Exit interviews, namely interviews which employers hold with employees whose employment  is ending, are widely used by HR departments and may provide useful information regarding managing the workplace. In today’s piece, we will take a look at exit interviews from the perspective of data protection legislation.

Does any personal data processing occur in the context of exit interviews?

While exit interviews will vary in scope from employer to employer, we can assume that, as a general rule, they will touch on issues such as: (i) the reasons for the employee’s departure, or (ii) the employee’s opinions on the workplace collected, say, in a questionnaire completed by the employee. In this situation, an exit interview may lead to an employee’s personal data being processed, such as in the form of information on the reasons for the employee’s departure or the employee’s assessments of the workplace, particular departments, etc.

Therefore, when conducting exit interviews, employers should have regard for the requirements of the GDPR’s data protection provisions and the Labour Code. Below, we highlight the key considerations in this respect that should be taken into account when conducting exit interviews.

The purpose of data processing in exit interviews

From the point of view of managing the processing of personal data so that it is legally compliant, it is essential that the purpose of the data processing is defined. This is because the purpose of the processing will determine the scope of the permitted processing (including what data may be collected and how long it may be retained). There is no difference in a situation of processing personal data as part of exit interviews. Therefore, we recommend that employers that decide to conduct exit interviews should establish, as precisely as possible, the purpose of such interviews and, consequently, the purpose of the processing of personal data that will occur in connection with the interviews. For example, the data protection implications will be different, if the purpose of the exit interview is to find out the reason for the employee’s departure and different if the purpose is only to obtain general feedback from the employee about the workplace, e.g. benefits offered by the employer.

When determining the purpose of the interviews, we also advise that the employer should consider whether the information collected during the exit interviews (all or just a part) should be irreversibly anonymised immediately after the exit interview, or whether it should be collected anonymously, particularly by not recording the source of the information. Indeed, if for the purpose of the employer’s collection of information in an exit interview (say in the form of a questionnaire evaluating the employer), it is irrelevant who specifically provided certain information, then there is no justification for the employer to collect/store such data in a non-anonymised form. As a result, in such a situation, the employer should anonymise the data collected, in particular by having it processed/recorded in such a way that it cannot be established which employee provided the information and to whom it pertained. An effective and irreversible anonymisation of the data would also make it possible to assert that the GDPR does not apply to this data, which would significantly reduce the risks associated with the employer’s processing of this data. Significantly, the anonymisation would have to be carried out in such a way that the data subject (including the person who provided the data) could not be actually identifiable. In practice, due to the nature of the information provided or the factual circumstances, such as that only one person holds a particular position in the organisation, it may be sometimes difficult to achieve effective anonymisation.

Basis for processing data collected from exit interviews

Each processing of personal data (other than in special categories of data) must be carried out on one of the grounds stated in Article 6 par. 1 of GDPR in order to be lawful. This also applies to the personal data the employer collects during exit interviews. As a result, when deciding to conduct exit interviews, employers should identify an appropriate basis for processing the data they collect. It would appear that the most appropriate basis for the data processing may be Article 6 par. 1f of GDPR, namely a legitimate interest of the data controller; here, the employer.

Significantly, for the employer to be able to rely on a stated premise for the processing, it is necessary that it should carry out and document (for internal purposes, but particularly, in the event of an inspection) a balancing test before the processing starts, which should thoroughly assess the planned manner of the processing and demonstrate that the scope and manner of the planned data processing within the framework of exit interviews is necessary for the purposes that arise from the employer’s legitimate pursuit of its interests and, at the same time, the interests or fundamental rights and freedoms of the employee are not overridden by those legitimate interests of the employer. A similar view has been expressed in a publication posted on the website of the Polish Personal Data Protection Office (”UODO”) entitled “May an employer obtain information from an employee about the reasons for leaving employment?” (https://archiwum.uodo.gov.pl/pl/225/2227).

It is also worth emphasising that a favourable outcome of the above test will only be possible if the planned processing takes full account of the rules of processing that follow from the GDPR, including the principle of minimal processing, according to which the data processing should be adequate, relevant and limited to what is necessary for the purposes of the processing. As UODO points out in the above-mentioned article in the context of exit interviews: “(...) before deciding to process personal data, the data controller should assess whether the personal data are indeed necessary to achieve the purpose, or whether there are any other, less intrusive, ways of achieving it. The processing of data in an extent that is not necessary to achieve the purpose will be contrary to the GDPR.” Thus, a robust balancing test conducted before carrying out any exit interviews is essential for minimising the risks of breaching the GDPR. Above all, as a result of the test, it may become apparent that the originally intended way of conducting the exit interviews (e.g. the set of questions) may need to be modified or that additional measures may be required to minimise the risk of a breach. In addition, it is worth noting that it should indeed be simpler to justify the lawfulness of the processing of data in the context of exit interviews, if the data includes the employee’s general assessments of particular issues concerning the employer (e.g. assessments of management, quality of business equipment, office comforts or its location, attractiveness of the remuneration or benefits, etc.) than if the data includes an explicit indication of the reasons for the employee’s departure.

