The Information Commissioner issued an opinion according to which the trade union and the employer are required to enter into an agreement concerning the processing of personal data.
In the opinion no. 0712-3/2018/1260, entitled Processing of the personal data of the trade union members, the Information Commissioner pointed out that trade union may obtain specific personal data directly from the employer.
Pursuant to Article 203 of the Employment Relationships Act (Official Gazette, no. 21/13, hereinafter ZDR-1), which provides that the employer shall provide conditions for quick and effective performance of trade union activities in accordance with the regulations concerning the protection of the employees’ rights and interests, the employer may provide the trade union with the workers’ data and allow access to the data that are necessary for the performance of the trade union activities (the amount of data to which the trade union is entitled shall be determined according to the circumstances of the specific case).
Furthermore, if the worker chooses to pay the membership in such a way that the employer deducts the membership from the workers’ wage, the employer is acting in a capacity of the contractual processor of worker’s data which are submitted to the employer by the trade union as a data controller. In this case, it is crucial that the trade union and the employer enter into an agreement concerning the personal data processing, which should include the provisions on technical and organisational measures for data protection.
In any event, the employer is not allowed to ask the trade union to provide it with the entire membership application form of the worker, but can only ask for those data that it needs in order to pay the membership (data minimisation principle).