Case Studies Purpose Limitation
Processing employee’s personal data from their private email account/emails for disciplinary purposes
Two individuals were employed by an organisation that provides services to primary schools. Upon arrival at work, one individual found their personal email account open on their shared computer. A few weeks later, the individual’s employment was terminated on foot of disciplinary proceedings. During the course of the proceedings, the individual was presented with printed copies of several emails from their personal email account. The second individual was also dismissed. It became apparent that a third party had been hired by the organisation to handle the disciplinary proceedings and this third party was provided with a copy of both individual’s emails addressed to each other.
See More InformationProcessing of Special Category Data
This complaint concerned the processing of the complainant’s personal data (in this case, details about the nature of the complainant’s medical condition) by his employer, for the purpose of administering the complainant’s sick leave and related payments. In particular, the complainant raised concerns regarding the sharing of his medical records by the data controller (the employer), including with staff at the local office of the data controller where the complainant worked. The complainant highlighted his concerns to a senior official in the organisation. However, the view of the senior official was that the minimum amount of information necessary had been shared.
See More InformationUse of CCTV in the workplace
We received a complaint that concerned the use of CCTV cameras by the data controller in the complainant’s work premises, and the viewing of that CCTV footage (which contained personal data of the complainant, consisting of, among other things, images of the complainant) for the purpose of monitoring the complainant’s performance in the course of his employment with the data controller.
See More Information