Statement (advice) of the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia on releasing personalised information on the amount of reward of an employee

The issue of the legitimacy of releasing or not releasing personalised information on the rewards granted to employees by state and local self-government bodies has recently become a matter of active discussions. Moreover, among other issues, this issue is also being considered from the perspective of protection of the personal data of employees.

Based on the aforementioned and accepting as a basis the power of the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia to give advice and inform about the best practice in data processing — prescribed by the Law of the Republic of Armenia "On personal data protection" — we deem it necessary to present the regulations of the existing legislation on transferring the personal data of employees to other persons (within the meaning of the Law, providing personal data to other persons and publishing personal data shall be considered as transfer of personal data).

Thus, first, it is necessary to mention that the issue of rewards granted to employees is an issue that is within the scope of employee-employer relations; consequently, we are dealing with employment relations and the personal data of an employee. In its turn, the Law of the Republic of Armenia "On personal data protection" prescribes the general principles and rules for processing personal data. Thus, in addition to the Law of the Republic of Armenia "On personal data protection", it is also necessary to observe the issue in question under the light of the regulations regarding personal data protection of employees in the Labour Code of the Republic of Armenia.

Pursuant to Article 8 of the Law of the Republic of Armenia "On personal data protection", both the consent of a person and the fact that personal data protection is directly provided for by other laws are among the foundations for development of a law on personal data. Pursuant to Article 134 of the Labour Code of the Republic of Armenia, "While transferring the personal data of the employee the employer shall be obliged to follow the following requirements: (1) not to disclose the personal data of the employee to third parties without the employee’s written consent, except for the cases when this is necessary for preventing the threat to the life and health of the employee, as well as in other cases provided for by law; (...)".

From the aforementioned it follows that, as a general rule, when transferring the personal data of the employee to other persons, the employer must, in accordance with the requirement of Article 134 of the Labour Code of the Republic of Armenia, be guided by the expression of will of the employee and not transfer his or her data to other persons without the written consent of the employee, unless otherwise provided for by other laws. As a result, the Code does not lay down only an imperative rule to publish the personal data of the employee without his or her written consent, but allows an exception, that is, publication of the personal data of an employee without his or her consent shall be allowed, where it is provided for by law, and vice versa — where publication of the personal data of the employee is prescribed by any law, it is necessary to be guided by the consent of the employee.

Taking into account the public resonance of the issue under consideration, we deem it necessary to emphasise that the advice that the Personal Data Protection Agency has given to different authorities in regard to salaries and rewards concern the general rules for processing the personal data of the employee and may not be interpreted as a conclusion on the lawfulness of publication or no publication of data in any case under consideration (the Agency examines the lawfulness of processing of personal data within the scope of proceedings, and there are no proceedings instituted in relation to any case under consideration). In each specific case, depending on the status of the employer, the status of the employee, the status of the person requiring the personal data of the employee or the case of transfer of personal data, it is necessary to identify the relevant legislation and clarify whether the right or duty of the employer to publish the personal data of the employee is prescribed by law in the given case or not, and it is necessary to be guided by the consent of the employee.