Contradicting challenges: the complexity of documenting personal information in a regulatory environment

Abstract

Purpose

Many organizations are challenged by different and, perhaps, opposite, registration and protection obligations of information regarding their employees. The purpose of this paper is to explore how organizations balance the registration obligations of the Icelandic equal pay standard (EPS) and the protection requirements of the general data protection regulation (GDPR). It aims to raise awareness of how information professionals can ensure that documentation on the education and skills of employees is authentic, traceable and secure.

Design/methodology/approach

The analytical framework covered multiple-cases and semi-structured interviews with various professionals and comprehensive documentary analysis.

Findings

The findings indicate that the organizations were not properly prepared for the implementation of the EPS and were hesitant regarding further registration of personal information due to GDPR. Documentary analysis also revealed critical attitudes towards the legal endorsement of the standard and its potential success.

Originality/value

There is a lack of studies explaining the juxtaposition of information and records management and the legal and regulatory environment. This paper provides a unique description of how information and recordkeeping practices function with the requirements of the EPS whilst complying with GDPR. The results could bring valuable opportunities for the information profession regarding the development, implementation, administration and maintenance of documentary evidence regarding the requirements of international and national standards and legislations and advance their collaboration with other professionals in the management of information.

Citation

Haraldsdottir, R.K. and Gunnlaugsdottir, J. (2022), "Contradicting challenges: the complexity of documenting personal information in a regulatory environment", Records Management Journal, Vol. 32 No. 1, pp. 1-20. https://doi.org/10.1108/RMJ-06-2020-0023

1. Introduction

The legislation of the Icelandic Standard of Equal Pay No. 85:2012 (EPS) (Icelandic Standards, 2012), requires organizations to document information on the knowledge of employees as records of evidential value (Ministry of Welfare, 2018b, 2018c; Icelandic Standards, 2012). Iceland is the first country to require organizations to acquire a standard certification for their equal pay systems (Sigmarsdottir, 2018; Ministry of Welfare, 2018a). The equal pay standard (EPS) claims that “all decisions on wages and employment terms [must be] documented, reasoned and traceable” (Icelandic Standards, 2012, p. 7). Organizations are required to document, implement, sustain and continually optimize their equal wage management system. The EPS guidelines state that jobs must be evaluated against each other and a weight assigned to each. This includes the cognitive and physical competence that a job requires. This may include competences consisting of experience, training and education or the “knowledge obtained by education or experience, cognitive skills, initiative and independence and communication skills” (Icelandic Standards, 2012, p. 18). Simultaneously, the general data protection regulation (GDPR), Act no. 90/2018 on data protection and the processing of personal data, calls for minimum data. According to GDPR, registered data should be adequate, relevant and limited to what is necessary for the purpose of documentation (Romanou, 2018, p. 102). The EPS and GDPR may impose contradicting challenges to the documentation of personal information in organizations. Whilst documentation of the personal knowledge of employees in a knowledge directory may play a key role in fulfiling the requirements of the EPS (Ministry of Welfare, 2018a (Article 11); Icelandic Standards, 2012; Ministry of Welfare, 2018b), personal data must be protected in accordance with the GDPR (IT Governance Privacy Team, 2016).

There are minimal empirical studies explaining organizational preparations for the requirements of the EPS regarding the registration of knowledge whilst complying with GDPR. This study seeks to address this research gap by examining what preparations organizations have taken to implement the EPS in their operations. The focus is on the personal knowledge of employees, i.e. their education, training and skills whilst emphasizing the intersection of registration, access and use of documented information. This is done from the standpoint of information and records management and quality management. To summarize, the paper addresses the following research question:

RQ1.

In what way, if any, has the legislation of the EPS and GDPR impacted the registration, access and use of the personal knowledge of employees in organizations?

The paper is organized into nine sections. After the introduction, Sections 2 to 5 focus on the theoretical background of this research. Methodology is presented in Section 6. Section 7 contains the key findings. A discussion is covered in Section 8 whilst Section 9 contains an outline for future research and conclusive remarks.

