Comment by GTP
5 months ago
Well, if we're discussing whose data it is the information about how much I pay you, even from a devi's advocate perspective, you can't do better than arguing that this data pertains to both of us. So we should share the property of that data somehow. I don't see how you could argue that that data would be solely the employer's data.
If it has my name on it, it likely belongs to me. The portion that clearly belongs to the company, are the role, the amount, and my initials (maybe an anonymying number would be better?)
They're welcome to do what they want with that, but once it includes the ability to make inferences about me as an individual, more than the company, it becomes my data. I likely have to choose to share it to meet the terms of the emploment contract, but that doesn't change the appropriate ownership.
Try and apply whatever rules you want to IP the company claims to own? Surely the exact details of some trade secret process also belongs to me and I can do whatever I want with it because I need to know it to fulfill the terms of that same contract right? I can sell it to a 3rd party just 'cause right?
If I administer a survey, collect responses, and put them into a spreadsheet, is the data in that spreadsheet not mine despite the fact that it consists of things that other people told me? I can't share it without the permission of those surveyed, assuming I didn't promise not to?
These are answered questions. If you are talking about the raw data, you have to get the respondents to agree that their answers become your property (either implicitly or explicitly, there are rules around both), or no, you do not own the data in the spreadsheet.
A key distinction is that people need employment. People don't need to fill out surveys. That's why there are many things companies aren't allowed to require of their employees, that they are allowed to require of other parties.
So while, in many jurisdictions, it's fine for companies to sell data collected on their employees, and it could be argued that those employees consented to this data sharing by working there, one could also easily argue for an employee protection law that prevents companies from requiring their employees to consent to this.
It really depends on which kind of data you're collecting. If you're collecting health related data that is linkable to the people it pertains to, the GDPR would prevent you from sharing that data with third parties without one of the admissible legal basis, the most common of which is the consent of the people whose data you collected. In the case of health data, maybe even USA laws would prevent you from sharing it.
Edit: it is now some time since I studied the GDPR, so I'm actually unsure if, for healt-related data, it can be used any legal basis other than consent. The reason being that health, together with a few other categories, has special protections.
Technically sure, but the sort of people who live that way don't get invited out anywhere.