Alternatively, one may consider whether the employee’s consent may serve as a basis for processing personal data obtained during an exit interview. Nevertheless, to be valid under the GDPR, the consent must meet a number of conditions, such as, foremost, it be given completely voluntarily. In the context of the specific, fundamentally unequal relationship between an employer and an employee (even at its end stage), it is possible to have doubts whether the employee’s consent is being given completely freely (whether the employee might be afraid to refuse consent). Therefore, one should take great caution in relying on consent as grounds for the processing of data as a part of exit interviews.

Retention of data collected during exit interviews

In accordance with data protection legislation, personal data should not be processed or held longer than necessary for the purposes of their processing. This also applies to the personal data that an employer collects during exit interviews. As a result, employers that decide to conduct exit interviews should establish how long they will retain the data that they collect during them, namely the period for which the data will be kept generally or in a non-anonymised form. The period of time should be tailored to the purposes of conducting the exit interviews.

Transparency of personal data processing

One of the main principles of data protection law is that of transparency, which requires all data controllers to ensure that data subjects are adequately informed about the intended processing of their personal data in accordance with the requirements of Article 13 of GDPR. Employers are the data controllers of their employees’ data. Therefore, in the context of exit interviews, the above principle requires employers, as a rule, to inform their employees about the processing of their personal data that they intend to carry out in connection with conducting exit interviews. This should include, among others, the above-mentioned information on the purpose, basis and duration of the intended processing of personal data.

As for the practical implementation of the above requirement, employers have various options available. For example, appropriate information may be included in the general information clause on the processing of employees’ personal data that the employer provides to employees at the point of hiring. It also appears acceptable to provide an appropriate separate clause before an exit interview itself. From a practical point of view, we advise employers to arrange the provision of the information in such a way that they are able to demonstrate (e.g. in the event of an inspection) that they did indeed provide relevant information to employees.

What should be avoided?

In the context of planning for exit interviews and the practice of conducting them, it is worth noting the following points:

1. The recording of exit interviews raises additional challenges on regulatory grounds, including personal data law. Additionally, from the point of view of the purpose of such interviews, it will usually be difficult to justify that their recording is actually necessary. We therefore advise avoiding recording exit interviews, but if recording is chosen, then we advise assessing first very carefully the measures that should be implemented to ensure that the recording does not violate the law.
2. The processing of special categories of data, referred to in Article 9 of GDPR (personal data identifying racial or ethnic origin, political opinions, religious beliefs or worldviews, trade union membership and the processing of genetic and biometric data enabling the unique identification of an individual or data concerning that person’s health, sexuality or sexual orientation) is only admissible in exceptional situations. Exit interviews should therefore not lead to such data being acquired or recorded by the employer. For example, if an employee’s reason for leaving is health problems which the employee discloses during the interview, the employer should not record/store this information in any form.
3. The recording of employee data of particularly private nature (not necessarily included in the special categories under GDPR), such as about family problems or relating to persons other than the employee (e.g. persons unconnected to the employer) may often be not justifiable in view of the purpose of the exit interview. Its collection may also be outside the employer’s legitimate interest and thus it will be obtained without proper grounds. We therefore recommend that employers should not collect or record such data during exit interviews.

What should be done to reduce legal risks?

It should be noted that the implementation of exit interviews may result in new personal data processing arising for the employer. Therefore, such programmes should be implemented in compliance with any internal regulations at the employer regarding new processing and the requirements of GDPR, including the rules of processing under Article 5 of GDPR.

In addition, to avoid situations in which data from an exit interview is not processed properly in practice, in particular that personal data is collected that is outside the purpose of the process or that the employer does not wish to, or cannot collect it (such as special categories of data), we advise preparing an internal manual for exit interviews that can describe such issues as: (i) questions that may be asked of the employee, (ii) how the results of the interviews may be recorded, (iii) how and for how long the data may be retained, etc, (iv) possible ways of anonymising all or part of the collected data. This will not only reduce legal risks, but should also help in streamlining the process overall and increase the quality and usefulness of the information collected.

Łukasz Rutkowski

Karolina Romanowska