in this way can often be linked to an individual and contain information about the individuals actions and behaviour in different respects. The data may concern relatively harmless circumstances, for example the time an employee logged his/her PC into the network. However, using more advanced technology the employer can register all the measures taken by an employee when he/she uses certain IT tools, which is the case, inter alia, in connection with measurement of performance in telecommunication services operations. Furthermore, by using so-called GPS technology, an employees physical whereabouts can be registered, which occurs, inter alia, in the transport sector. Thus, employers have relatively extensive possibilities of using logging to monitor employees. However, these possibilities are restricted in that monitoring must not contravene laws, good practice or be otherwise improper. Logging activities in which collected data can be linked to certain individual employees constitutes processing of personal data under the Act. In its assessment of the protection of personal integrity provided by the Act, the committee found that the Act must be considered to provide satisfactory protection of the personal integrity of employees in connection with logging. to this circumstance, together with the fact that it is possible to regulate the phenomenon of logging under a general provision, the committee does not wish to propose any provision tangibly regulating logging. On the other hand, there is reason to emphasise and clarify the protection of integrity provided by the Act. therefore proposes that reference to the provisions of the Act be included in the protection of personal integrity act. Personal data on health or the use of drugs Personal data on health or the use of drugs is sensitive information and such information must therefore be handled very restrictively. From the review of relevant legislation in the report, it can be seen that there is no acceptable and comprehensive protection of personal integrity for employees in this respect. Bearing in mind the sensitive character of this information, the committee proposes as a general rule a prohibition on employers processing personal data on the health of or use of drugs by employees. This regulation makes no provision for the consent of the employee. Exemptions are proposed, however, if it is necessary for an employer to process personal data on an employees health or drug use in order to ascertain whether the employee is capable of carrying out tasks required by the job. This exemption is intended to be applied when it is necessary for the security of the employee him/herself, of other employees, the workplace or the general public. But also in other cases involving the use of alcohol or drugs with clear negative effects on the capacity of the employee to work or on the working environment of other personnel, where it is considered necessary to assess whether the employee is capable of undertaking his/her tasks. The employer is also entitled to process personal data on an employees state of health to be able to assess whether the employee has the physical capacity, regarding, for example, sight or hearing, required for the job. Exemptions from the prohibition may also be made for the employer to be able to assess an employees right to benefits, providing, for other benefits than legal, that the employee him/herself has requested this. Implementation of examinations and drug tests The draft law contains provisions aimed at guaranteeing employees that examinations and drug tests will be undertaken using reliable methods. Thus under the draft law, examinations and drug tests may only be carried out by staff within the health and services or under the supervision of such staff. With regard to drug tests, the draft law also stipulates that tests should be analysed by a laboratory authorised under the Technical Conformity Assessment Act. This applies to all kinds of tests that may be used as the basis for an analysis of drug use, with the exception of breathalyser tests. To reduce the risk of a false positive outcome being accepted as the final result, the committee further proposes that tests showing positive results shall undergo a two-stage analysis. During the course of the committee's work, the wish has been expressed by representatives of employers in the public sector for extended possibilities for these employers to require examinations and drug tests. understands that there may be a need for this, but has found that its terms of reference do not allow it to consider such a proposal in this regard. From representatives of trade union organisations the wish has been expressed for a provision equivalent to Section 30 of the Public Employment Act to be introduced into the private sector of the labour market. Here too, it is questionable whether it is within the realm of the committee's terms of reference to propose such examinations by order. In view of this, and also of the fact that the matter in question has not been brought up for discussion at central negotiations, not recently at least, the committee considers that negotiation should be tried first before legislative methods are considered. Personal data on criminal offences As a rule, personal data on criminal offences is particularly sensitive and the processing of such information implies an obvious risk of violation of personal integrity. In addition, it is in the public interest that a person who has served his/her sentence should be able to go on with his/her life, without being discriminated against or treated differently as a result of previous criminality. thus proposes a provision prohibiting the processing by employers of personal data on employees' criminal offences. Exemptions from the law are only proposed for cases in which processing is necessary in order to ascertain an employee's reliability with regard to public security or the security of the employer's operations, which also includes security for other employees and for the work place. Application of this exemption should be extremely restrictive, according to the proposal. It is by no means uncommon for an employer to request extracts from criminal records as a condition for employment. These records are naturally surrounded by strict confidentiality but an individual citizen is always entitled to information on him/herself in the register. According to information from , the number of applications for extracts of records by individual citizens has grown considerably in recent years, which indicates that it has become increasingly common for employers to request extracts from records. Employers today have practically unlimited opportunities to process entirely manually personal data on criminal offences. The proposed provision means that this opportunity will disappear. An employer will thus no longer be able to demand extracts from records, more or less as a matter of routine, as a condition of employment. The provisions in the draft law will also be supplemented by the equivalent provision in Section 21 of the Act, which prohibits the automatic processing, or registration of personal data on criminal offences by any one, apart from authorities. An employee may not consent to processing of personal data on criminal offences neither according to the draft law nor the Act. Personality tests are currently commonly used during the recruitment process. These tests, which aim, inter alia, to reflect the personality and abilities of the person being tested in certain situations can also lead to risks of violations of personal integrity. Tests currently on the market are also of shifting quality and the qualifications of test users may vary. The draft law therefore proposes a provision stipulating that the processing of personal data collected through personality tests may only be carried out with the consent of the employee. This means that the employee maintains control over the information resulting from the test. In order further to reduce the risk for violations of personal integrity, it is also proposed that employers should ensure that personality tests are only undertaken in a satisfactory , using reliable test instruments and performed by persons with adequate training. At the moment, a project on quality and assessment regarding the reliability of test instruments and users is being undertaken at the Swedish foundation psykologi (applied psychology foundation). , which expects the project to conclude with its proposals and recommendations shortly, considers that the proposed provisions should not enter into force before the results of this work are published. The material provisions of the draft law are supplemented by provisions ensuring that the employee has access to and control of the processing of personal data involving him/herself. This refers to the provision previously mentioned, stipulating that when processing personal data on health or criminal offences, the employer must primarily obtain such data from the employee him/herself. This also refers to the provisions on –the storage of personal data, –the employer's obligation to inform the employee of ongoing personal data processing –the obligation of the employer to correct or delete incorrect, incomplete or irrelevant information, and –professional secrecy for those processing or having processed personal data in the private sector. Infringements of the law will incur sanctions and damages. Criminal liability does not apply to entirely manual processing however. The social partners have a central function in all legislation referring to working life, and the committee emphasises that the responsibility and commitment of both these partners will be necessary for the draft law to provide employees and job applicants with the protection of integrity that is intended. The efficiency of the law will be significantly dependent on trade union commitment, both at the central level and locally. In formulating the law, the committee has intended to promote cooperation between the social partners as regards the protection of personal integrity in working life.