Privacy and employee appraisals?

It has been a while since the EU General Data Protection Regulation (GDPR) was introduced, and after a very hectic period of preparations and many questions, things have become considerably quieter. That doesn't make it any less relevant.

A few days ago, I searched for “privacy and employee appraisals”. I was shown the Norwegian Data Protection Authority's pages on storing personal data. Here, minutes from employee appraisals are included in the list of documentation that may legitimately be kept in a personnel file, and that sounds fine. A personnel file is easy to access, and it isn't that difficult to make rules for deletion, access and the right to take records with you – requirements that are reinforced by the new regulation.

The only problem is that documentation from employee appraisals rarely ends up in the personnel files.

A great many still use a paper-based method for preparing and following up the conversations. It is not unusual for the outcome of the confidential conversation to be distributed and stored in several places, electronically and on paper. Or, to be honest, in all sorts of nooks and crannies.

How do we find practical routines for handling privacy and employee appraisals in line with the regulation?

Since 2018, we have all had to document the basis for the personal data we process in our organisation.

I imagine that many still find it a challenge to get an overview of everything that is lying around.

• What do we have, and what do we need?
• Why?
• Do we have a legal basis, or do we need consent?
• How long is the documentation needed?
• How is it stored?
• Who has access?

Does GDPR offer any advantages?

Transparency is a key word in GDPR, and that is a good thing. Each of us should be able to know what happens to our personal data: what is processed, by whom, why, how, where and for how long.

As a former HR director, I have on several occasions seen documentation turn up in personnel cases in a form and with content that I have not been at all tempted to use, and that has certainly not been suited to creating good relationships. Greater transparency and more access have a disciplining effect on what we write and store. The interaction between employees and managers benefits from that. I quite simply believe the changes lead to healthier companies, with openness and better involvement.

• Psychological safety in the workplace

A digital solution can solve much of the challenge.

Through GDPR, those of us who process data on behalf of others have been given extended responsibility. Through binding data processing agreements, we must ensure that privacy is safeguarded on behalf of our customers in the areas we process. We also face a requirement that privacy must be built into all new software solutions, so that the privacy principles are met automatically.

• Get to know Motivati

I have some advice along the way, beyond the fact that the supplier you choose must of course be able to document that they will meet the GDPR requirements.

1. Be ambitious. Look for solutions that increase the quality and value of the task at hand, not just solutions that add time-saving structure. A good method that provides greater insight is worth its weight in gold.
2. Choose a simple and flexible solution that is easy to implement. Busy managers hate having to get to grips with complicated solutions that contain more than they need.
3. Not everything needs to be in the same tool.

Here you will find easy-to-understand information about the new data protection regulation from the Norwegian Data Protection Authority: Norwegian Data Protection Authority guide – What does GDPR mean for your organisation?