2. The Icelandic context

According to the World Economic Forum Index, Iceland is the top runner for the 12th year in a row, closing more than 89.2% of its overall gender gap (World Economic Forum, 2021; Marinosdottir and Erlingsdottir, 2017). With the first democratically elected female president (Henley, 2018), Iceland has even been described as “the world’s most feminist country” (Bindel, 2010). Still, critics claim that Iceland is no feminist paradise. It seems to be equal on paper, but not in practice (Rudolfsdottir, 2014; Rudolfsdottir and Johannesdottir, 2018; Olafsdottir, 2018). Studies show that women are outnumbered by men in positions of authority (Juliusdottir et al., 2018). There were no female CEOs in 2019 in the 18 listed companies in the Iceland-Nasdaq stock market. In addition, there are only two female CEOs in Icelandic pension funds (Asta Dis Oladottir et al., 2019). A recent study conducted in a heavy industry plant in Iceland showed that despite managerial support for a 50/50 gender policy, the interviewees thought the policy was unrealistic and ultimately would not succeed (Rafnsdottir and Weigt, 2019). Studies have also revealed that despite the alleged Icelandic gender paradise, female managers are stuck with additional jobs caring for the young, sick and the elderly much more than their male colleagues (Juliusdottir et al., 2018).

In January 2018, a bill was passed in the Parliament making it illegal for organizations with 25 or more employees to pay men more than women for work of equal value (Ministry of Finance and Economic Affairs, 2018; Gray, 2018). A total of 1,180 organizations with approximately 147.000 employees must acquire the EPS which is around 80% of total employment in Iceland. Of those, 269 organizations should have completed their certification by the end of 2019 (Icelandic Standards, 2020). In January 2020 only 156 organizations had been legally certified according to the EPS (Jafnretti.is). Only three out of 56 municipalities in Iceland expected to obtain the EPS certification in 2019 had succeeded (Morgunbladid, 2019a). Prior to the EPS becoming law, a small pilot group took the lead in 2012. One of these was the Directorate of Customs where the HR manager claimed that “implementing the [Equal Pay] standard was pure quality management” (Kristjansdottir, 2017). A senior advisor from the Ministry of Welfare stated that “[t]he pilot was an eye-opener” and that the experience had revealed that “[n]o employers want to discriminate, but the structures exist in such a way that they do – it is simply a result of the unconscious gender bias in our societies” (Erlingsdottir, 2017).

A registry of certified organizations is maintained by the Centre for Gender Equality. Monitoring of the EPS takes place through rectification measures. Should an organization fail to act in accordance with the required implementation, the Centre for Gender Equality is authorized to impose per diem fines (Ministry of Welfare, 2018c). Per diem fines have not been imposed so far according to correspondence at the Centre for Gender Equality (Kolbeinsson, 7 February 2020 [e-mail]). Since June 2019, four Icelandic certification services have had permits to audit organizations according to the EPS (Ministry of Welfare, 2018a). Lack of certification services may be a part of a bottleneck syndrome experienced with the slow rise in certified organizations according to the Director of the Centre for Gender Equality (Morgunbladid, 2019b).

Reviews received by the Parliament prior to the legalization of the EPS revealed serious reservations regarding how Icelandic supervisory authorities would be able to regulate the standard due to a lack of funding and staff. Former experience from the financial crisis in 2008 in Iceland may partly explain this criticism. It showed that domestic enforcers such as the Central Bank, the Financial Supervisory Authority and the ministries in charge of economic affairs were understaffed and lacked the experience to manage a large financial sector (Benediktsdottir et al., 2011). Iceland has received lots of international attention due to the EPS (Sigurdardottir, 2018). It is, therefore, crucial to do things right from the beginning as “we have been bragging about this all over and if this turns out to be a fiasco, then why go-ahead to begin with”? (Hardardottir, oral reference, March 1st, 2018).

3. Information governance – obligatory registration of personnel records

The legislation requires organizations to document information on the knowledge of employees as records of evidential value (Icelandic Standards, 2012). Thus, strategic information and records management can support organizational compliance with the EPS by managing information and records as evidence of business activity and accountability as stated in ISO 15489 standard (ISO, 2016a). The EPS has the possibility to change the way work is performed in organizations, not only as regard equal pay but on information governance in general. Information governance has been explained as the “strategic, cross-disciplinary framework of standards, processes, roles and metrics that hold organizations […] accountable for the proper handling of information assets” (ARMA International, 2016, p. 28). Brooks states (2019) that “the truly new and valuable characteristic of information governance is its focus on meaningful collaboration in meeting information challenges”. Study results from Gunnlaugsdottir (2012) show that the main reasons for organizations for obtaining quality management certification were demands from customers and public authorities and more disciplined work procedures and increased traceability which benefitted management. Also, organizations involved in international businesses thought the certification was a great advantage.

