Data protection law—application to employee share schemes [Archived]
Data protection law—application to employee share schemes [Archived]

The following Share Incentives guidance note provides comprehensive and up to date legal information covering:

  • Data protection law—application to employee share schemes [Archived]
  • Introduction to DPA 1998
  • Compliance with the DPA
  • Protection for the company—data disclosed to third parties
  • Notification
  • EU data protection proposed reform

ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998. This Practice Note is for background information only and is not maintained.

Under the GDPR, it is even less likely than it was under Data Protection Directive, Directive 95/46/EC that an employer will be able to rely on employee consent as the legal basis for data processing at work and given the serious consequences of failing to comply with obligations under the GDPR, employers should therefore avoid relying on consent as a lawful processing condition.

In most cases, it is likely that the employer will instead be able to rely on ‘legitimate interests’ condition, provided:

  1. the processing is necessary for the purposes of the employer’s legitimate interests

  2. those interests are not overridden by the employee’s interests or fundamental rights and freedoms

  3. the processing is proportionate and cannot be achieved by other, less intrusive means

  4. the data being processed are adequate, relevant and not excessive for the legitimate purpose, and

  5. the employee has been properly informed of the nature of the processing, the purposes for which it is being carried out and the legal basis for it

Alternatively, in certain situations, the employer may be able to rely on the lawful processing condition relating to ‘performance of a