Data law brings firms’ staff info under focus

livemint.com:

MUMBAI/ NEW DELHI : Companies will no longer be able to collect vast amounts of employee data since it has the potential to become a “toxic asset" after the enactment of the personal data bill, said consultants and law firms advising corporates. Companies will have to take the consent of employees after explaining in granular detail why their data or that of a prospective candidate needs to be collected and how long it will be stored in the system.

Corporates will also have to specify if the data will be saved to protect the proprietorial rights of the company or provide services and benefits the employee has asked for. “Until now, some firms used to collect and retain all the data they could get from employees, using broad notices for consent.

Now, they will need to be careful about how much data they hold, and will need to be clear about the purpose and necessity for collecting data, for consent to valid," said Arun Prabhu, partner and head, technology and telecom at Cyril Amarchand Mangaldas. There will be provisions which will allow employers to ask for data but there too, changes in policies will need to be made.

“While firms can use data without consent to safeguard from liability, protect proprietary information or to provide benefits that employees have asked for — like crèche, medical insurance etc — consent will still likely be important," Prabhu said. “Employees have enforceable rights in relation to their data including to seek its correction and erasure, so India Inc may no longer be able to afford to hold data it does not need because it can incur significant liability under the DDPA in relation to employee data," he added.