Kayode Ibukunoluwa-Micah's Blog

HOW TO ALIGN HR PROCESSES AND PROCEDURES WITH GDPR

IS GDPR APPLICABLE IN NIGERIA?

Strictly speaking, GDPR is NOT APPLICABLE TO NIGERIA since Nigeria is OUTSIDE the EU economic area and she is NOT A MEMBER OF EU.
However, it is instructive to note that because of globalization and social media borderless transactions most countries are now working out compliance mechanisms including countries outside the EU.
Also, if an organization based in Nigeria transacts business with EU Nations it then means that such an organization must as a matter of necessity comply with the GDPR regulations.

Most importantly, too, based on my HR experience, I have noticed that a significant percentage of businesses in Nigeria have facebook pages or promotes their businesses on social media platforms and in some instances HR places advert on behalf of their organization using external servers that are hosted outside Nigeria. The import of this is that if your business or HR operations are connected to an online media such as Facebook, LinkedIn, social media platform or hosted on a server in EU countries then you are under the covering of GDPR.
Note that with effect from April 2018 Facebook took the decision to implement the EU’s General Data Protection Regulation in all its operation across the world.

HOW TO ALIGN HR PROCESSES AND PROCEDURES WITH GDPR

It is important to state here that GDPR is a “Principal-Based” legislation which implies that the burden of ensuring compliance lies with the data-collecting entity as against the original owner of the data. For example, if “A” sent his CV to XYZ Nigeria Limited, it is the duty and responsibility of XYZ Nigeria Limited to ensure that A’s data is protected. Such failure could result in litigation taken into consideration the opportunistic orientation of some individuals.

To this end, HR has the herculean task of putting in place appropriate procedures and policies that will adequately protect the information of employees as well as job applicants otherwise the organization may be sued for unethical use or disclosure of personal information.
1. Proactively redesign overall HR policies to incorporate data protection right and transparency in the use of employees and applicants’ personal information.

2. Include a data processing addendum on documents that relate to employee’s information and that of applicants alike. This addendum should be written in HR forms and online transmissions and should contain a clear explanation on how personal information would be used.

3. It should be noted therefore that applicants and ex-employees’ information cannot be stored beyond a required time and once the staff is no longer in the company employee such information should be deleted within a reasonable time frame. However, it is sometimes necessary that ex-employees files are kept, especially personal file for reference purposes, what should be the practice, in this case, is to ensure that in the application form a consent agreement is drawn in which the employee gives permission for his or her data to be kept by the organization.

4. Personnel information should henceforth be protected from external threat.

5. There should be a high level of transparency in the use of applicants and employees data by an organization.

6. Theft and loss of personal data in the company’s custody should be communicated and reported to the person concerned.

7. HR should institute training support to prepare the organization ahead.
In conclusion, as pointed out in the preceding pages, GDPR is essentially an EU legislation which impacts cut across the world and because Nigerian businesses play in the global arena, a proactive policy measure is required by organizations especially at the level of HR to ensure compliance so as not to fall foul of data protection right of employees as well as those of job applicants.

In the words, of Tim Cook, Apple Chief Executive, I’m personally not a big fan of regulation because sometimes regulation can have unexpected consequences to it, however I think this certain situation is so dire and has become so large, that probably some well-crafted regulation is necessary,” March 24, 2018.
It is the opinion of this writer that the need to protect employees or applicants information should be given full attention from abuses through a well-structured HR policy so as to be ahead of likely legal issues due to such exposure as provided by the implementation of GDPR in Europe.

Start reading from GENERAL DATA PROTECTION REGULATION (GDPR) IMPLICATIONS FOR HR PROCEDURES AND PRACTICES

Sharing is caring!