New provisions for the Act for Protection of Privacy in Working Life: Regulating on what grounds an employer has the right to process personal credit data concerning an employee or a job applicant to asses the reliability of the person
In the Act for the Protection of Privacy in Working Life (759/2004) there have been only general requirements for processing employees’ personal data, the most important of which has been the general necessity requirement. According to this the employer is allowed to process employee’s personal data only to the extent it is directly necessary for the employment relationship. There have been special provisions on processing certain kinds of employee’s personal data, such as employee’s health information, but only now the proposal for a specific provision on personal credit information has been passed by the Parliament of Finland.
After 1st of September 2008 there will be special provisions on the employer’s right to process employee’s personal credit data. The provision states that the employer can process only data concerning a person already hired, thus the amended act will preclude the employer’s right to process credit data of job applicants not yet appointed.
The credit data processing provision will also limit situations in which the employer can obtain employee’s personal credit data. The employer can only receive employee’s personal credit data if the employee is appointed to a position which requires particular credibility and the position includes some other elements expressly described in the act. For example, the employee’s position includes decision-making power on behalf of the employer to make significant commercial commitments or actual deliberation-power to prepare such commitments.
At the same time, a new provision has been added sanctioning infringements of the provision stipulating processing of employee’s credit information of the Act for the Protection of Privacy in Working Life. The employer can be liable to pay a fine when committing the violation deliberately or by gross negligence.
Effect on employers
Employers can after 1st of September obtain personal credit data concerning an employee only in specific situations stipulated by law. The employer can also be sanctioned by way of a fine for violating some provisions of the Act for the Protection of Privacy in Working Life.