Question: All kindergarten teachers have official work email accounts, but we are unable to create work email addresses for non-teaching staff. We would like to collect private email addresses from support staff in order to send them materials electronically, such as health and safety training presentations, pension scheme (PPK) training materials, and information related to work organization. How can we do this in compliance with GDPR? Should we use a specific form? Can we require employees to provide a private email address, or is this entirely voluntary?
Answer: In the case of private email addresses, providing them by employees is only permitted with their consent. This means the employee must have a real possibility to refuse (without facing negative consequences). In other words, lack of consent must not prevent access to training or information. In the employer–employee relationship, the voluntariness of such consent may be questioned by the Data Protection Authority due to the fact that the employee may feel pressured to give consent and may be afraid to refuse (which makes the consent not truly voluntary).
Since the information to be sent is of organizational nature only, we suggest two solutions that help avoid collecting and using private email addresses:
- One shared email account – to distribute information, the institution may consider creating one shared email account, which staff could log into and use to access training materials and other information.
- Creating individual accounts for each employee using a commercial email service. Such accounts would be used only for the purpose of sending the above-mentioned materials. We recommend that the email address not include the employee’s full name — using initials instead, for example.
Of course, setting up one shared or several individual accounts involves using free, commercial email services, which we generally advise against. However, in this specific case, you may assume that employees’ private accounts are also created with free commercial providers. Furthermore, no correspondence containing personal data will be sent to those addresses.