Data protection in working life

The secrecy of a confidential message is a fundamental right in Finland. This applies to email messaging in workplaces as well. Despite this, the Act on the Protection of Privacy in Working Life provides employers with the possibility to retrieve and open email messages sent to and from work email addresses.

Employers should aim to ensure that there is no need to retrieve and open messages. Because of this, employers must ensure that:

1. employees may inform the senders of any messages via an automatic reply of their absence and its duration and of the person taking care of the tasks belonging to the absent employee, or
2. employees are able to redirect messages to another person approved by the employer or to another address in their own use, or
3. employees may give their consent to another person receiving their messages during their absence to find out whether the employee has been sent a message of which the employer must be informed for the appropriate organization of its operations or tasks.

If the retrieval of email messages still becomes a necessity, the employer has the right to retrieve the messages if:

1. the employee takes care of their tasks independently for the employer and the employer does not have a system with which the affairs taken care of by the employee and their processing phases are recorded or can otherwise be found out,
2. it is apparent, due to the employee’s tasks and pending matters, that messages belonging to the employer have been sent or received,
3. the employee is temporarily unable to perform their tasks and messages belonging to the employer cannot be made available to the employer regardless of the fact that the aforementioned preparedness has been taken care of, and
4. the employee’s consent cannot be obtained within a reasonable period of time and the matter’s clarification cannot be delayed.

The employer may open a retrieved message if it is apparent that it is clearly a message belonging to the employer, the content of which the employer must be informed of to be able to conclude negotiations related to its operations, provide services to customers, or secure its operations. An additional requirement is that the sender or recipient of the message cannot be reached to clarify the content of the message or for its forwarding to an address indicated by the employer. The message may be opened with the help of a person using the access rights of a main user and in the presence of another person.

The opening is subject to an account of it signed by the persons participating in the opening. This account must indicate which message was opened, why the message was opened, the date and time of its opening, the individuals who opened it and the people informed of the content of the message. The account must be delivered to the employee in question without delay. The opened message must be stored and its contents and sender details may not be processed any more extensively than is necessary for the purpose of opening the message, and the individuals processing the data may not disclose the content of the message to third parties during their employment relationship or after it.

Camera surveillance means monitoring in the premises used by the employer that is based on the use of a technical device that transmits or records continuous images.

The legal bases for starting such monitoring include:

1. ensuring the personal safety and security of the employees and other people occupying the premises,
2. the protection of property,
3. monitoring the appropriate functioning of production processes, and
4. the prevention or investigation of situations that may compromise safety, security, property or the production process.

Camera surveillance is prohibited in staff facilities, changing rooms, lavatories and other equivalent premises, and in employees’ personal offices.

Nor may camera surveillance ever be used for monitoring an employee in the workplace.

Camera surveillance may be directed at a particular workstation if such monitoring is necessary:

1. due to an apparent threat of violence related to an employee’s work or the prevention of a factor that causes an apparent threat or risk to their safety or health,
2. for the prevention and investigation of property offences if a material part of the employee’s tasks consists of handling property that is of a substantial value or high quality, such as cash, securities or valuables, or
3. to ensure an employee’s benefits and rights, provided that the camera surveillance is based on a request from the employee to be monitored and the matter has been agreed on between the employer and the employee.

The camera surveillance must be open. This is ensured by investigating the possibility to use other means, less invasive in terms of employees’ privacy, before deploying the surveillance. Nor may employees’ privacy be interfered with any more than is absolutely necessary to achieve the purpose of the measures. The camera surveillance and its execution method must furthermore be indicated in a visible manner.

The recordings resulting from the camera surveillance may only be used for the purposes for which the surveillance is carried out. In derogation from this, a recording may nevertheless be used to prove the grounds for the termination of an employment relationship, to investigate violations of the Act on Equality between Women and Men and the Non-Discrimination Act, and to investigate an occupational safety matter.

The recordings must be deleted as soon as they no longer necessary for serving the purpose of the camera surveillance, and no later than within a year of the end of the recording in question. The “other special reason” mentioned in the Act provides grounds for longer storage.

Drug testing refers to a certificate issued by a health care professional and laboratory designated by the employer stating that the employee has been tested for the use of a drug and containing a report based on the test stating whether the employee has used drugs for non-medicinal purposes in a manner that has impaired their working capacity or functional capacity.

The employer may only process data on the drug testing of employees that are contained in the drug test certificates supplied to the employer by the persons concerned.

In recruitment, employers have a right, based on an applicant’s consent, to process the data when:

1. the applicant is meant to carry out tasks in which special trust is required, in which work will be performed elsewhere than in premises supervised by the employer and in which the performance of duties while under the influence of drugs or while addicted to drugs may cause significant financial loss to a customer of the employer or endanger the customer’s personal safety,
2. the applicant is meant to carry out tasks which, on a permanent basis and to a material degree, include raising, teaching, caring for or otherwise looking after a minor, or other work involving personal interaction with a minor, and no other person is involved, or
3. the applicant is meant to carry out tasks in which there is independent and uncontrolled access to drugs or a more than minor quantity of medicines that could be used for the purposes of intoxication.

Following a recruitment decision, the employer may receive or otherwise process data entered in a drug test certificate, with the consent of the applicant selected for the job, only if the applicant is meant to carry out tasks that require precision, reliability, independent judgment or good ability to react, and if performing the work while under the influence of drugs or while addicted to drugs could:

1. endanger the life, health or occupational safety of the employee or other persons,
2. endanger national defense or national security,
3. endanger traffic safety,
4. increase the risk of significant environmental damage,
5. endanger the protection, usability, integrity and quality of information received while working and thereby cause harm or damage to public interests protected by confidentiality provisions or endanger the protection of privacy or the rights of data subjects, or
6. endanger a trade secret, or cause more than a minor level of financial loss to the employer or the employer’s customer, provided that endangering a trade secret or causing a financial risk could not be prevented by other means.

If the employee’s duties change during the employment relationship in such a way that they meet the preconditions referred to above concerning the employer’s right to process data entered in a drug test certificate, the employee may also be obligated to take a drug test.

Drug testing may also be carried out during an employment relationship. Employers may obligate an employee to present a drug test certificate during their employment relationship if the employer has a justified reason to suspect that the employee is under the influence of drugs at work or that the employee has a drug addiction, and if testing is necessary to establish the employee’s working or functional capacity and the employee carries out work that requires special precision, reliability, independent judgment or good ability to react, and in which the performance of duties while under the influence of drugs or while addicted to drugs:

1. seriously endangers the life, health or occupational safety of the employee or other persons,
2. seriously endangers national defense or national security,
3. seriously endangers traffic safety,
4. could considerably increase the risk of significant environmental damage,
5. seriously endangers the protection, usability, integrity and quality of information received while working and may thereby cause harm or damage to public interests protected by confidentiality provisions or endanger the protection of privacy or the rights of data subjects,
6. endangers a financially significant trade secret, or may cause significant financial loss to the employer or the employer’s customer, provided that endangering a trade secret or causing a financial risk could not be prevented by other means, or
7. could significantly increase the risk of illegal trading in or spread of substances in the possession of the employer.

The employer may set a reasonable time limit for the employee during which the certificate must be presented.

The employer is obligated to bear the costs of the drug testing.