Jobs In Egypt / HRM / What Is The Employer Allowed To Do With Personal Data?


For the vast majority of personnel data, these can be used within the framework of HR Analytics, provided they are processed carefully and according to the regulations. The following principles apply here.

Every employee can expect an employer to process data in accordance with the law and in a proper and careful manner. The employer and the employee are obliged to behave like a good employer and a good employee. Article 7: 611 Civil Code The law determines which personal data may be collected and used, by whom and under what conditions. Article 10 paragraph 2 Constitution The law lays down rules on individuals' claims to the collection of data recorded about them and the use made of them, as well as on the improvement of those data. Article 10 paragraph 3 Constitution The entrepreneur requires the approval of the works council for any decision it has made to adopt, amend or revoke a regulation concerning the processing of and the protection of the personal data of the persons working in the company. Article 27 paragraph 1 sub k Works Council Act (WOR)

What does this mean in practice for the use of personnel information systems?

The basic principle is that every employer may use its personnel information systems in the context of HR analytics, provided that the purpose of this is compatible with the purpose for which the data are included in the relevant systems.

To be able to speak of compatibility, attention must be paid to:
- the nature of the data (what kind of data is involved?);
- the purpose for which the data were initially collected;
- the guarantees that the organization has taken into account in order to protect the interests of the employee (eg anonymizing the data or limiting the access rights).
- For example, salary data may be used to analyze historical trends in salary development within the organization. Data about the age and gender of employees may be used to map development opportunities. The provision of personal data to an external party for data analysis is in principle also covered by this freedom. If employer is allowed to apply data analysis, he may also have this done by an external party. Aggregated reporting of data is in principle permitted, for example by aggregating them to group level prior to reporting. For this purpose, groups of at least ten employees are sufficient, although the AP groups from five people may find it acceptable. Also linking data from personnel information systems with other data - for example customer reviews - is permitted,

Use that is only permitted with a legitimate interest

In certain cases permission from the person (s) is crucial. For example, an employer may not simply collect personal data from internet sources or social media such as LinkedIn, Facebook or Twitter. After all, those data were not (explicitly) made public by the parties involved with the aim of being used by employers, for example in the context of HR analytics. If an employer wishes to process such data, he must have a legitimate interest that weighs heavier than the interests of (future) employees. The data must also be 'necessary' for that interest.

Never use in principle

Then there are the special personal data, which contain information about:
- a person's race or ethnicity;
- political views;
- religious or philosophical beliefs;
- membership of a trade union;
- genetic properties;
- biometric characteristics (used to uniquely identify people);
- health;
- sexual behavior or sexual orientation.

Strict conditions apply to the processing thereof. Apart from the cases where processing is legally prescribed, most employers will not be able to obtain permission in practice. For permission for positive discrimination, permission is not required again, which can be relevant in an HR context.

Consent of works council

The employer usually requires the consent of the works council for the processing of personnel data. Furthermore, he must be transparent to the employees about the use of the data. This is possible, among other things, by drawing up a privacy statement.

Questions or complaints from employees

Employees with questions or complaints about the processing of personal data can best contact the management first. Or to the Data Processing Officer, if the rules prescribe that the organization appoints it. He can act as an ombudsman at the organizational level. Separately, the employee always has the opportunity to go to court or involve the AP. The latter can ex officio or upon request start an investigation and coercion ('burden under penalty').

Back to Top