The Hellenic Data Protection Authority (HDPA) recently imposed its first GDPR fine on PwC due to the fact that it unlawfully processed the personal data of its employees.

It is worth noting that PwC's employees had consented in writing to the processing of their personal data. However, it was held by the HDPA that employees' consent could not be regarded as having been freely given due to the clear imbalance between the parties. It follows that consent is not an appropriate legal basis to process employees' personal data.

Instead, legitimate bases for processing employees' personal data could include:

i) carrying out acts directly linked to the performance of employment contracts;

ii) compliance with a legal obligation to which the employer is subject; and

iii) the smooth and effective operation of the employer, as its legitimate interest.

Additional safeguards in the context of an employer-employee relationship that may be useful in demonstrating compliance with the GDPR:

i) the legal basis for processing of personal data must be set out in plain terms and in a form other than the employment contract. Moreover, requiring an employee to acknowledge the lawfulness of processing may well be counter-intuitive;

ii) elaborating on the type of data to be collected, the duration for which each type of data will be held and employees' rights, including their right to withdraw consent and the 'right to be forgotten';

iii) summarily informing the employees of the technical and organisational measures the employer has taken to ensure compliance with the GDPR; 

iv) ensuring that it is necessary and proportionate to forward specific types of employees' personal data to third parties. Legitimate receivers of personal data could include public authorities and parties with whom the employer has a continuing and existing business relationship with; and

v) informing employees whether personal data will be disclosed to third parties and, if so, the types or categories of these third parties.