Data protection authorities regularly make key points of their topics available to the public in their activity reports. Among other things, the Saxon authority addresses the topic of how to deal with verbal statements in the employment context from a data protection perspective. In particular, the assessment covers special category data in accordance with Art. 9 GDPR, for example data relating to illnesses.
Statements on such topics can ultimately constitute a breach of data protection law, although this also depends heavily on the group of addressees and the person making the statement.
In principle, verbal communication about this data constitutes processing of personal data in accordance with Art. 4 of the GDPR. However, the scope of application does not apply to every internal communication.
A distinction must be made between two scenarios.
If colleagues talk to each other in a purely private setting about corresponding data of other colleagues, the Saxon Data Protection and Transparency Officer is of the opinion that this is a case that lies outside the scope of the GDPR. Art. 2 para. 2 lit. c GDPR applies here, which states that the regulation does not apply to exclusively personal activities. However, the situation is different if the employer itself communicates through personnel entrusted with personnel administration.
Their conduct is actively attributable to the employer, meaning that the GDPR applies.
In this specific case, this means that the management level and HR department in particular must pay special attention to which data is shared in which context. In any case, the lawfulness of the processing must be ensured in order to prevent a data protection incident from occurring. Verbal communication in particular, which is usually quicker and less deliberate than written communication, should therefore be carefully considered.
Communication about colleagues should therefore be carefully considered, especially in the relevant departments. This is because, in addition to data protection issues, there may also be consequences under employment law.