Sensitive Personal Data in Employment

Sensitive personal data in employment refers to employee information that can cause significant privacy, financial, social, or professional harm if collected, disclosed, misused, or accessed without proper safeguards. In an employment relationship, such information may be held by employers, HR departments, payroll teams, insurers, occupational-health providers, background-verification agencies, and technology vendors.

In India, privacy protection in employment is closely connected with Article 21 of the Constitution, the Supreme Court's recognition of privacy as a fundamental right, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules). The SPDI Rules specifically include passwords, financial information, physical/mental health information, sexual orientation, medical records and biometric information within sensitive personal data.

1. Meaning in the employment context

Examples of sensitive employee information include:

• Bank-account and salary-payment information.
• Medical records and health conditions.
• Disability or occupational-health information.
• Biometric information such as fingerprints and facial data.
• Passwords and authentication credentials.
• Information concerning sexual orientation.
• Mental-health information.
• Medical-test and insurance records.
• Genetic or highly personal information where collected.
• Sensitive information obtained during background verification.
• Information concerning an employee's family or dependants where it reveals sensitive personal circumstances.

The SPDI Rules define sensitive personal data by reference to specified categories rather than treating every item of HR information as automatically "sensitive."

2. Why sensitive employee data requires protection

An employer often has legitimate reasons for collecting sensitive information. For example:

• Bank details may be required for salary payments.
• Medical information may be required for statutory benefits or workplace safety.
• Biometrics may be used for attendance or access control.
• Identification information may be required for legal compliance.
• Health information may be relevant to occupational safety.

However, the employment relationship involves an imbalance of bargaining power. An employee may feel compelled to provide information because refusing could affect employment or access to workplace benefits.

Therefore, collection should have a legitimate purpose and should not become an unrestricted right to examine an employee's private life.

3. Consent and purpose

Under the SPDI Rules, collection of sensitive personal data is subject to requirements concerning consent, lawful purpose, and necessary information. The Rules also require a body corporate handling such information to maintain an appropriate privacy policy.

In employment practice, a proper privacy framework should explain:

1. What information is being collected.
2. Why it is being collected.
3. How it will be used.
4. Who can access it.
5. Whether it will be transferred to third parties.
6. How long it will be retained.
7. What security measures protect it.
8. What rights or procedures are available to the employee.

4. Employer's legitimate interest versus employee privacy

An employer can legitimately monitor certain workplace activities—for example, attendance, access to confidential systems, or use of company devices.

But monitoring should not automatically extend to unlimited surveillance of an employee's private life.

The Supreme Court's privacy jurisprudence requires restrictions on privacy to satisfy constitutional requirements, including legality and proportionality where fundamental rights are implicated. The principle is particularly relevant when government employers or statutory authorities process employee information; private-sector employers may additionally face statutory and contractual obligations.

5. Biometric information

Biometric data deserves particular caution because fingerprints, facial characteristics and similar identifiers are closely connected to the individual and cannot simply be replaced like an ordinary password.

The Aadhaar judgment emphasised that biometric systems require safeguards from the collection stage through retention and access, and that the purpose for which the information is collected must be considered.

Accordingly, an employer using biometric attendance should consider:

• Whether biometric collection is actually necessary.
• Whether a less intrusive method is available.
• Who can access the biometric database.
• How long the data is retained.
• Whether the information is shared with vendors.
• What happens when the employee leaves.

6. Medical and health information

Medical information can affect an employee's dignity and employment prospects. Employers may legitimately require limited medical information—for example, fitness certification or information necessary for statutory benefits—but unnecessary circulation of detailed medical records may create privacy concerns.

Access should therefore ordinarily be restricted to personnel who actually need the information.

For example, the HR payroll team may need information concerning medical leave entitlement, while the employee's detailed medical diagnosis may not need to be available to every manager.

7. Financial information

Salary, bank-account details, tax information, investment declarations and benefit information can be highly confidential.

The SPDI Rules expressly identify financial information such as bank-account and payment-instrument details as sensitive personal data.

An employer should therefore use appropriate access controls and should avoid unnecessary circulation of employee bank or financial information through email, spreadsheets, messaging applications, or unsecured systems.

8. Disclosure to third parties

Employee data may be shared with:

• Payroll providers.
• Insurance companies.
• Background-verification agencies.
• Cloud-service providers.
• IT vendors.
• Government authorities where legally required.
• Professional advisers.