International management system standards, for instance, ISO 9001 and ISO 27001, interrelate with ISO15489 standard for information and records management due to their documentation requirements (Brumm, 1996; Gunnlaugsdottir, 2012). The same applies to the EPS which is “in substance and form similar to international management standards” (Icelandic Standards, 2012, p. 5). Standards, as defined by ISO/IEC Guide 2, may be mandatory or voluntary (ISO, 2016b). Still, standards are in their essence a “document approved by a recognized body, that provides, for common and repeated use, rules, guidelines or characteristics for products or related processes and production methods” (World Trade Organization, 2018). Icelandic standards are written when interested parties find it necessary, due to circumstances or since there are no previous European or International Standards that cover the circumstances (Icelandic Standards, 2012). The EPS is in many cases the first standard to be implemented in Icelandic organizations. It is, therefore, the first time that many of these organizations are required to fulfil strategic information and records management of any sort.

4. Registration requirements of the equal pay standard

In the EPS it is stated that the organization shall ensure that all employees “involved in the decision on wages […] are qualified […] in terms of appropriate education, training and experience”. It is expected that the organization “maintain[s] appropriate records on the subject”. It is required that the organization not only identifies the need for training but fulfils those needs and maintains appropriate records on the subject. Simultaneously, personal data must be protected in accordance with the GDPR (European Commission, 2018; IT Governance Privacy Team, 2016). As claimed by Anderson et al. (2017) the tension between expected benefits and potential security risks in information sharing exists in many domains. As with information on personal health, “security controls must be sufficient” to protect data but “not restrictive to the point that they impede interoperability” (Anderson et al., 2017, p. 1085).

The EPS contains a list of the necessary documentation for the equal wage system. This includes an equal wage policy and its objectives. Also, the wage formation system, i.e. the criteria on how wages are evaluated “relating to qualifications and performance”, all decisions on wages and terms, together with all related data on which decisions are based such as job classifications, job descriptions and “sources of information on the evaluations of individual jobs or employees” (Icelandic Standards, 2012, p. 11). Organizations determine whether and how personal factors or group factors are compensated, i.e. what object criteria are used. The EPS includes a description of the control of documents. It states that the organization shall maintain processes to approve that documents are satisfactory prior to issue and to reapprove documents as needed. The EPS also requires that all changes made to documents are identifiable and correct versions of documents are available and legible. It is required that the organization ensures that external documents that the organization deems necessary for organizing a functioning wage system are identified and to prevent the use of outdated documents.

Section 4.5.4 of EPS deals with the control of records and includes the requirement that organizations must “establish and maintain all records necessary to demonstrate compliance with the requirements of the equal wage system and the Equal Wage Standard and the results achieved” (Icelandic Standards, 2012, p. 12). The organization must implement and maintain “processes for the identification, preservation, safeguarding, recovery, retention time and disposal of records”. These processes are in accordance with the GDPR regulation as an essential step to “strengthen individuals’ fundamental rights in the digital age and facilitate business by clarifying rules for companies and public bodies in the digital single market” (European Commission, 2018).

In Annex B of the standard, it is stated that jobs must be evaluated against each other and the weight assigned to each (Icelandic Standard, 2012). This includes a criterion of competence which is the cognitive and physical competence that a job requires. This can include “knowledge obtained by education or experience, cognitive skills, initiative and independence and communication skills”. This competence may consist for instance of experience, training and education which relates to personal knowledge registration (PKR). The criterion of competence has the greatest impact on the job assessment according to the example in Annex B or 40%, whilst responsibility has 30%, the strain has 20% and working conditions 10% (Icelandic Standards, 2012, p. 18).

GDPR data controllers are the organizations that are responsible for abiding by the requirement of informed consent. Ensuring employees’ consent to having their personal data processed is a critical component to preserving their rights and adhering to the privacy principles (IT Governance Privacy Team, 2016, p. 183). Data controllers are, furthermore, required to create documentation and processes that include the management of information assets. Thus, a register must be created to show the present data, who can access the data, where it is located, what the purpose of collecting it is and for how long it will be kept (Harvey, 2017).

