By Italian Data Protection Authority has specified the role and the responsibility of labour consultants in personal data processing of clients in the light of the General Data Protection Regulation, by identifying them as “data processors” when they process personal data of employees based on the the received tasks.
By replying to questions submitted by the National Council of labour consultants and by a number of experts, the Data Protection Authority has clarified that the Regulation (UE) 679/2016 is in continuity with all that has already been specified by the Directive 95/46/CE. The Regulation confirms the definitions of data controller and data processor, in which the first is still the subject that “determines the means and the purposes of the personal data processing” and the second is the one which processes “personal data on the behalf of the data controller”.
And for this reason the labour consultants are “data processors, when they process, in full independence, personal data of their employee or of their clients when they are a natural person, as freelancers by determining means and purposes of the processing”. They are data “processors” when they process personal data of their employees based on the received task, which include also the instructions of the processing that need to be carried out. For example, it is the case for labour consultants which protect on behalf of employers the preparation of pay slips, practices relating to recruitment and termination of employment, or social security and welfare, dealing with a plurality of personal data, including sensitive, workers
It is about information recollected and used by data employers based on the contract, legislations and the regulations (as well as the provisions about work and social assistance), and are managed by labour consultants in which are externalized services based on sectors and relevant ethical rules.
And it is on the contract of entrustment and appointment of data processors by the client that it is based on the legitimacy of processos realized by consultants. The Data Authority has defined to the labour consultants, as data processors, is recognized a high level of autonomy and responsibility connected also with individuation and predispositions of adequate security measures technical and organizational ones, in order to protected clients from personal data processed.
Source: Garante Privacy