15. Data protection, surveillance and monitoring

Data protection law regulates the way in which employers can use personal information about their workers. It balances the rights of organisations to process information for necessary or legitimate purposes against the rights of individuals to know what information is being processed and how it is being used.

This is done through the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 18). The UK GDPR operates by imposing duties on those responsible for processing data (“data controllers” and “data processors” — which include employers and trade unions, or those acting on their instructions) and giving rights to individuals whose personal data is processed (“data subjects” — individuals including workers and employees). The DPA 18 contains additional provisions to ensure that it functions in domestic law. For example, it defines public authorities and public bodies and contains provisions for the enforcement of data protection law and the appointment of the Information Commissioner. It also regulates data processing for law enforcement and intelligence services.