5. Registration, access and use of personal knowledge

Records management has undergone significant changes in its evolution to remain relevant to the needs of organizations (Lomas, 2010; Haraldsdottir et al., 2018). Almost anything that has information of evidential value can be managed as a record (DML Forum Foundation, 2010, p. 24). Organizations are, for instance, becoming more interested in assessing, managing and developing their intellectual assets, including the knowledge of their employees (Buenechea-Elberdin et al., 2018). Still, few organizations have a way to systematically track the skills of their employees or to estimate what skills they lack (Barley et al., 2018; Haraldsdottir et al., 2018; Hesse, 2017). To document information and records on the education of employees, expertise and skills as required by the EPS is a pursuit of information governance. Information governance is a multidisciplinary approach to minimizing risks such as rectification measures enforced by standards or legislation, whilst maximizing the value of organizational information (Brooks, 2019). The registration requirements of the EPS have an impact on how documentation of personal records of employees is processed in HR divisions. A prerequisite for implementing an equal wage management system in accordance with the standard is to ensure that “all decisions on wages and employment terms are documented, reasoned and traceable” (Icelandic Standards, 2012, p. 7).

The term personal knowledge registration and the abbreviation PKR have been introduced before in relation to the process of managing HR documents (Haraldsdottir and Gunnlaugsdottir, 2018). In their study, PKR was defined as a part of personnel records that are habitually related to human resource management systems (HRMS), human resource information systems, the information registered into the learning and development module of talent management systems and human capital management systems as described by Kavanagh and Johnson (2017). PKR has been used to denote both the registration process and at times the registry itself. The registration of the knowledge of employees may play a key role in fulfiling the requirements of EPS. To better understand the concept of PKR a conceptual model was created, Figure 1. The model is partially built on Haraldsdottir and Gunnlaugsdottir (2018).

Based on the assumption that managing personal knowledge is a multi-professional task, the conceptual model represents six facilitators of PKR on the left side. Tasks and qualities of these facilitators are placed on the right-side placing the concept of PKR in the middle. Each task and quality are then further described on the far right side of the model. The yellow circle represents the legal environment in which PKR resides. External factors such as legislation regarding the protection of personal data (GDPR) and the EPS affect organizations as new legislations require a certain re-creation of formal [and informal] structures. The selection, registration and access of information regarding personnel records make it possible to manage personal knowledge for both individual and organizational purposes (Haraldsdottir and Gunnlaugsdottir, 2018; Palmer, 2002). Documentation ensures the transparency of educational information used in an equal wage system, which is a prerequisite for the EPS. The intention of PKR is to create an overview of the accumulated knowledge embedded in the employees (Hase and Galt, 2011; Henttonen et al., 2016). Figure 2 represents an example of how PKR may be maintained to support the implementation of the EPS whilst complying with GDPR.

Figure 2 presented here is built on a previous model made by Haraldsdottir and Gunnlaugsdottir (2018). The development and implementation stage and the last stage, maintenance of evidence, which is interrelated to the registration requirements of the EPS, is an addition to the original model. Each stage is further described on the right side of Figure 2. The model demonstrates how the PKR process may benefit from the expertise of information and records professionals in the classification, indexing and content analysis of information right from the very beginning of the development and implementation stage. The same applies to each task involving the selection, registration, organization and administration of personal knowledge (Franks, 2013; Saffady, 2016). Information and records professionals, in coalition with information technology (IT), human resource (HR) and training, as well as quality managers, may “act as mediators between the system developers [IT], standards [EPS] and the system users [HR, training, quality managers and individual employees]” (Foscarini, 2010, p. 390). Their professional knowledge of the registration requirements of the EPS and the data protection prerequisites of GDPR may augment the PKR process and help administer the system.

6. Methodology

The purpose of this paper was to explore how organizations balance the registration obligations of the EPS whilst complying with the protection requirements of GDPR. The aim was to provide an understanding of what actions organizations had taken to prepare for the EPS, with a focus on whether PKR was being registered differently due to recent auditing and legal requirements. It sought to answer the following research question:

RQ1.

In what way, if any, has the legislation of the EPS and GDPR impacted the registration, access and use of the personal knowledge of employees in organizations?

This research is a part of a larger multiple case study. Data collection for this part of the study took first place in 2010–2012 and again during 2014–2016. A total of 12 organizations were visited during this part of the data gathering. According to Neuman, we study a case because it is a part of some grouping of – type or kind – that we study to develop knowledge about causes of similarities and differences (Neuman, 2011). A multiple case study allows the researcher to analyse within each setting and across settings. Thus, several cases were examined for this research to understand the similarities and differences between the cases (Baxter and Jack, 2008). In January 2018 it was decided to revisit 8 organizations out of 12 as further clarification was needed about the EPS and GDPR. Those eight organizations represent the data analysed in this paper.

