A worker in a European Union (EU) member state has ceased his employment with a company. What should the employer most likely do in regard to the worker's personal data?

Question

Options

• ADestroy sensitive information and store the rest per applicable data protection rules.
• BStore all of the data in case the departing worker makes a subject access request.
• CSecurely store the data that is required to be kept under local law.
• DProvide the employee the reasons for retaining the data.

• A
  7% (4)
• B
  12% (7)
• C
  78% (47)
• D
  3% (2)

Explanation

The GDPR requires that personal data be kept for no longer than is necessary for the purposes for which the personal data are processed. However, the GDPR also allows member states to provide for more specific rules on the processing of employees' personal data in the employment context, including the retention periods for erasure and deletion of categories of personal data. Therefore, the employer should securely store the data that is required to be kept under local law, such as tax records, pension records, or health and safety records. The employer should also ensure that the data is protected from unauthorized or unlawful access, accidental loss, destruction, or damage. The employer should not store the data for longer than necessary or for purposes other than those for which the data was collected, unless the employee has given consent or there is another legal basis for doing so.

No community discussion yet for this question.