Concise and to the point with ALRUD: HR & DIGITAL (№19)

Reminder

The transfer of the personal data of an employee to an external lawyer for the purpose of participation in court proceedings is allowed without the consent of the employee.

This was confirmed in the Decision of the Zadonsky District Court of Lipetsk Region dated 27 April 2024 No. 2-112/2024 (unchanged by the Appeal Ruling of the Lipetsk Regional Court dated 23 October 2024 No. 33-3740/2024).

Facts of the case

By filing a lawsuit, the employee, inter alia, asked that the transfer of her personal data by the employer to a third party without written consent be recognized as illegal.

The employee’s position: There was no clause in the employment contract on consent to the processing of personal data, and no separate written consent was ever given. The employer illegally transferred the personal data to a third party, its legal representative in the court case. The external lawyer collected information about the employee on the websites of the courts, pension authorities and former employers, which violated the employee’s right to privacy.

The employer's position: In transferring the personal data, the employer was exercising the protection of its rights and legitimate interests in court. The lawyer involved did not collect the personal data illegally – he familiarized himself with the case materials and judicial acts involved in civil cases regarding other claims made by the employee in order to prepare objections to those claims and confirm the arguments for the counterclaim.

The court's position: In two instances (first and appeal), the courts supported the employer and clarified that the processing of the employee's personal data, including transfer to the external lawyer, was carried out on the basis of Paragraph 3, Part 1, Article 6 of Law No. 152-FZ, for participation in civil proceedings. The actions of the employer (as a data controller) and its lawyer involved the protection of their rights and legitimate interests in court and cannot be considered a violation of the privacy of the plaintiff.

Finally, the actions of the employer did not entail any negative consequences. In the case described, the data controller provided the relevant legal grounds for personal data processing. Note that, according to Article 88 of the Russian Labour Code, the employer generally has the right to transfer the employees’ personal data to third parties only with their prior written consent. At the same time, before transmitting personal data, the employer must warn the third party (data processor) that the data can only be used for the purposes for which they are transferred, and obtain confirmation from the data processor that they will fulfil this requirement.