These cases were purposefully selected from two groups. Group one included the organizations named A, B, E and F that had been studied in detail whilst group two contained the organizations named H, I, K and L which had been selected as a corroborative interview group by using snowball sampling (Neuman, 2011; Haraldsdottir and Gunnlaugsdottir, 2018). The organizations from both groups were divided equally between the private and the public sector. In the eight organizations participating in 2018, it was possible to contact the same interviewees as in 2010–2012 and 2014–2016. One of the advantages of this approach is the close collaboration between the researcher and the participants to enable participants to tell their stories (Crabtree and Miller, 1999).

Using a qualitative methodology and interpretative paradigm was considered appropriate for addressing the research question. As qualitative methods produce a wealth of detailed data on a relatively small number of participants (Patton, 1991) they were the most relevant choice for grasping the collaborative aspects of the EPS and GDPR in relation to PKR. The methodology was also suitable for examining documentary material regarding the Icelandic Standard of Equal Pay no. 85:2012, the 21 reviews sent to the Parliament and the media. These were studied as possible stimulants and/or hindrances for personal knowledge registration in organizations. Grounded theory was used to analyse the data gathered (Charmaz, 2006; Charmaz and Bryant, 2011; Glaser and Strauss, 2017). Using triangulation, as in this research, involves using several kinds of data collected from various sources (Janesick, 1994). It is an attempt to ensure an in-depth understanding of the topic being studied. Table 1 gives an overview of the participating organizations in this paper.

Four interviewees from the first group (A, B, E, F) consisting of two information and records professionals and two HR managers and, four interviewees from the first corroborative group (H, I, K, L) based on the same selection were contacted via e-mail. In the message, the eight interviewees were asked to evaluate the following; what preparations their organizations had made to fulfil the registration requirements of EPS; how, if at all, PKR was being registered differently due to recent auditing and legal requirements; in what way added PKR complied with GDPR and in what manner EPS and GDPR had if at all, affected the roles and responsibilities of information and records managers within the organizations. Documentary material was collected simultaneously. A total of 24 interviews were included in this study. See Table 2 for an overview of the number and timing of the interviews conducted.

The eight interviewees in 2018 were purposefully selected. Their knowledge and experience of the EPS were considered important and their position to evaluate if and how PKR had changed, as the preparations for the EPS began. In line with the exploratory nature of the research, it was decided to keep a low degree of structure in all interviews whilst still focusing on specific situations from the place of work of the interviewees (King, 1999). All interviews were recorded to maintain a level of accuracy and to ensure accurate examination during the analytical part of the research.

Discourse analysis was used on documentary material (Wetherell, 2001; Gee, 2014). The analysis requires that documents are interpreted to elicit meaning, gain understanding and develop empirical knowledge (Corbin and Strauss, 2008). The EPS was analysed to identify how documentation of evidence was formulated in the text. Studying the documents allowed for the identification of written requirements of the standard. Additionally, a total of 21 reviews from stakeholders to the parliament on the EPS were examined for corroborative purposes as was documentary material published in media. The purpose of the analysis was to better understand whether the perceptions of the interviewees in the participating organizations were mirrored in the textual discourse in and around the EPS. The analysis of the documentary material was interlinked with the analysis of the interviews to better ensure the validity and reliability of the findings (Golafshani, 2003).

Iceland is a small community. The risk of revealing the identity of the participants was considered high. Thus, it was appropriate to disguise individuals and their places of work (Gorman and Clayton, 2005). Pseudonyms were used by either referring to the job title or simply “interviewee” and the organizations were assigned a letter of the alphabet to ensure that they could not be identified in the findings. Handling all information with strict confidence in order not to reveal the identity of the individuals or the organizations during the data collection was strongly emphasized (Esterberg, 2002; Kvale, 1996).

7. Findings

7.1 Preparations for the equal pay standard in relation to personal knowledge registration

The organizations had all started to prepare for the implementation of the EPS.

• The information and records manager in Organization A stated that the organization had already implemented EPS in 2015 which she said would make it easier for them to adjust to the new certification. All documents and records regarding their policy on equal wage were registered into an electronic records management system.

• The information and records managers in Organizations B and K claimed that they had no role regarding the preparations for EPS. They both said that these matters were in the hands of lawyers and HR managers within their organizations.

• In Organization E the HR manager claimed that necessary preparations for the equal pay system had just recently begun, processes were being reviewed, as well as processes and records management of related documents.

