In a municipal office — can evaluation of local government employees be a process that should undergo a data protection impact assessment?

ANSWER

In HR processes, a DPIA may be necessary because we always deal with data subjects requiring special protection due to the imbalance in the employer–employee relationship. In the case of employee evaluation, everything will depend on the type of evaluation. In my view, standard evaluation of an employee by a supervisor does not necessarily trigger a DPIA requirement, but when it is systematic and uses many criteria, a DPIA should be considered. Furthermore, a DPIA will be necessary in the case of automated evaluation, large scale, or use of modern technologies (e.g. HR analytics using artificial intelligence/machine learning).