The Estonian data protection authority (AKI) reminds the different legal bases applicable to the processing of employees' personal data within the framework of the employment relationship.
Certain processing activities are justified by the necessity to perform the employment contract, notably for managing working time, payroll, or IT access. Others may arise from a legal obligation incumbent on the employer. Legitimate interest may also justify processing, such as protecting the company's assets, provided that a prior written analysis demonstrates its necessity and respect for individuals' rights. The authority specifies that surveillance is prohibited in rest rooms, changing rooms, and toilets. In the absence of another legal basis, the employee's consent is required and must be freely given, without negative consequences on employment.