• The HR manager in Organization F stated that they had started but not just because of the EPS but due to requirements from labour unions and collective wage agreements regarding the registration of knowledge, as well as to protocols from the financial management authorities.

• The training manager in Organization H agreed and said that their preparations had just started. “We have been very busy as there is a lot to be done to prepare for the standard!”.

• The HR manager in Organization I stated that the organization had already an extensive PKR database in their HR system. Their preparations involved extracting the files they already had to be able to calculate the “correct” wages of employees in accordance with their predefined jobs. “The process is quite difficult”, said the HR manager as the protocol available for such classification of jobs was “highly limited”.

• The information and records manager in Organization L stated that the EPS had been presented to the staff in early 2017. Two representatives were selected among staff members to manage the preparations, but one had since resigned and the other was not able to finish the project. After hiring an external advisor, the process had begun again in 2018. They would start by “reviewing processes regarding records management in general, as well as focus on records regarding quality management and internal audit”.

7.2 Changes in the personal knowledge registration process due to the equal pay standard and its legislation

The interviewee in Organization A stated that EPS and its legislation had pushed the PKR process forward. She said that employees were better aware of the value of their educational documentation and more willing to have their documentation registered into the HR system. She claimed that the requirements on managers to monitor their employees about education, skills or experience, was greater than before. She stated that these changes were due to the registration requirements of the EPS. She also stated that PKR was no longer simply preserved on paper. PKR was registered into electronic information systems whilst only accessible to those who necessarily needed access.

The HR manager in Organization E claimed that their registration of the personal knowledge of employees had been “in an organized form” for a whilst. Still the requirements of the equal wage system called for an even more structured form. Organization E had decided to implement a new HR system and the HR manager was expecting to be able to manage PKR more effectively in the new system.

The HR manager in Organization F stated that the preparations for the EPS had only just begun and the PKR process was still lacking. She said that they were expected to register more information than before on personal knowledge, but not only due to the standard. She described requirements originating from general wage agreements which included a pay raise in accordance with formal education. Being a public organization, organization F was also required to register certain information on the educational background of employees into their payroll system. For this to happen they needed more documentation.

“We have recently implemented a new HR system and our PKR registrations for the past 8–12 months are better than before”, said the training manager in Organization H. He continued “we have not changed much in the process and still use a scanner to paste information on formal and informal education based on certificates produced by employees”. He stated that it would be better if this information was properly registered into the system, not simply scanned, as it would help with the overview. He claimed: “We are still struggling to gather all information regarding the personal knowledge of our employees” and explained that employees had been using e-learning without registering it into their PKR system. “It was by mere chance that I found out when obtaining a username to this e-learning website […] and I had no idea about it”. Despite the lack of registrations, the training manager found it very positive that the employees were seeking the knowledge they needed.

The interviewed information and records manager in Organization L stated that the legislation of EPS had not yet changed how they handled the knowledge of employees. Registrations were still lacking and copies of university diplomas were only kept in a locked drawer in the HR office. She said that they had recently started to scan existing documentation and link it to the personnel files of employees, but the project had just begun.

The registration of personal knowledge had not changed due to the legalization of EPS according to the HR manager in Organization I. The knowledge and experience of the employees were already considered an asset and they had, therefore, made sure to register everything. “We must know what we are capable of to sell our service”, she said.

7.3 How to balance different requirements of the equal pay standard and general data protection regulation

The interviewee in organization A maintained that their information processes were in accordance with GDPR. She maintained that employees gave their informed consent, for the collection of personal data and knew for what reasons it was collected. The HR manager in organization F had not been aware of there being any preparations for GDPR in her office. She claimed not to be involved in the process and had not “looked into the matter well enough to have an opinion”.

The HR manager in the organization I said that there were a few things to consider. She stated: “We need our employees to sign an informed consent for us to use the information we have gathered in our PKR database outside of the organization” and continued “but, I have just realized that we still need to have their informed consent for using the same information within our organization”. She said that most employees already had access to the PKR database in their organization and could, therefore, look for specific knowledge. “It took years to get this to function as we wanted it to”, she said. “The point of having it all in the open is for the employees to kind of sell their own experience, education and skills” and, thereby, get more interesting projects.

The interviewee in organization L said that a lawyer and an information and records manager in the organization had attended courses on how to implement GDPR but the process of registering personal information at the office had not started. Personal files were kept on paper in the HR office, but most files were also kept with very limited access in their records management system.

