Monthly Archives: June 2015

The Data Protection Acts 1988 and 2003 provide rules that apply to the collection, use, disclosure and transfer abroad of information about individuals. The Acts cover the principals that companies must follow when processing personal data about employees as well as information about clients/residents.

The Acts also give individuals certain rights in relation to personal data that is held about them. 

If you as a Company collect, host or process data about people on any type of computer or structured filing system, then you are considered a data controller under the Acts.

Every Company holding information about individuals should have a Data Protection Policy in place and should ensure that all IT administrators and employees with access to personal/confidential information are fully trained on the rights and responsibilities associated with that access.

Billy Hawkes, the Data Protection Commissioner, ensures that companies that keep personal data are in compliance with the Acts. The Commissioner has a range of enforcement powers to help guarantee that the provisions of the Acts are observed. The Commissioner can serve legal notices compelling data controllers to provide information needed to assist with his enquiries. He can also compel data controllers to implement provisions of the Acts in a particular prescribed manner.

He may investigate complaints made by members of the public and can authorise officers to enter sites with the aim of inspecting the type of personal information kept as well as how it is processed and the security measures that the data controller has in place. Companies are required to co-operate fully with such data protection officers.

Data controllers who are found guilty of offences under the Acts can be fined up to €100,000 on conviction and may be ordered to delete all or part of their database.

The Data Protection Commissioner publishes a report annually naming, in certain cases, data controllers who were investigated by his office.

On 12th May 2014 Billy Hawkes launched his Annual Report for 2013. The report contains a summary of the activities of the Office of the Data Commissioner during the entire year.

The Annual Report highlights a huge number of individual complaints that were referred to the Office regarding difficulties in gaining access to personal data. According to the report these were as a result of poor customer service standards by commercial entities.

It appears as though individuals who feel as though they are not receiving sufficient customer service from a commercial entity are exercising their data protection rights more regularly and are more frequently requesting a copy of all personal data held by that entity.

If the initial query or request had been comprehensively dealt with in the first instance then perhaps they would have been less likely to exercise their data protection right to request a copy of all personal data held about them.

Employers should note that telephone call recordings are considered personal data. The Office has seen as increase in the number of access requests to data controllers by individuals seeking a copy of telephone recordings. Organisations are obliged to inform data subjects that their call may be recorded if a call recording system is in operation.

Throughout the course of 2013 the Office opened more than 900 complaints for investigation. More than 500 of these complaints (56.8%) were from individuals who experienced difficulty when gaining access to their personal data held by organisations. This was a record high for this type of complaint which is indicative of the increased level of awareness among the general public of their statutory right of access.

Last year the Office dealt with 1,577 Data Security Breach notifications. The 2013 Annual Report contains a variety of case studies regarding Data Security Breach investigations. One such case study involved the taking of a client list by a former employee to a new employer. This has emerged as a regular issue in recent years and is a serious breach that is a big concern for all employers.

Civil sanctions may result where a person suffers any damage as a consequence of failures on the part of a data controller to meet his/her obligations.

In November 2013 it was discovered that the personal information of more than 1,500,000 people was compromised by a major security breach at a Co. Clare based Company. In an RTE Morning Ireland interview at the time, Mr. Hawkes admitted that “cyber-criminals have become extremely sophisticated and it can be quite difficult to actually identify that your system has been perpetrated.” This was one of the worst data breaches in Irish history.

The Society for Chartered IT Professionals in Ireland, known as the Irish Computer Society (ICS), carried out a recent survey on data protection in Ireland and the results, which were published in January 2014, were astonishing.

256 Irish based companies were surveyed and a record number of data breaches were reported to have occurred in 2013. Findings revealed that one in two of the surveyed companies experienced a data breach during the last 12 months. In fact, more than 20% of the companies contacted by the ICS reported multiple breaches. These statistics mark a significant increase on last year’s figures when 43% of companies examined reported a breach.

According to the results, one third of employees are not fully aware of data protection issues and many receive insufficient data protection training or, alarmingly, no relevant training whatsoever.

Several IT managers admitted that Data Protection policies are not implemented at all in their Company or they are only partially adhered to. The survey has highlighted the need for companies to manage their data processing environment much more carefully and provide additional training for their IT administrators and all employees who have contact with personal information pertaining to employees/clients. According to the ICS survey, negligence on the part of employees accounted for 77% of the reported incidents. Hackers seeking to obtain data and unencrypted laptops were also cited as major threats.

