The Hungarian Data Protection Authority (NAIH) recently issued a new guidance on the making and keeping of copies of employees' qualifications to comply with ISO 9001:2015 quality management standards.
While the NAIH is of the view that compliance with ISO 9001:2015 does not entitle the employer to make copies of employees' qualifications, the NAIH has reversed its previous practice and states that employers may make copies of physical documents and employee files that contain personal data, as long as the employer may lawfully process the personal data contained in the relevant documents.
While the Hungarian Labour Code does not generally authorise an employer to make copies of an employee's documents, as an employer - as a general rule - an employer may not oblige an employee to do anything more than merely request the production of such documents. The NAIH's previous practice was in principle not to make copies of employees' files, unless it was necessary to comply with a specific legal obligation [e.g. for payroll purposes]. In addition, the NAIH did not consider the employee's consent to the copying of the employee's records for HR purposes to be lawful, as there were no voluntary conditions attached to the consent; the NAIH also did not consider a simple (scanned) copy to be adequate to ensure the quality of the data and therefore denied that the employer had a prevailing legitimate interest in obtaining a scanned copy, as the NAIH considered that the mere presentation of an identity card or document, the verification of its validity or the employer's recording of this fact and the number of the document was sufficient for this purpose.
Now, in its new guidance, the NAIH argues that making copies of documents is not a new purpose of data processing, but merely a new means of processing the same personal data already processed by the employer. Therefore, the NAIH narrows its interpretation and says that only documents containing personal data that the employer already processes in connection with the establishment and maintenance of the employment relationship with employees can be copied and stored for data quality purposes. Employers may need to redact personal data on copies of documents that they do not have a valid legal basis to process, such as the image of the employee regarding identity cards.
By Adam Liber and Tamas Bereczki, Partners, Provaris