“The GDPR process is ongoing for sure”, the training manager in organization H stated. The work is mostly in the hands of our legal division and as in organization L, the HR manager was not yet involved in the process. He had thought about the balance between the registration requirements of EPS and GDPR and said he expected that issues might arise as experience would grow. Still, he stated that he experienced the legislation of EPS and GDPR in a positive way as it encouraged disciplined work processes. “We need more discipline in the HR division” he stated.

Organization E had started its preparations for GDPR according to the HR manager. They had put together a workgroup on the subject and appointed a data protection officer. Regarding the balance between the EPS and GDPR, she claimed: “This is one of those aspects that we are looking into”. She added: “We foresee that we need to have permission from our employees to register their personal knowledge”.

7.4 The employees responsible for personal knowledge registration

Four information and records managers were asked how the EPS and GDPR had if at all, affected their roles and responsibilities within the organizations. The findings indicate that they were not more involved in the PKR process than prior to the advent of the EPS.

The HR managers in organizations E and F are expected to supervise their PKR process. The HR manager in organization E added that she expected her colleague, a training manager, to cooperate with her on the registration process. The training manager in organization H claimed to be hoping to be able to hire new employees; one for information and records management and another for organizational training. He stated that the current “office buzz” prevented him from being proactive enough for PKR. The HR manager in Organization I claimed that PKR was a collaborative project, but the administration of the system was collective between HR and training.

8. Discussion

8.1 Organizational preparations for equal pay standard in relation to personal knowledge registration

Previous research has shown that HR or training managers collected certificates from employees as proof of necessary qualifications (Haraldsdottir and Gunnlaugsdottir, 2018). These registrations had evidential value for the benefit of employees and for organizations to provide answers to monitoring institutions such as the Financial Supervisory Authority or the Centre of Gender Equality. In this way, PKR provided documentary evidence of personal knowledge as required in EPS. Still, organized registration of employees’ knowledge was lacking.

There were various explanations for the current status of preparation. Organizations A and I, which had implemented a voluntary EPS certification prior to the legalization, had started the implementation in a serious manner. HR and training managers in organizations E and H stated that they were planning to implement a new HR system or had recently done so. Organization L was at the starting point and had recently acquired an external advisor for help. In organizations E, H and L the interviewees confirmed a current lack of registrations but hoped for a more structured registration of personal information. The status of organizational preparations for EPS indicated that the organizations had not taken the necessary steps to implement the standard and were hesitant as regard further registrations due to GDPR. This hesitation is of concern as around 1,200 organizations in Iceland must have the certification by the end of 2022.

8.2 Changes in the personal knowledge registration process due to equal pay standard

The EPS legislation has pushed the PKR process forward. The four sections of EPS, as well as guidelines for the classification of jobs in Annex B, confirmed the legal obligation of registration made by the Act on Equal Status and Equal Rights of Women and Men No. 10/2008 with recent amendments no. 56/2017. This registration requirement also applied added pressure from the labour unions and the obligation to register educational information of employees into a public payroll system.

The EPS requires that the equal wage system shall include all records. Examples of such records can be identified in Section 4.4.1 of the standard where it is stated that the top management must ensure documentation on necessary resources such as human resources and expertise. The same applies to Section 4.4.2 where the organization shall ensure that all employees who are involved in its decisions on wages are qualified and maintain appropriate records on the subject. Thus, the evidential value of documentation regarding the personal knowledge of employees is rich.

Previous results had identified that HRMS, knowledge mapping, corporate directories or interactive databases, had been tried for registering personal knowledge but without great success (Haraldsdottir et al., 2018). The causes seemed to be linked to a lack of managerial support, unclear responsibilities of tasks, lack of access and added value to the users. These findings supported Sutanto and Jiang (2013) in the claim that the success of a knowledge management system [in their case] depended on people contributing content to the database and seeking knowledge from it, sort of an as you saw, so shall you reap ideology. The findings of Sutanto and Jiang are furthermore supported by Anderson et al. (2017) where it was maintained that the stability and championing of top leadership balanced an organization’s ability to both protect and share information when “information sharing is governed by strict laws due to the specifically sensitive nature of the information” (Anderson et al., 2017, p. 1107).

