Download article in original language : FI0106191FFI.DOC
In June 2001, Finland adopted a new Act on Protection of Privacy in Working Life, regulating issues such as the testing of employees, the handling of information concerning their health, and rules on monitoring the workforce. A basic principle is that the employer is permitted to collect only information relevant to the employment relationship. The legislation should come into force in October 2001.
June 2001 saw the adoption of a new Act on the Protection of Privacy in Working Life, following lengthy preparation and disputes. The Act specifies the kind of personal information an employer can collect concerning an employee, and contains provisions on procedures for collecting such information, intended to ensure that the privacy of the employee is safeguarded. The preparation of the Act started in 1997, when a tripartite working group was set up. Following a unanimous recommendation from the group, the government's subsequent proposal was submitted to parliament in September 1998, but was rejected. Nevertheless, parliament required that a new proposal be made, and this has now been adopted. The new Act supplements the existing Personal Data Act, which will be applied together with it. It is scheduled to come into force in October 2001.
The new Act applies to employment relationships in the private and public sectors, or any employment relationship comparable to these. It also applies to job applicants. The Act applies only to the relationship between employer and employee.
When making personality and suitability assessments, the employer is obliged to ensure the reliability of the tests used, the expertise of the testers and the correctness of the test results. Employers have no right to require an employee to submit to genetic examination, nor do they have a right to know whether the employee has undergone such an examination.
The right of an employer to handle information on an employee's state of health is based on the employee's approval and, in addition, may cover only issues demarcated by law - such as payment of sick pay, investigation of the reason for an employee's absence, and whether the employees concerned specifically want their ability to work to be clarified on the basis of information concerning their state of health. When alcohol or drug tests are to be conducted, the employer must always use professional healthcare personnel or services for this purpose. However, the legislation does not prescribe the grounds on which an employer would be permitted to oblige employees to undergo a drug test.
A central provision of the Act is that the employer is entitled to process personal data only in cases where this is directly necessary for the observation of the rights and obligations of the parties to the employment relationship, or if such processing is related to the employee benefits provided by the employer, or connected with the special nature of the work duties. There can be no exemption from this "necessity requirement", even with the consent of the employee. The employer is obliged to collect such personal data primarily from the person in question. If the employer collects personal data from elsewhere, this must be done with the consent of the employee. The duty of disclosure and the right of employees to check the information concerning themselves are regulated mainly according to the Personal Data Act already in force.
The use of e-mail and computer networks, and the purpose of any technical monitoring of employees - as well as the implementation of such monitoring and the methods used - are also governed by the Cooperation Act, which sets out the participation rights of employees and their representatives. Associated changes to the Cooperation Act will thus come into force at the same time as the new privacy Act. The employer must thus specify the purpose of the monitoring and the measures to be taken, and must inform the personnel concerning them. The legislation does not create rights in connection with the monitoring (which are regulated under other legislation), but rather it assumes that the procedures and rules will be arranged at the workplace.
The new Act also stipulates that the employer, in the use of e-mail and computer networks, must not endanger the secrecy of messages characterised as private and confidential. However, this provision was not considered sufficient by parliament, which required the government to prepare further legislation on what kind of technical supervision employers should be permitted to carry out and how the use of e-mail could be controlled.
The Act covers employees, civil servants and job seekers. As an Act of industrial law, its enforcement is overseen by the data protection ombudsman and the industrial safety authorities.
The employers' organisations regard positively the fact that the deliberation over the Act has finally come to an end. In their view, the outstanding issues concerning drug tests and e-mails can be settled satisfactorily on the basis of the existing legislation and the new Act. The trade unions state that the most important contribution of the Act from their point of view is that the employer is permitted to collect only information relevant to the employment relationship.
The Act on the Protection of Privacy in Working Life is a notable milestone in the definition of "rules of the game" for working life. It recognises that the need to collect personal data is one aspect of an employer's activities, while at the same time, with regard to privacy at the workplace, giving job applicants, employees and civil servants an extensive right to know about and decide on the processing of their personal data and to be aware of its contents. They also now have the right to be assessed on the basis of accurate personal data.
The legislative process has been long and awkward, but it has now reached its conclusion. Central to the new legislation is the fact that it requires the use of professionals in the testing of employees. So far, the methods used in employee testing in Finland have been many and varied, and even in some cases clearly offensive to the employees. According to the Act, employers now have an obligation to check the reliability of the test methods, the expertise of the testers and the accuracy of the test results. Genetic testing is prohibited under all circumstances.
Since drugs have become a severe problem, it is most likely that specific legislation concerning drug testing at workplaces will be enacted in future. The same applies also to the control of e-mail use and to data security, which are becoming so complicated that the present legislation is not sufficient for this purpose. (Juha Hietanen, Ministry of Labour)