Communication about an employee’s departure - DPA confirms its earlier position

In a decision of 17 February 2023, the Litigation Chamber of the Data Protection Authority (DPA) confirmed its earlier position that an employer is allowed to inform employees of an employee’s departure. However, the employer must limit itself to what is strictly necessary. In this case, the employer had also notified who the initiating party was and that the employment contract was terminated with immediate effect. This was considered as going beyond what was necessary.  The employer was given a deadline to remove the mentions on the intranet and received a warning to no longer communicate such information to the employees in the future.

Facts

The decision is framed in a dispute between an employee and his former employer, a public institution. The employer published a communication on the intranet stating that the employee’s employment contract was terminated with immediate effect and on the employer’s initiative.

Within the relevant company, it was indeed standard that staff changes were published on the intranet. Each time, in addition to the employee’s date of joining or leaving the company, it was also stated on whose initiative the employment contract was terminated.

The employee blamed the employer that this communication made it appear that the employment contract was terminated because of a serious breach by the employee and considered that the employer committed as a result thereof a breach of data protection law.

Decision of the DPA: legality and minimum data processing

According to the DPA, when assessing this case, one should make a distinction between the announcement of an employee’s departure as such and the additional information related to the initiating party and the immediate nature of the termination.

Legality

The DPA first checked whether the publication on the intranet of the termination of the employee’s employment contract with the indication of the initiating party and its immediate nature is necessary for the fulfilment of a task of public interest (given that it is a public institution) or necessary for the performance of a contract.

The DPA, referring to the case-law of the Court of Justice, argued that these mentions were not necessary for the performance of a task of public interest and that the mere mention of the end of the employment contract as well as the date on which the employment contract had ended was sufficient. It is noteworthy that the DPA considers that these mentions should be considered sensitive personal data, as these mentions would make it appear with a high degree of probability that the employer had terminated the employment contract because of a serious breach on the part of the employee.

In assessing whether the announcement of staff changes on the intranet is necessary for the performance of a contract, the DPA reiterated that this publication took place in the context of the end of the employment relationship between the employer and the employee. Referring to its previous decision 63/2021 of 19 May 2022, it argued that it is indeed appropriate in the context of a staff policy to inform employees of staff changes. Hence, the mere announcement of staff changes can be considered necessary for the performance of the employment contract.

In contrast, the DPA took a different view regarding the mentions of on whose initiative the employment contract was terminated and its immediate nature. Thus, the employer cannot claim that these mentions are necessary for the performance of the employment contract.

Given that there is thus no valid legal ground, the DPA concluded that the employer had thus committed a breach as to the legality of processing personal data.

Minimum data processing

In addition, the DPA ruled that communication regarding an employee’s departure should also respect the principle of minimum data processing. The information communicated to employees should be limited to what is strictly necessary to pursue an appropriate staff policy.

The mere announcement of the termination of an employee’s employment contract is accepted by the DPA. However, the mentions of on whose initiative the employment contract was terminated and that the employment contract was terminated with immediate effect, are, according to the DPA, not strictly necessary to inform the employees about the changes in the workforce, which led the employer to breach the principle of minimum data processing.

DPA sanction: removal order and warning

The DPA ordered the employer to remove from the intranet the mentions on whose initiative the employment contract was terminated and that the employment contract was terminated with immediate effect and issued a warning to refrain from sharing such information on the intranet in the future.

Action point

Taking into account these recent decisions of the Litigation Chamber, any communication surrounding the termination of an employee’s employment contract should be limited to what is effectively necessary. Mentions of the initiating party, the immediate nature of the termination and other details regarding the circumstances of the termination of the employment contract should therefore be omitted in the communication to employees. This thus constitutes an additional point to be taken into account when dealing with employees’ departures.