In the final of a three-part blog series covering Data Protection in the Workplace, Information Commissioner Paul Vane discusses Lawful Bases, the impact of Artificial Intelligence and Privacy during the pandemic.
Consent has been a hot topic throughout my data protection career and I doubt that’s going to change any time soon.
It surprises me how many organisations get so hung up and focus on consent, whether that’s specific consent for certain types of processing, or, as I’ve seen quite often in a number of organisations, a blanket consent applied to ALL processing activities they conduct. So, in other words, you can do what you like with all the personal data you hold because the staff member has ‘given their consent’.
But have they? Have they really given their permission? Remember that for consent to be valid it has to fulfil a number of criteria:
So given the above, you can see that consent carries with it it’s fair share of issues and with all that in mind I would say that ‘consent’ is probably the last lawful basis for processing you should be using. And of course, there is another major reason not to rely on the consent condition, and that’s because with consent comes the right to withdraw that consent. If an employee withdraws their consent for you to hold certain personal data, what are you going to do?
Why not use some of the other lawful bases set out in Schedule 2 of the Data Protection (Jersey) Law 2018? For example:
Briefly on the subject of Artificial Intelligence (AI), will AI be a job killer? Some commentators on AI would suggest it will be. But there is an equally strong counter argument that AI will actually be a job creator and enabler, helping us to work better and more efficiently, and also helping us do things we’ve never been able to do.
In terms of the uses of AI in the workplace, it probably starts right at the outset of recruitment, with more companies using AI to assist with recruitment and shortlisting. The law makes specific provision for automated processing activities such as these, but the truth is the issues lie much deeper than just the automated processing aspect.
One of the wider concerns around the use of AI in circumstances such as these is the issue of bias. At the end of every AI system or process is a set of ‘rules’ programmed in by a human. So, the big question is how do you avoid either conscious or unconscious bias creeping into AI systems that effectively select people on the basis of a pre-programmed criteria? There have already been a number of cases where allegations of bias and discrimination have arisen as a result of AI-determined decision making.
Where you might see more use of AI in the workplace is in places where the jobs are human labour-intensive, highly repetitive or subject of regular human error. Why would you have a human doing those jobs when that job could be done more effectively and efficiently by a machine, and the human resource can be better used elsewhere in the business? This is no different from what has happened historically where humans have made way for machines in the manufacturing industries into professional services.
To finish, I can’t write a Data Protection in the Workplace blog series without mentioning the recent impact of Covid-19. Of course, just because there is a pandemic doesn’t mean that privacy and data protection falls away. One does not trump the other.
What it does mean, is that as an employer, you need to consider a number of factors:
The resource room on our JOIC website provides a wealth of guidance about all areas of data protection and my team is always on hand to answer any questions.
