On 7 October 2019, the EU Council formally adopted the new Whistleblowing Directive that will guarantee whistleblowers EU-wide standards of protection. The Directive obliges both public and private organisations and authorities to set up secure reporting channels, so that whistleblowers can report violations of EU law as safely as possible. Member States have two years
Data privacy and GDPR
Facilitating HR Management: Electronic medical certificates
As part of the “Third Bureaucracy Relief Act” the German government intends to introduce an electronic submission procedure for medical certificates regarding the incapacity of employees. More than 80 million of such certificates are issued every year by doctors in Germany. Replacing extensive documentation and record-keeping duties will allow medium-sized companies in particular to reduce…
Control or trust: Legal claim to home office?
Digitization and technological advances are accelerating the flexibility of working conditions leading to a changed understanding of leadership. A key topic of debate is the “home office” which is currently used by approximately 12 per cent of employees in Germany for all or part of their working time. On this topic, the German government is…
Vicarious liability in the data breach context – bad news for UK employers
The Court of Appeal has upheld a decision of the High Court holding that an employer can be vicariously liable for data breaches caused by the actions of an employee, even where the employee’s actions were specifically intended to harm the employer. This decision is significant as it means a company can be held liable…
The GDPR – What does it mean for Employers?
You cannot fail to have noticed that the GDPR (General Data Protection Regulation ((EU) 2016/679)) came into force today. The Data Protection Act 2018 received Royal Assent on 23 May and ensures that the standards set out in the (GDPR) have effect in the UK.
The GDPR affects the processing of employment data – but…
ICO updates its subject access Code of Practice
The Information Commissioner’s Office in the UK (ICO) has updated its Subject Access Code of Practice (the Code) which deals with requests from individuals for personal information. The amendments are mainly to reflect the Court of Appeal’s decisions in the recent cases of Dawson-Damer and others v Taylor Wessing LLP [2017] EWCA Civ 74 and Ittihadieh v 5-11 Cheyne Gardens RTM Company Ltd and Deer v University of Oxford [2017] EWCA Civ 121.
Norton Rose Fulbright’s online guide to global employment law is now available
More and more organisations are growing their global footprint and need to move their people around the world. In this global environment, it is essential to know, understand and comply with employment and labour laws in place across all of the jurisdictions in which organisations engage people. This will help to protect business from unnecessary…
Employment Law and Financial Institutions
In the financial sector, in addition to individual employment contracts, working conditions can be subject to various industry related statutes and regulations, collective bargaining agreements and works agreements.
Laws and regulations
As a reaction to the global financial crisis, the participants of the 2008 G20 summit in Washington, including Germany, agreed on the establishment and…
Use of social media in France: Employee’s rights and obligations
The impact of the use of social media in the workplace has regularly given rise to controversies and debates as how this subject is to be handled by a company’s management. The current state of employment law is still not entirely settled in this respect. It is however possible to provide some guidance on the…
Data protection and employment law update (Italy)
The Italian Data Protection Authority (IDPA) is increasingly faced with issues relating to the ways employers may monitor the Internet usage of its employees. In 2016, the Authority handed down two important decisions on this topic.
In the first decision, the IDPA stated that an Italian University (the University of Chieti and Pescara) was acting unlawfully in the way that it used e-mails to trace the identity of Internet users. This University, without having given any prior warning to its employees, implemented a system that retained information regarding personal Internet access, for the purpose of service monitoring, internal security and for the prevention of possible investigative inquiries by the Authorities. In essence, the policy, which controls, filters and monitors information on Internet data, enabled the employer to indiscriminately monitor employees from a distance. The IDPA’s decision was based on the argument that this policy breached the relevant principles of “actual need and proportionality of the treatment”. The IDPA considered that the policy was not in accordance with the law because it did not refer to tools used by the employees in performing their duties and had not been previously communicated to the employees.