Must an employer obtain consents to process the personal data of its employees and family members for the purpose of organizing a company trip?

ANSWER

Under Article 2(2)(c) GDPR, the GDPR does not apply to processing carried out "by a natural person in the course of a purely personal or household activity". When organizing a trip with friends, we do not think about the GDPR. If a joint trip of employees and their families is similarly informal, i.e. without invoicing or other formal involvement of the workplace, the GDPR does not apply. If, however, the workplace's involvement is formal, the employer, when processing participants' data, may rely on its legitimate interests (Article 6(1)(f) GDPR), collect consents (Article 6(1)(a) GDPR) or even conclude contracts with employees (Article 6(1)(b) GDPR). Each of these legal bases is possible, depending on how the data processing process is organized.

The choice of Article 6(1)(f) GDPR is reasonable (it is sufficient to declare willingness to participate and register for the trip), unless other employee data will be collected than those previously obtained on the basis of labour law. In that case, because of Article 22¹ and Article 22¹a of the Labour Code, consent will be required. If consents are collected, each participant should give consent themselves, unless the employee is authorised to act on behalf of another person (most often their child).

In connection with settlement or possible co-financing of the trip, the employer will also process data for the purpose of fulfilling related legal obligations (Article 6(1)(c) GDPR).

Where the workplace's involvement is formal, an obligation arising from the GDPR will undoubtedly be to fulfil the information obligation towards participants. Since participants will include not only employees, accompanying persons should also receive privacy notices under Article 14 GDPR — if employees provide their personal data when registering.