Processing of workers’ and employees’ personal data – is the labour medicine service a data controller?

Abstract

The objective of this article is to establish whether the Labour Medicine Service processes the personal data of the workers and employees of its clients as a data controller or as a data processor. Since the relations between the employerand the Labour Medicine Service form the subject matter of a detailed legal regulation, the capacity of the Service cannot be determined on the grounds of the general rule that the data controller identifi es the purposes and means of data processing. An analysis is made of the criteria used in the practice of the Personal Data Protection Commission (PDPC) when defining an organisa tion as an independent data controller. The juxta po si tion of these criteria against the organisation of the Labour Medicine Service shows that the latter should be defined as an independent data controller. The same conclusion is applicable to the criteria used by the Working Party dealing with Art. 29 of Directive 95/46/ЕC1 (WP29) as well. Consideration is also given to the question of whether the employer and the Labour Medicine Service carry out the processing of workers’ and employees’ data under the conditions of joint admi nistration. The totally independent purpo ses for the achievement of which the employer and the Labour Medicine Service perform the activities of processing determine the nega tive answer to the question of joint administration.