Can an Authorisation to Process Personal Data Be Issued in Electronic Form?

ANSWER

Yes. Article 22^1b § 3 of the Labour Code requires a written authorisation in the case of processing special categories of data (e.g. employee sick leave records). However, pursuant to Article 78¹ § 2 of the Civil Code, a declaration of intent made in electronic form (bearing a qualified electronic signature) is equivalent to a declaration of intent made in written form.

This applies to the signature of the data controller, as the granting of an authorisation is a unilateral act. There is no requirement for the employee, for example, to confirm receipt of the authorisation by means of a qualified electronic signature.