According to Fintan Swanton, Chairman of the Association of Data Protection Officers, “Clear policies and procedures are vital, with regular refresher training and timely reviews to ensure that staff are complying with the structures.”

It is important for employers to be aware that new data protection legislation will require most organisations to appoint a Data Protection Officer.

A dispute arose recently between HSE South – Waterford Regional Hospital and UNITE Trade Union over the payment of a “Twilight Hours” premium.

The evening shift for 22 Catering Attendants employed by the HSE in Waterford Regional Hospital was Outsourced to Agency Workers and, resulting from this, as of the 28^th April 2013, the Twilight Hours premium ceased to be paid.

Management’s opinion was that it was unreasonable to expect payment for a shift that was no longer worked by the Catering Attendants, however, UNITE argued that, in accordance with Section 8: Service Delivery Options of the Public Service Agreement (PSA), their members should continue to receive the payment.

As the dispute could not be resolved at local level, it became the subject of a Conciliation Conference under the auspices of the Labour Relations Commission. Agreement was not reached at this stage and, on 18^th June 2013, the case was referred to the Labour Court in accordance with Section 26(1) of the Industrial Relations Act, 1990.

 

A Labour Court Hearing took place on 15^th April, 2014 where UNITE argued that the workers suffered reduced wages due to the outsourcing of the evening shift even though the PSA stated that such procurement would not result in a worsening of pay rates for employees.

The Union also argued that the payment should have continued on a personal-to-holder basis or, at the very least, compensation, calculated on the actual loss over a 12 month period beginning on the 29^th April 2013, should be paid as per the PSA.

The HSE argued that it was forced to consider outsourcing as an option because the level of Catering Staff had diminished considerably and there was no alternative to this. The Employer argued that the decision was not taken lightly and its view was that the move did not worsen rates of pay as the “Twilight Hours” payment was a premium payment and the basic pay for the Catering Employees was not affected by the HSE’s decision to outsource the evening shift.

 

Management’s view was that the Haddington Road Agreement took precedence over the PSA and that compensation for loss of earnings should be paid to the employees for the 2 months from 29^th April (when the payment ceased) to 1^st July 2013, rather than 12 months as argued by UNITE.

The Court noted that the premium was no longer paid because the hours were no longer worked due to the decision to outsource. The loss was calculated as €1,430.00 per annum per Claimant and, after considering the submissions of both parties, the Court recommended that the issue be dealt with via the compensation formula provided for under the terms of the PSA 2010-2014. This meant that 50% of the identified loss should be paid with effect from 29^th April with the remaining 50% payable 6 months later.

As  I am sure you are aware, World Cup 2014 is starting today and we want to ensure that you are prepared as an employer, in the event that employee issues arise as a result of this tournament, particularly attendance at work during games and on the day following games.

The World Cup is commencing today, 12th June, and runs until 13th July. Employees should have requested this time off by now or in the coming days if they wish to take annual leave during this time for matches.

The main issues that could arise as a result of World Cup 2014, for employers, is that employees will be seeking additional time off either as annual leave or unscheduled time off. Unauthorised absence/increased sick leave may also be an issue for employers. Most games will be in the evening time - those employers who have evening/night shifts will need to be particularly prepared and pre-empt absence.

You as an employer, will first need to establish what your policy is to be during this period. Once you have decided the stance you wish to take with employees during this period, you will need to ensure this policy is clearly outlined to employees in the coming days to ensure they are clear about what is expected of them.

 

In deciding what you want to enforce for employees, you should pay attention to the following:

• Inform employees that, if they wish to take time off, they must apply for annual leave immediately - and let them know that it will be on a first come, first served basis. 

• Perhaps give staff the opportunity to swap shifts with colleagues who may not be interested in the matches - ensure all shifts are adequately covered.

• Be mindful of your employees who are not football lovers and do not want to take any time off during these games. Ensure there is fair treatment between all staff and ensure football fans are not getting special treatment and additional time off over those who do not follow the game.

• Make it clear that all employees are expected to be in work as normal, unless they have requested time off etc., during World Cup 2014. Outline that you expect productivity and attendance etc., to remain as it is currently.

• You could outline that for any absences during this time (within reason), due to illness; employees are required to provide a medical certificate upon their return.

