Displaying a Holiday Lists and GDPR

[Laanizare]

A simple question posed by an employee...

Is displaying a Holiday List (complete with names and dates of holidays) in contravention of the GDPRs?

 

[astutiumRob]

Who are you displaying it to ?

 

[Breffni Potter]

Where is it displayed and who has access to that area.

 

[Stitchbob]

As with so much of GDPR, the answer is "It depends". The key questions to get you started are "Why do you have the data?", "Who can see it?", and "Do they need to see it?"

As an employer, you clearly have a requirement to know when your employees holidays are. Whether that data needs to be displayed publicly depends on a number of factors. For example, if employees or customers are dependant on specific staff being in the office, you have a legitimate interest in making that data available to them. If you only allow two employees to book a holiday at a time, the employees have a legitimate interest in knowing what dates are available (but not necessarily who is off).

In your case, I'd focus on the reasoning behind the question rather than the question itself. Tell your employee that you display the data for x reason and you believe that is legitimate, but because the legislation is still very new, specific details like this haven't been tested. If the way you do things concerns them, of course you'd be happy to discuss it and welcome their feedback on more privacy-focussed ways to achieve what you need.