Such transfers should be controlled by appropriate contractual and security arrangements. The fact that an employee originally supplied information to an employer does not mean that every third party should automatically receive unrestricted access.

9. Data security

Protection of sensitive employee information requires technical as well as organisational safeguards.

Important measures include:

• Role-based access control.
• Strong authentication.
• Encryption.
• Secure HR databases.
• Audit logs.
• Employee-data classification.
• Vendor due diligence.
• Confidentiality obligations.
• Data-breach response procedures.
• Secure deletion or disposal.
• Periodic access reviews.

The SPDI framework specifically addresses reasonable security practices and procedures for sensitive information.

Important Case Laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1

This nine-judge Constitution Bench decision is the foundation of modern Indian privacy law. The Supreme Court recognised privacy as a constitutionally protected fundamental right, including interests relating to dignity, autonomy and control over personal information.

Employment relevance:
Employers dealing with highly personal employee information must recognise that privacy is not merely a matter of workplace courtesy. Where State action is involved, constitutional privacy principles become particularly important. The judgment provides the foundation for analysing collection, processing and disclosure of personal information.

2. K.S. Puttaswamy (Retd.) v. Union of India, (2018) 8 SCC 1 — Aadhaar case

The Supreme Court considered the constitutional implications of large-scale collection and use of biometric and identity information. The Court applied proportionality principles and stressed safeguards concerning collection, purpose, access and retention of personal information.

Employment relevance:
The principles are relevant where employers use biometric attendance systems, identity verification, facial recognition or other technologies involving sensitive employee information. Employers should consider whether the particular data collection is necessary and whether a less intrusive alternative exists.

3. People's Union for Civil Liberties (PUCL) v. Union of India, (1997) 1 SCC 301

The Supreme Court treated telephone tapping as a serious invasion of privacy and required procedural safeguards against arbitrary interception.

Employment relevance:
The case is useful when considering workplace monitoring, interception of communications and surveillance. Monitoring of employee communications should not be assumed to be unrestricted merely because the communication occurs through an employer-controlled system.

4. Selvi v. State of Karnataka, (2010) 7 SCC 263

The Supreme Court examined involuntary narco-analysis, polygraph and related techniques. It recognised the distinction between physical privacy and privacy concerning a person's mental processes and held that compelling testimonial responses raises serious constitutional concerns.

Employment relevance:
The case is relevant to intrusive employee investigations and attempts to obtain highly personal information. An employer's investigative requirements do not automatically justify invasive techniques affecting bodily or mental privacy.

5. Gobind v. State of Madhya Pradesh, (1975) 2 SCC 148

The Supreme Court considered privacy in the context of police surveillance. It recognised privacy interests while also explaining that privacy is not absolute and that legitimate restrictions may exist when supported by law and justified circumstances. The later Puttaswamy judgment discusses Gobind as an important stage in the development of Indian privacy jurisprudence.

Employment relevance:
The case illustrates the basic balance between legitimate institutional interests and individual privacy. In employment, legitimate security or disciplinary objectives must be distinguished from unnecessarily intrusive surveillance.

6. Navtej Singh Johar v. Union of India, (2018) 10 SCC 1

The Supreme Court's decision recognised constitutional protection for dignity, autonomy, equality and privacy in relation to sexual orientation. The Court's jurisprudence on sexual orientation is particularly relevant because the SPDI Rules expressly identify sexual orientation as sensitive personal information.

Employment relevance:
An employer should not unnecessarily collect, disclose or use information concerning an employee's sexual orientation. Confidentiality becomes particularly important because disclosure can expose an employee to discrimination, harassment or social consequences.

10. Practical compliance principles for employers

An employer handling sensitive personal data should generally follow these principles:

Conclusion

Sensitive personal data in employment requires a balance between legitimate employer requirements and employee privacy, dignity and autonomy. Information such as medical records, biometric identifiers, financial information and sexual-orientation information deserves heightened protection. India's SPDI framework specifically identifies several of these categories, while Supreme Court decisions such as Puttaswamy, Aadhaar, PUCL, Selvi, Gobind and Navtej Singh Johar provide important principles concerning privacy, proportionality, surveillance, bodily autonomy and personal information.

Key legal takeaway: collection of sensitive employee information should be lawful, purpose-specific, proportionate, secure, access-controlled and appropriately confidential, rather than treated as an unrestricted consequence of the employment relationship.