• Employees may also arrive to work still under the influence of alcohol. If this is discovered, you need to act fast. Send the employee to the company doctor immediately to be checked by the doctor to establish if the employee is under the influence of alcohol. If the employee is found to be under the influence he/she should be sent home.  It may be time to engage a disciplinary process with the employee at this stage.

• If applicable, you may consider screening the games in house as a goodwill gesture to employees.  

  • Be mindful if there are a number of matches on, you will need to allow employees have their say on which match is shown..

• Employees may attempt to stream matches online on work computers, the company’s internet usage policy should be outlined to employees and the company’s expectations also outlined to employees here.

The key to avoiding any issues during World Cup 2014 is to make sure you clearly outline to staff (in advance), what is expected of them and that absences etc., will not be tolerated.

The above advice is courtesy of Lorraine Byrne, Senior Account Manager at The HR Company.

A significant number of employees regularly work with Visual Display Units (VDUs) as part of their role.

Employers – Did you know that there are a range of measures that you must adhere to with regard to VDUs in your workplace?

*The following are the categories of employees who will be covered by these Regulations;

1. If the employee has no choice but to the use the VDU to carry out his or her work.

2. If the employee normally uses the VDU for continuous periods of more than one hour.

3. If the VDU is generally used by the employee on a daily basis.

 

Please note that a normal laptop is not covered by these Regulations due to the fact that the keyboard is tilt-able and separate from the screen so as to allow the user to find a comfortable working position hence avoiding fatigue in the arms or hands of the employee.

*In accordance with the Safety, Health and Welfare at Work Acts 2005 and 2010, employees working with VDUs are entitled to have their workstation assessed in line with the following requirements;

1. The Company must ensure that the general use of the equipment is not a source of risk for the employee.

2. The Company is obliged to perform an analysis of the employee’s workstation in order to evaluate the safety and health conditions to which it may give rise.

3. The Company must take appropriate measures to remedy any risks found during the workstation analysis.

*Upon the commencement of their employment employers must ensure that;

1. Employees are trained in the use of the VDU workstation and given information about health and safety factors.

2. Employees receive periodic breaks or changes of routine (away from the VDU).

1. Employees receive appropriate eye and eyesight tests (or may opt for either) before working with VDUs as well as at regular intervals throughout their employment with the Company.

If an employee experiences any eyesight/physical problems as a result of working with a VDU, the employee should highlight the issue to his or her manager as soon as possible.

*Some notable points for employers;

•             If special corrective appliances (glasses) are required exclusively for working at a display screen, they must be provided by the employer at no cost to the employee. The costs of minimum requirement frames and lenses must be borne by the employer.

•             Should the glasses be used also for other purposes the employer must cover the cost of the correction required for working with display screens only.

•             Employer obligations relating to the various components of the workstation (from chairs to the display screen, lighting, noise levels, heat, radiation and humidity) are also included in the Acts.

We have created a draft VDU Policy for you to incorporate in your Employee Handbook alongside all of your other HR policies.

Click the below image in order to download our draft policy that you can tailor for your Company.

 

 

The 2012 Annual Report of the Employment Appeals Tribunal has highlighted some astounding statistics 

• According to Chairperson Kate T O’Mahony’s foreword “there are presently approximately 5,000 cases awaiting a hearing, of these 37% are unfair dismissals cases.”

• According to the Chairperson’s foreword, “In its appellate jurisdiction the Tribunal deals with disputes about matters occurring during the course of the employment relationship. A notable trend in recent years has been the steady increase each year in the percentage of the Tribunal’s appellate work which, significantly doubled from 12% in 2011 to 24% in 2012.”

• In 2012, employees had some sort of additional representation at the hearing before the Employment Appeals Tribunal on 1,917 occasions – employers, however, only had representation in 1,116 cases. It is clear that unfair dismissal cases see the highest level of representation but it is interesting to note that employee parties had representation in 1,071 cases and employer parties only had representation on 740 occasions.

• In 2012, the Employment Appeals Tribunal received 5,623 cases.

 

• The number of appeals against the recommendations of the Rights Commissioners received in 2012 was 1,349 – this number represents a 38% increase on the previous year and a staggering 81% increase on the 2010 total.

