Data Protection Impact Assessments: a union guide
Technology is transforming the way we are managed and work. During the COVID-19 pandemic we have seen growing interest in the use of digital technology to support remote work. But we have also seen a worrying trend in digital monitoring.
The move to remote working has led to a greater use of digital platforms – with more of us using new platforms such as Zoom, Slack, Whatsapp, or other digital software. One in five employers are now using some form of digital monitoring or are planning to do so.
The use of our personal data at work is covered by GDPR. When employers introduce a different way of using our data that could present high risks to our rights and freedoms or produce significant affects to us, they need to conduct a Data Protection Impact Assessment (DPIA).
Our new guide to DPIAs provides a worker perspective to help unions ensure that members are involved, consulted and part of any changes in how our data is used at work. Download the guide.
GDPR
GDPR rules were incorporated into UK law by the Data Protection Act 2018 to provide a framework for considering workers’ views when new data processes are introduced. The rules provide scope to:
- check if an employer is fulfilling their obligations under the law
- ensure that the union is appropriately informed and involved as representative of its members
- provide visible evidence on what data is being collected, how and why.
This is our data
The systematic collection of workers’ data presents an inherent high-risk to individual employees as it could affect or impact on the employment relationship. This could include the risks of:
- loss of data or poor security in how employers collect, store and use the data
- damage to workers standing or reputation
- material damage through decisions made using the data, such as promotion opportunities, pay or performance management
- discrimination based on decisions made using the data.
Prospect has worked with a number of data and privacy specialists to produce our DPIA guide for union representatives.
Commenting on the guide, Anna Thomas, from the Institute for the Future of Work, said:
“It is hugely important that workers have access and control over their personal data, especially when it is collected at work and used to determine fundamental terms and conditions of work. Implementing data rights and processing safeguards under the Data Protection Act is a key step to achieve this goal.
“We are proud to have supported this excellent, practical guide for all UK Unions, in parallel with our recommendations for boosted individual and collective rights in the future.”
This guide is to help representatives ensure that meaningful consultation happens on a regular basis.