The controversy generated as a result of the decision of the Spanish Data Protection Agency (AEPD) to file the claim of a worker whom the company had included in a WhatsApp group without his consent has led the public body to clarify the assumptions in which a company can use the private telephone of a worker for this purpose. In response to a request to clarify his position, the agency recalls that "no regulation requires" that the worker have to provide his private email and telephone number to the employer. However, there are some cases in which it would be allowed.
Therefore, as explained by Gonzalo Oliver, legal adviser on privacy, data protection and cybersecurity at Ozonia Consultores, it is established "that the employment contract does not legitimize that employers can use workers' personal phones to create WhatsApp groups indiscriminately." And he maintains that this latest report "gives legal certainty" to data protection delegates when advising those responsible for data processing.
In its previous letter, the public body stated that a Madrid logistics company had created two groups in the instant messaging application in which a worker had been included without his consent. The AEPD based its decision to file the lawsuit on article 6 of the General Data Protection Regulation, which details the rules that must govern the processing of personal data.
In response to this article, it argued that "in the field of labor relations, the processing of personal data is legally based, mainly, on the execution of the employment contract." And it added that in this specific case the data being processed was "the minimum necessary for the organization of work" and that the company had informed the workers of the purpose of their processing in WhatsApp groups.
Several data protection specialists criticized the agency for not clarifying in that controversial resolution whether the mobile phone referred to in the lawsuit was private or corporate. If it were a private motive, the resolution of the AEPD would have contradicted current labor legislation.
In this sense, the agency clarifies that in the event that the provision of services is made outside the workplace or working hours, the company must make a company telephone available to the worker. However, you can also use your private mobile phone and email as long as the worker gives his voluntary consent, which he can revoke later if he wishes. "If the worker does not provide it, he cannot be penalized or undermined or fired," explains Oliver.
The AEPD adds that data such as address, email address, telephone number (landline or mobile) or bank account are considered personal. However, "it seems necessary" in general that the employer have some means of communication with the workers for the execution of the employment contract, "and it is essential that the worker provide" some means of contact. "For example, "to notify overtime, low, high or vacation", Oliver clarifies.
However, the employment relationship "does not legitimize the company to request all this data from the worker." For this, it will be necessary to analyze in each case "the alleged legal basis", which could be the employment contract, the consent or legitimate interest of the employer, the intended purpose and the data processed", reads the AEPD report. .
Finally, remember that, regardless of whether the mobile phone included in the WhatsApp group is corporate or private, the worker has the right to digital disconnection in the workplace, as stated in Organic Law 3/2018.
