What does every employee already have before their first day at work? A personnel file in paper or digital form. It is created at the start of employment and then continuously maintained in the background by the HR department. But what is in it, what rights does the employee have and what is the situation with the digital file from a data protection point of view?
In principle, there are no specifications as to which documents are part of the personnel file, unless we are in the public sector. The content can be determined by each company itself. The documents should be related to the employment relationship and contain only correct information. Examples are:
Da die Einsichtnahme lediglich in den Räumlichkeiten des Arbeitgebers stattfinden darf, bietet sich hier eine digitale Lösung an: die digitale Personalakte.
The HR department is not obliged to disclose what has been added to the personnel file and when. Rather, the employee has a right to inspect it at any time. This follows from §83 BetrVG. Here, the employee is given the opportunity to make copies of the documents and to have incorrect information corrected or removed. Since inspection may only take place on the employer's premises, a digital solution is available here: the digital personnel file.
Behind the digital personnel file there is usually a document management system in which the documents are created and managed in digital form. This can optimise personnel processes and relieve the personnel department. For example, documents can be found more quickly and easily via the search function. In addition, joint work on documents becomes more effective, as neither duplicate work nor copies of the original documents need to be made. With a digital personnel file, filing cabinets are a thing of the past; after all, hardly any paper documents need to be kept. They can simply be outsourced to the document management system. Checks such as those on driving licences can also be carried out decentrally and online at any time. The employee himself can also exercise his rights more easily. For example, he can access the management platform directly using his own login data and thus inspect the digital personnel file. At the same time, he can point out incorrect information to the employer and request a change.
Since personnel data is sometimes very sensitive personal data, the regulations of the GDPR also apply here. There are a number of points to consider when making a selection. First and foremost, it is important to protect the documents from being viewed by unauthorised third parties. Attention should be paid to secure data transmission and encrypted storage of documents. At the same time, an authorisation concept should regulate the necessary user roles. Not every employee needs access to personnel files. This access right should be limited to a select group of persons with personnel decision-making authority. The respective employee also needs access to his or her own file in order to exercise his or her right of inspection. If available, the works council may also have access to the personnel file. However, this is only possible if the employee requests it, as follows from §83 (1) sentence 2 BetrVG.
If changes are made to existing documents, it must be possible to trace who adapted what and when. For this purpose, logging these adjustments in a history log is helpful. In this way it should be possible to recognise changes and also to restore the original state of the document. Furthermore, access logs should be kept in order to quickly detect unauthorised access and to be able to take appropriate measures.
Even after termination of the employment relationship, the personnel file must still be kept on the basis of the DSGVO. The duration can be different for each individual document, so that different deletion periods apply to one and the same personnel file. The digital personnel file is particularly helpful here because a separate deletion period can be set for each document. After the retention period has expired (e.g. holiday and sickness certificates max. 3 years; tax statements 10 years), deletion can then take place automatically. This keeps the archive clean because no employee has to manually search the archive for documents to be deleted.
With regard to data protection, the following points in particular should be met:
Add a comment