Yes.
The GDPR anticipates that a company may process personal data as long as one (or more) of six lawful purposes applies.1 One of those lawful purposes relates to the collection of personal data about a person as part of performing a contract with that person.
The Article 29 Working Party – the predecessor to the European Data Protection Board – recognized that a company is processing data for the purposes of performing a contract when it collects or processes “salary information and bank account details so that wages can be paid” to employees.2 Arguably the collection and maintenance of salary and payment details might also be based upon compliance with law (if local laws mandate that employees be paid for their services) and the legitimate interest of both the employee and the employer (if such information is also used for human resource management and/or to facilitate convenient forms of payment such as direct deposit over less convenient forms of payment such as check).
This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.
1. GDPR, Article 6(1)(a)-(f).
2. WP 259 Rev. 01 at 8
[View source.]
