Poland’s Data Protection Authority  UODO weighs in on “employee of the month” postings in the workplace.

• The employer may, under certain conditions, display the best performance results in the workplace, based on his individual assessment.
• The processing of employees’ personal data for the purposes of the efficient and effective functioning of the workplace may be based on the legitimate interest of the employer.
• Therefore, the employer must demonstrate that his interest overrides the interests or fundamental rights and freedoms of the data subject (Article 6 (1)(f) of the GDPR). He should also consider whether he can improve the efficiency and quality of work by using other tools that are less intrusive to the employee’s privacy.
• Employers should not post employee evaluation results in an accessible location that shows which of them worked best and which did the worst and identifies them personally based on the assessment.
• A solution may be to distinguish a couple of people with the best results, so that at the same time it would not reveal who obtained the worst results.

Details from the Polish Data Protection Authority.

[View source.]