• The top 3 categories of cases referred to the Employment Appeals Tribunal in 2012 were Unfair Dismissal (1,742), Redundancy (1,239) and Minimum Notice & Terms of Employment (929).

 

• In 2012, the Employment Appeals Tribunal awarded almost €7million in 377 Unfair Dismissal cases. The average compensation awarded was more than €18.5k. *96 claimants received more than €25k

 

• The number of Payment of Wages cases disposed of in 2011 was 154 – this number rose by 164% to 407 in 2012.

• The number of Maternity Protection Acts appeals rose from just 2 in 2011 to 11 in 2012.

 

In the 6 month period between January and June 2013, The National Employment Rights Authority (NERA) conducted 2,755 workplace inspections. A staggering 1,458 (53%) of these inspections were unannounced!

NERA’s update on activity from January to September 2013 illustrated the following:

*In the first 9 months of 2013 the NERA Customer Service Unit provided information to more than 48,484 people. The vast majority of people who received information from the Customer Service Unit were employees or former employees (an estimated 71%).

 

 

*Redundancy, Working Hours, Conditions and Terms of Employment, Payment of Wages and Unfair Dismissal were the main topics/issues dealt with during the period.

 

 

*The Workplace Relations Customer Services (which deals with complaints in relation to all employment rights bodies) received 11,787 Employment Rights Complaints between January and July of 2013. This number represents a significant increase on the same period in 2012 when 9,809 complaints were received.

 

 

*4,009 workplace inspection cases were completed in the first 9 months of 2013. These cases involved more than 44,100 employees. This represents a significant increase on the 2012 figure of 3,140. The amount of unpaid wages recovered totalled €583,650.

 

 

*In the period between January and September 2013, 33 cases were referred for prosecution. 47 convictions were recorded in cases heard by the Courts during the first 9 months of last year.

http://www.workplacerelations.ie/en/Publications_Forms/NERA_Update_September_2013.pdf

 

The Data Protection Acts state that personal information held by a data controller (the Company/Organisation) should only be retained for as long as necessary for the purpose(s) for which the data was obtained.  If the personal information is no longer needed, the data should be disposed of in a secure manner or deleted.

 

However, as the Data Protection Acts do not specify what the different retention periods are for the various types of data, companies are required to pay attention to the statutory obligations imposed on them through Employment Legislation when determining the relevant retention periods.

According to the Organisation of Working Time Act 1997, employers are required to keep several records in relation to employees’ leave and rest periods – Employers are obliged to record and keep details of Annual Leave, Public Holidays, Carer’s Leave, the hours worked by each employee each day as well as detailed records of start and finish times.

There are various requirements in terms of timeframes for the retention of these records, for instance;

• Annual Leave and Public Holiday records must be kept for 3 years

• Carer’s Leave records must be retained for 8 years

• Similarly, Parental Leave records and Force Majeure Leave records must be kept for 8 years

While there is no set period for the maintenance of Maternity or Adoptive Leave records, employers should ensure that they hold on to these details for a period not less than 12 months in the event that a dispute arises leading to a case – the time limit varies from 6 months to 12 months (in exceptional circumstances).

 

If, as an employer, you do not record employee working hours electronically (via a clock-in/clock-out system) you are required to complete a special form (an OWT1 form or a form not dissimilar to this) on a daily/weekly basis.

In relation to retaining hardcopy documents, it would be best to keep any original, signed documents on file as per the timeframes outlines above.

The key here is to ensure that the documents are available in the event that an inspection is announced. The records must be presented in a format that an inspector could easily understand.

Employers who fail to keep records as outlined above are liable, on summary conviction, to pay a fine of up to €1,900.

 

As an employer, you must be able to prove that you have informed each worker of his or her rights to rest/breaks. You must also be able to show that you have informed each worker that untaken breaks must be reported to you as the employer (or a representative of yours e.g. a manager).

If an employee claims that he or she was unable to take a break during work then the employer is obliged to look at the reasons for this. The employer is also responsible for looking at any health and safety issues that could have arisen as a result of this. As soon as is reasonably possible, the employer must allow the employee to take the rest period that was due to them. If the employee does not take the rest period at this stage then the matter is closed as the employer has fulfilled his or her duty by allowing the employee to take it.

Employers must even keep records on candidates who have aplied for positions within their company - even where the applicants have not been successful. The Data Commissioner considers a retention period of one full year to be appropriate in situations like this.