Policy on “Smart Data” Principles
Responsible***************GSB-DGO
Reference*****************CEA 2018
Approved*****************in June 2018
Entry into force***********01 July 2018
I.Purpose and applicability
The following principles have been agreed between Swisscom Ltd ("Swisscom") and the trade unions party to the Collective Employment Agreement (CEA). They apply to all forms of data processing within Swisscom to which, cumulatively, the following conditions apply (jointly referred to as "data processing"):
(i)The data processing concerns personal data of Swisscom employees ("employees") and is performed electronically; and
(ii)The data processing consists of an automated analysis of large, complex and rapidly changing amounts of data in respect of the creation or increase of added value with the help of algorithms (Smart Data).
II.Basic principles
A.General
1.Swisscom respects its employees' privacy in the workplace. For this purpose, Swisscom informs its employees in writing about the risks of any private use of the electronic work equipment and systems used by employees to perform their duties under the contract of employment. Swisscom is investigating the feasibility and economic efficiency of measures to separate private and business information by technological means.
2.Where data processing takes place, the mandatory statutory provisions shall be observed, particularly the mandatory provisions of data protection law, the code of obligations and employment law.
3.Swisscom only uses pseudonymised and/or anonymised personal data of employees in its data processing, provided this does not prevent or significantly impede the achievement of the purpose and the economic efficiency of the data processing. For the purposes of these basic principles, the achievement of economic efficiency is deemed prevented or significantly impeded if the costs or work required to use pseudonymised and/or anonymised personal data of employees considerably exceed the use derived from the processing.
B.Purposes of processing
4.Data processing may only be carried out for legal and legitimate purposes which may be specifically and explicitly identified.
5.Data processing must comply with the principle of proportionality.
6.No data processing for the purpose of monitoring employee behaviour in the workplace may be conducted. The same applies to the processing of physiological and/or biometric data for the purpose of effecting a productivity increase in employees.
7.The processing of location data is only performed within the customary working or operating hours, provided this does not prevent or significantly impede the achievement of the purpose and the economic efficiency of the data processing.
8.The personal data related to any data processing must be finally deleted once the intended purpose of processing has been achieved, unless there is a justification for retaining the data.
C.Information and rights of employees
9.Employees must be informed personally, clearly and transparently of the data sources, purposes of processing, procedure, consequences, recipient categories and storage location of data processing.
10.Employees have a right to information, correction and revocation with regard to the data processing, which may be exercised at any time.
11.Employees have the right to demand that decisions made on the basis of automated processes be reviewed by a competent person.
D.Consent to data processing
12.Data processing usually takes place without express consent by the employees. Where, in exceptional cases, data processing is to be based on the consent of employees, Swisscom will only obtain their consent if it may, in good faith, assume that such consent can be given on a voluntary basis.
13.Where consent is obtained from employees, Swisscom must explicitly inform employees that the granting of consent is voluntary. Moreover, employees must be informed that a refusal to grant consent will not have any negative consequences for the employees concerned.
14.Consent to data processing applies for a maximum period of two years.
III.Joint committee
15.The implementation of the "Smart Data" principles is overseen by a joint committee. This comprises six members, three representatives each of the contracting trade unions and Swisscom. The joint committee meets at least once a year and is informed of the data processing which has taken place in accordance with these principles. A joint committee meeting may be called on an ad hoc basis in the event of larger undertakings which, according to the spirit and purpose of the agreed principles, require the prior consultation of the contracting trade unions.
