{"id":5793,"date":"2023-04-25T14:22:31","date_gmt":"2023-04-25T14:22:31","guid":{"rendered":"https:\/\/exciting-panini.13-37-234-21.plesk.page\/?p=5793"},"modified":"2024-08-06T10:19:15","modified_gmt":"2024-08-06T10:19:15","slug":"focus-rgpd-et-employes-quel-cadre-legal","status":"publish","type":"post","link":"https:\/\/viqtor.eu\/en\/focus-on-gdpr-and-employees-what-legal-framework\/","title":{"rendered":"FOCUS GDPR and employees: what legal framework?"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"FOCUS\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t

FOCUS GDPR and employees: what legal framework?<\/h1>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\n

Legal Watch \u2013 May 2019.
<\/strong><\/p>\n\n\n\n

Two recent cases involving a major online bookstore raise questions about the leeway employees have when processing the personal data of the company's customers.<\/p>\n\n\n\n

Although data processing is now regulated in detail by law and by numerous guidelines \u2013 whether those of the CNIL or the European Data Protection Board (EDPB) \u2013 responsibilities within the company itself still raise many questions.<\/p>\n\n\n\n

What is the employer's responsibility regarding how its employees process personal data? A few principles should be kept in mind:<\/strong><\/p>\n\n\n\n

The scope of the GDPR is broad[1]. Indeed, the automated processing of personal data covers operations carried out on data using software traditionally used in businesses: databases, email, spreadsheets for example, as well as, where applicable, data processing carried out using word processing software.<\/p>\n\n\n\n

Responsibility for the actions of employees generally rests with the employer under the Civil Code2 but also under the GDPR, because the employer is the data controller: it is the employer who defines the means and purposes of the processing within the meaning of the law3.<\/p>\n\n\n\n

For the same reason, the employer will be liable in the event of a security breach, even if it results from the actions of an employee, because it is the employer who has the obligation to secure data within his company4.<\/p>\n\n\n\n

If the employer is liable to third parties, he can of course take action against the employee who has acted illegally, in particular for breach of trust or fraud, and impose a disciplinary sanction or even dismissal. Fraudulently accessing or maintaining access to all or part of an automated data processing system is also a criminal offense.<\/p>\n\n\n\n

Independently of the employer's liability, the employee may also bear his own liability towards his employer but also towards third parties: the employee who deviates from the instructions given by the employer and pursues his own purposes becomes himself responsible for the processing within the meaning of the law (see the analysis of the European Working Party on Article 29 6 \u2013 now EDPB).<\/p>\n\n\n\n

The same applies if he violates the company's IT charter to use the data for his own account.<\/p>\n\n\n\n

In conclusion, it is essential for the employer to take the following precautions:<\/p>\n\n\n\n