Processing the personal data of workers and employees – is the occupational health service a processor?

Abstract

The study deals with the role (an administrator, a processor, a joint administrator) of the occupational health service from the viewpoint of the personal data of the workers and employees of an employer with whom the service has entered into a contract. The supervisory body, the judicial practice and the legal literature define the occupational health service as an administrator (Supreme Administrative Court) and as a processor (Commission on Personal Data Protection and the Legal Doctrine). Neither the Commission on Personal Data Protection nor the legal literature base their assertions on a thorough analysis of the relations between the employer and the occupational health service. The Commission defines a criterion for distinction (the capability of independent performance of the activity assigned), which should not be applied on its own as that brings about a wrong definition of the arrangement. The legal literature points out the relations between the employer and the occupational health service as an example of relations between an administrator and a processor, but gives no arguments as to why the occupational health service is defined as a processor. Attention is drawn to the need for independent consideration of the question of whether the occupational health service is an independent administrator or an administrator acting jointly with the employer.