Act on the Protection of Privacy in Working Life, 2004

The Act on the Protection of Privacy in Working Life sets out specific rules for processing employee-related personal data and also applies, as appropriate, to job applicants. In addition, the Data Protection Act applies to the processing of personal data of employees and job applicants, unless otherwise stated in the Act on the Protection of Privacy in Working Life. The employer is only allowed to process personal data directly necessary for the employee's employment relationship. Specific questions directed at the applicant's health cannot be asked. The questions must be limited so that they relate only to information that is relevant to the performance of work duties, taking into consideration the nature of the work. The employee's consent is not required when an authority discloses information to the employer to enable the latter to fulfil a statutory duty, or when the employer acquires personal credit data or information from the criminal record in order to establish the employee's reliability. The employer must notify the employee in advance that data concerning the employee is to be collected in order to establish that employee's reliability. If information concerning the employee has been collected from a source other than the employee directly, the employer must notify the employee of this information before it is used in making decisions concerning the employee.