Centralised Processing of HR Data
Transnational corporate groups often wish to establish central human resources data files. This raises various specific issues which are discussed below.
Legal restrictions on centralised human resources processing
Strictly interpreted, Article 328b of the Swiss Code of Obligations does not allow the disclosure of employee data to other group companies because they are considered third parties and such disclosure is not necessary for the performance of the employment contract. The employee also cannot consent to such a transfer. Because the DPA authorises the outsourcing of data processing, it may be reasonably argued that, under certain conditions, central human resources management is allowed.
The employees' records usually will constitute personality profiles, especially if they contain performance reviews and personality assessments. The disclosure of sensitive data and personality profiles to third parties, such as group companies, is only lawful if there is a legitimate reason for such disclosure, which can be supplied by the employee's consent. Therefore, the employee's consent should be sought, for example through an appropriate provision in the employment contract, before human resources data is disclosed to group companies. If an employee objects to the disclosure of his or her data to a group company, such disclosure is prohibited.
Data transfer abroad
Centralised data processing often involves the transfer of employee data to other group companies outside Switzerland. Considering that data may be forwarded to other group companies in various locations, the scope of the transfer outside Switzerland may be significant. Appropriate precautions will need to be taken to ensure compliance with the DPA in this respect.