Phase
Employment Contracts Act; Personal Data Protection Act
Native name
Töölepingu seadus; Isikuandmete kaitse seadus
Type
Employee monitoring and surveillance
Added to database
16 October 2023

Article

Personal Data Protection Act Chapter 2 Employment Contracts Act Chapter 2, section 11 - data collection of a potential employment Employment Contracts Act Chapter 3, Division 2, section 28(2)11) - Employer's obligation to respect employee's privacy Employment Contracts Act Chapter 3, Division 2, section 41


Description

An employer will always possess an employee’s personal and work-related data, but there are regulations to the usage of that data. Trust and mutual understanding provides a foundation to a good employment relationship. This puts the principle of data processing with the knowledge of the employee in high importance. In legal terms, an employer must ensure the processing of personal data of an employee in accordance with the Personal Data Protection Act. Personal data are any data concerning an identified or identifiable natural person, regardless of the form or format in which such data exist.

The Employment Contracts Act obliges employers to respect employee privacy and control fulfilment of job tasks without unnecessary measures. Employers have the right to process employee data without employees' consent as long as it is necessary to fill employment contract and work arrangements rules at the workplace. This data however, must be collected only in legal and fair ways. At the same time, employees have the right to ask and receive information on what kind and on what purpose is information collected on them and who has access to that data (Personal Data Protection Act). An employee also has a right to demand a change or removal of false information collected about them. The data of an employee can only be processed if they have been given an opportunity to give consent which can also be withdrawn at any moment. If an employee withdraws their consent, the employer has to stop processing that data.

In addition, the employer does not have the right to carry out couvert surveillance on their employees. If there are cameras used in the office, all employees need to have knowledge of that, which needs to be clear and unambiguous. In the case of privacy violation due to collection of data, the subject can demand compensation. Surveillance cameras can only be used for the protection of people and property, not for collecting data on the quality and quantity of the work carried out by the employees. The employer has no right to collect data of the employees outside of working hours and must provide access to the materials (including recordings) at all times if the employee finds it necessary.

However, if the employee uses computers or other devices provided by the workplace, the data collected from there can be used without consent, but this should be specifically mentioned in the work contract. Also, the employer has a right to prohibit the use of work computers or other devices for personal use but this should again be stated in the work contract.


Commentary

The processing and protection of an employee's private information has been the main area of concern for the Data Protection Inspectorate in Estonia. In the case of unavoidable data processing due to the contract or the law, the lines for asking for consent get very blurry. For example, processing data about an employee's child for childcare leave purposes does not require consent, even if the child is a minor. For further processing of the data related to the employee's children, consent is required.

In addition, due to increased demand for telework due to the COVID-19 pandemic, the relation to monitoring at work has also changed. In many cases the employers started to use extra monitoring tools for employees working from home to control their working activity and productivity. In most cases automatic, AI related tools were used, which is often failing to identify between personal and work-related data while collecting. Also, even though the pandemic has ended, many companies have continued to use the surveillance tools, which still leave ambiguous situations in relation to the Data Protection Act.

Overall, there is currently very little data collected on this topic in Estonia. In the case of privacy invasion or other guideline violation, the Labour Inspectorate should be contacted and they will look at every case separately.


Additional metadata

Cost covered by
Not available
Involved actors other than national government
Public employment service
Involvement (others)
None
Thresholds
Affected employees: No, applicable in all circumstances
Company size: No, applicable in all circumstances
Additional information: No, applicable in all circumstances

Citation

Eurofound (2023), Estonia: Employee monitoring and surveillance, Restructuring legislation database, Dublin, https://apps.eurofound.europa.eu/legislationdb/employee-monitoring-and-surveillance/estonia

Download as PDF