Is a temporary employment agency the controller of employee data and should a personal data processing agreement be concluded with it?

ANSWER

The temporary employment agency will be the controller of its employees' personal data because it employs temporary workers and is their employer within the meaning of the Labour Code. When the temporary employment agency transfers employees' data (name and surname) to another entity, it discloses that data for that entity to pursue its own processing purposes. The entity receiving the personal data in such a case pursues its own processing purposes (for example, keeping records of the employee's working time) and does not process that data on behalf of the controller, which is the temporary employment agency. This means that the relationship between the user employer employing the agency's workers and the temporary agency will be a relationship between two independent controllers. Arrangements on the disclosure of personal data should be included in the main/framework agreement linking the user employer and the temporary employment agency. Provisions on data disclosure should include an appropriate confidentiality clause.