Employers need to process employees’ personal data, which is necessary for background checks, credit checks, and so on. To do this, they must obtain the employee’s consent, as it is the only basis for processing personal data under the DPDPA. Getting this consent is a complex process. However, if obtained correctly, there is no obstacle to processing the employee’s personal data.
-
What is the challenge in getting employee consent?
Consent under the DPDPA is valid only if it is:
=> free => specific => informed => unconditional
=> unambiguous => signified with a clear affirmative action
Most of these requirements can be managed by a carefully crafted employment contract. However, the requirement of free consent remains a challenge. To understand what free consent means, we can look to the Indian Contract Act.
The Contract Act explains when consent is considered freely given. For employers, the key factor is undue influence. For consent to be free, there must be no undue influence over the person giving consent.
Undue influence occurs when one party has power over the other and uses it to gain an unfair advantage.
The Act clarifies that a person has power over another when they are in a position of authority.
While a contract with the employer will not be invalid just because of this, if it is deemed unfair and evidence is provided, the burden of proof shifts to the employer.
The European Data Board’s guidance suggests that in an employment context, it is better for employers not to rely on consent for processing personal data. Instead, they should use one of the other six legal bases.
-
What can be done?
Getting free consent is tricky. The key is to ensure the contract is not unfairly in favour of the employer. This means having reasonable data retention periods, following the data minimisation principle, and so on.
The DPDPA also provides guidance on “certain legitimate uses” in an employment context, such as: => the purpose of employment => safeguarding the employer from loss or liability => preventing corporate espionage => maintaining confidentiality of trade secrets, intellectual property, and classified information providing a service or benefit requested by the employee
Employers must keep these factors in mind when obtaining employee consent for processing their personal data.