A supervisor's data protection duty: what may be collected, viewed and asked about an employee

In brief

The processing of employees' personal data is governed not only by the GDPR but by Finland's Act on the Protection of Privacy in Working Life (759/2004), whose core is the necessity requirement: the employer may process only data directly necessary for the employment relationship, and the employee's consent does not widen it. The act separately regulates health data, aptitude tests, camera surveillance and the retrieval and opening of emails belonging to the employer. In practice these rules are applied by the supervisor: they recruit, induct, handle absences and decide what data about their team they look at. A supervisor's data protection competence is therefore a skill of its own, distinct from all-staff basics.

Necessity that cannot be contracted away

Section 3 of the act says the employer may process only personal data directly necessary for the employee's employment relationship, relating to the management of the parties' rights and obligations, benefits provided by the employer or the special nature of the work. The second sentence is what sets working life apart from other data protection: the necessity requirement cannot be derogated from by the employee's consent.

This means a supervisor cannot ask about family plans in recruitment even if the applicant would answer voluntarily, nor collect data about their team unrelated to the work even if everyone agreed. The question is not whether one may ask, but whether the data is necessary for the employment relationship. At level 2 of our skills catalogue a supervisor processes team members' data only to the extent necessary and in the right systems; the latter means team data is not kept in a personal spreadsheet or on a phone.

Under section 4, data is collected primarily from the employee. Collecting it elsewhere requires the employee's consent, except where an authority discloses it for a statutory task or where collection is separately provided for by law, as with security clearances and checking the criminal background of people working with children. The employee must be told in advance of checks on their reliability, and told of data collected elsewhere before it is used in a decision about them. The collection of personal data at recruitment and during employment is dealt with in the cooperation procedure.

Health data and tests

Section 5 limits the processing of health data. The employer may process it if it was collected from the employee or, with the employee's written consent, elsewhere, and processing is necessary to pay sick pay or an equivalent benefit, to establish whether an absence is justified, or because the employee expressly wants their fitness for work assessed. Only those who prepare, make or implement decisions on the employment relationship on the basis of the data may process it, and the employer must designate these persons or tasks. They may not disclose the data to outsiders during or after the employment.

Health data is kept separate from other personal data. It is deleted immediately when there is no longer a basis for processing, and the basis and need are reviewed at least every five years. For a supervisor this means a medical certificate travels a designated route and does not stay in their inbox, and a diagnosis is not told to the team even if everyone could guess it.

Under section 13, personality and aptitude assessments may be carried out with the employee's consent to establish the prerequisites for the work or the need for training and development. The employer must ensure the methods are reliable, the assessors competent and the results accurate, and the employee has the right to a free written statement, or an account of the content of an oral one.

Camera surveillance

Section 16 allows camera surveillance on the employer's premises to ensure personal safety, protect property, monitor production processes and prevent or investigate situations that threaten these. It may not be used to monitor a particular employee or employees, and there may be none in toilets, changing rooms, other staff facilities or an employee's personal office. Surveillance may be targeted at a specific workstation only where necessary to prevent an evident threat of violence, to prevent crimes against property where the employee handles significant assets, or at the employee's own request to protect their interests.

Section 17 provides for openness: before introduction, less intrusive means are examined; privacy is not interfered with more than necessary; recordings are used only for the purposes of the surveillance; employees are informed after the cooperation or consultation procedure; and the premises carry a visible notice. Recordings are destroyed as soon as they are no longer needed, and as a rule at the latest one year after recording ended. Retention beyond a year is allowed where a matter that came up for investigation within that period is still open, where the recording is needed to prove that ending the employment was proper, or for another special reason. A recording may be used to establish grounds for ending employment, to investigate harassment or a workplace accident, under the conditions the act sets.

Situation	What the act allows	What it requires
Recruitment	Data necessary for the work, from the applicant	Consent for other sources; advance notice of reliability checks
Sick leave	Processing of the certificate by designated persons	Separate storage, deletion when the basis lapses, review every five years
Aptitude test	Testing with the employee's consent	A reliable method, a written statement on request
Camera surveillance	Safety, property, production process	Cooperation, information, a visible notice, destruction as a rule within a year
An absent employee's email	Retrieval and opening of messages belonging to the employer	The statutory conditions, an administrator, another person present, a signed record to the employee

An absent employee's email

Sections 19 and 20 are the ones a supervisor runs into when an employee falls ill in the middle of a customer negotiation. With the help of a person holding administrator rights, the employer may establish from sender, recipient and subject data whether the employee has received or sent messages belonging to the employer that it is necessary to know about to conclude negotiations, serve customers or secure operations. The conditions are that the employee handles tasks independently and there is no system showing them; that messages have evidently arrived; that the employee is temporarily prevented from working and the messages cannot be obtained even though the employer has met its duties under section 18, that is, given the employee the means for an absence notice and for redirecting messages; and that consent cannot be obtained within a reasonable time and the matter cannot wait.

Opening a message is a separate step. It is allowed if, from the subject or party data, it is evident that the message clearly belongs to the employer and its content is necessary, and the sender or recipient cannot be reached. Opening is done with the administrator's help in the presence of another person. For both retrieval and opening, a record signed by those involved is drawn up stating the reason, the time, who carried it out and, for an opened message, who was told its content, and the record is delivered to the employee without undue delay.

A supervisor therefore does not read an absent team member's mail on their own initiative. If the employee has agreed under section 18 that someone else receives their messages, or has consented to another arrangement, that arrangement is followed. Otherwise the statutory procedure is requested, and the procedure leaves a trace the employee sees.

What this requires of supervisors and HR

Our skills catalogue describes the supervisor's and HR's data protection duty at four levels. Everyone knows that only data necessary for the employment relationship may be collected about an employee. A supervisor processes team members' data only to the extent necessary and in the right systems. A unit head is responsible for the data protection practices of recruitment, induction and ending employment, and for the team's access rights. HR and management define the practices of working-life data protection, the conditions for technical monitoring and the cooperation procedure.

This is different competence from the all-staff data protection basics covered in What data protection competence is required of every employee?. A supervisor needs both. When an employee asks for their own data, including what the supervisor has recorded about them, the GDPR's right of access applies, described in Data subject rights. And as pay data becomes more transparent, that is a chapter of its own, which the library covers in a separate course.

What the act does not forbid

The act does not forbid a supervisor from managing. Monitoring work results, working hours and tasks is data necessary for the employment relationship, and it may be processed. The act does not forbid asking an employee about their own situation when the question relates to the work. It does not forbid camera surveillance or retrieving an absent employee's mail; it regulates how they are done. A supervisor's data protection duty is not a list of prohibitions but a way of doing the same things so that the employee knows what is collected about them and why.