Access to fiscal data collected in code of conduct: Worker’s consent is required

The AN declares contrary to the right to privacy and honor to require the worker to provide the income statement or the report of the AEAT to verify compliance with the rules of the code of conduct of the company. Such requirement of documents without the express consent of the worker is an inadequate and disproportionate measure for the purpose pursued.

A dispute is filed requesting that the articles of the Code of Conduct of the Bank of Spain be declared null and void, as well as other articles of Ordinance 9/2017, which contain measures such as:

a) Need for prior authorization to intervene in any type of conference, congress, external courses or seminars or any collaboration that is carried out in any type of publication or to relate to the media in the case of economic, financial, banking or any other issues related to the functions of the Bank of Spain.
b) Restrictions on the realization, directly or indirectly, of critical private financial operations.

The plaintiffs consider that these measures violate the fundamental rights to equality, to the privacy and dignity of the worker. The AN dismisses the claim on this point when considering that the measures exceed the proportionality judgment (suitability, necessity and proportionality) required by the jurisprudence to limit the exercise of fundamental rights.

Different conclusion reached regarding the possibility that the Internal Compliance Unit carries out actions to verify compliance with the rules applicable to the performance of critical operations, by requesting the employee a copy of the IRPF declarations and the data Taxes provided to the interested party by the AEAT may be supported, for this, in external companies.

In the IRPF and AEAT documents, data belonging to the intimacy of the persons are recorded, as they report on the expense incurred by the taxpayer, data on affiliation with a union, or whether or not it collaborates with the Catholic Church or with NGO or the personal assets that it owns. The question that arises, therefore, refers to whether the obligation to deliver personal income tax returns as well as the fiscal data provided by the AEAT violates the right to personal privacy.

The AN points out that, among the powers of control of the employer, it is not possible to request from its employees data belonging to the constitutionally protected privacy of the same. On the other hand, the LOPD of 1999 establishes as a general principle, in terms similar to those contained in the current RGPD, that the processing of personal data is only possible with the consent of its holders, unless the data can be treated without consent.

In addition, the measure does not exceed the proportionality trial. It is not an ideal, necessary and proportionate solution to achieve the purpose of compliance by employees with the rules applicable to the conduct of critical private financial operations as no more benefits are derived for the general or business interest than damages on the right to privacy.