In the context of the organisation of the next social elections, the employer is required to process a large amount of personal data. This concerns in particular the personal data contained in the following lists:
- the list of names of the members of the management staff;
- (if applicable) the list of names of the executives;
- the electoral rolls, which mention for each voter the surname, first names, date of birth, start date of employment and place of employment in the company;
- the lists of candidates, which mention for each candidate the surname and first name of each candidate, followed by the letter M or F, depending on whether he or she is a candidate;
- the lists of names of the witnesses.
The processing of those data must comply with the provisions of the General Data Protection Regulation of the European Parliament and of the Council of 27 April 2016 (GDPR).
What should you do in practice?
Register of processing activities
As the controller, the employer is obliged to include in the register of processing activities the processing of personal data carried out in the context of social elections.
In practice, the employer must complete the existing register by indicating:
- the processing purpose;
- the categories of personal data;
- the categories of persons concerned;
- the categories of the recipients to whom the personal data have been or will be disclosed;
- the period during which the data will be stored;
- (if applicable) the transfer of data to third countries.
Our legal team helps you to meet this obligation by providing you with a table containing this information.
Messages containing personal data
During the pre-electoral process, various messages containing personal data are communicated to the employees in particular.
The FPS Employment, Labour and Social Dialogue recommends including the legal processing basis in these messages.
In practice and for the message that is displayed on day X, for example, it is advisable to indicate the following: "These data are published as part of the information obligation provided for in Article 14 of the Social elections Act of 4 December 2007. As this notice contains personal data, the General Data Protection Regulation of 27 April 2016 (known as GDPR) applies. The company processes personal data only for the purpose for which they were collected and for as long as necessary.”
During the procedure, the electoral rolls must be made available to the employees at a location within the company that is accessible to them.
The electoral rolls can be made available electronically, as long as all employees have access to them during their normal working hours.
As the controller, the employer must take appropriate technical and organisational measures to ensure an appropriate level of security.
According to the Data Protection Authority, the electronic provision of the electoral rolls should take place:
- not by e-mail or through an open publication on the company's website;
- but on a closed platform or an intranet secured by the employer and only accessible to the employees.
In practice, it is possible to send an e-mail to the employees containing a link to this type of platform or intranet, as long as only the employees have access to it.
Sources: Social elections Act of 4 December 2007; European Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC; www.emploi.belgique.be; Advice No 156/2018 of 19 December 2018 of the Data Protection Authority.