8.3 On balancing different requirements of the equal pay standard and general data protection regulation

The implementation of GDPR concerned all interviewees. The participating organizations were preparing for more effective information governance, i.e. strategic framework of standards, roles and processes for proper management of information assets (ARMA International, 2016). Interviewees in organizations H, E and A stated that they expected more conformity and structure aligned with the implementation of GDPR and welcomed such changes. However, preparations were still at their starting point. Organization L still lacked a needs-analysis for the GDPR process to know what personal data was being collected, how it was organized, where it was registered and who had access to it. Organization E had hired a data protection officer but was still looking into aspects of PKR such as informed consent. The HR manager in the organization I had just realized that she needed consent for sharing personal data with other employees within the organization, as it was their interest to have “it all in the open”. Organizations were not fully equipped to implement and maintain the records management requirements of the EPS and supported by ISO 15489 (ISO, 2016a) and GDPR. Therefore, the organizations were at risk for receiving rectification measures from the Icelandic Data Protection Authority or other data protection authorities in Europe. If organizations fail to comply with GDPR, they may, in a worst-case scenario, expect a fine of 4% of their yearly revenue or up to 20m Euros (The Icelandic Data Protection Authority, 2018). The stakes are, therefore, high.

8.4 The responsibility of equal pay standard and general data protection regulation

The potential benefits from the expertise of information and records professionals as presented in Figure 2 were not reflected in the findings of this paper. Only one out of four claimed to have a role in the preparation process for the EPS, but none was particularly involved in PKR or GDPR. The model demonstrated how PKR could benefit from the information and records professionals in classification, indexing and content analysis (Franks, 2013), who could take on the role of mediators between the developers, the regulatory environment and the end-users (Foscarini, 2010). Still, HR and/or training managers, as in organizations B, K, I and H, were more likely to be involved in the PKR process than information and records managers. The same applied to the preparations for GDPR which was in the hands of the legal department as in organizations B, K and H. This is a surprise as the purpose of information and records management is among other things to manage information as evidence for business activity and for accountability reasons (Brooks, 2019; ISO, 2016b; Haraldsdottir and Gunnlaugsdottir, 2018).

8.5 Critical attitudes

The legislation of the EPS has been criticized as it obliges organizations, of which approximately 560 have an annual staff of 25–49 employees, to implement the standard (Althingi.is, 2018, p. 38). Critics questioned how Icelandic supervisory authorities could regulate the EPS due to a lack of funding and paucity of staff. The Centre of Gender Equality had been described as “weak and toothless” as a checkpoint on discrimination (Halfdanardottir, 2015). As mentioned, this criticism may be grounded in the financial crisis of 2008 when supervisory authorities failed to monitor the banking system (Benediktsdottir et al., 2011). Criticism has also been aimed at audit and certification services. In a parliamentary review, the situation is compared to a “bottleneck syndrome”. Obligatory investigation from accredited audit services was deemed incompetent, a few services were qualified to audit the EPS as they were understaffed, lacked experience and had time-limited permits (Althingi.is, 2018, p. 12).

9. Conclusion

The advent of the EPS and GDPR gave ample reasons to examine their impact on the documentation of personnel records. It is noteworthy that the findings indicate that the advent of EPS had a greater impact on PKR facilitators than did GDPR. One cause may be that the registration of the education, training and skills of employees was inadequate in many participating organizations. Hence, most organizations were far from fulfiling the requirements of the EPS. The requirements of GDPR seemed, on the other hand, not to disturb interviewees much in terms of PKR. Interviewees either claimed to already possess informed consent for PKR data processing from their employees or expected no complications in obtaining consent. In line with the findings, the different levels of constraints may be explained by the fact that the organizations had been working in accordance with data protection directives and former data protection legislation (Act No. 77/2000) for years, whilst the mandatory EPS was a novelty for the Icelandic economy.

All EPS records shall remain legible, identifiable and retrievable which relates to ISO 15489 whose purpose is primarily to manage information as evidence. The implementation of EPS was demanded by public authorities. The purpose of the standard is to enforce the Gender Equality Act. The requirements comprise more disciplined work procedures and increased traceability regarding a variety of personnel documentation, including decisions on wages and employment terms. Information and records management procedures are central issues in the certification process. Still, information and records managers were undiscovered as facilitators of the preparation and implementation of the EPS. It was somewhat of a surprise that the skills of records professionals were scarcely used for PKR despite their educational background, experience and insight into the creation, management and storage of knowledge. This is concerning as the skill set of information and records managers is specifically applicable when “information sharing is governed by strict laws due to the specifically sensitive nature of the information” (Anderson et al., 2017, p. 1107). The viability of PKR, as a collaborative platform containing information of the personal knowledge of employees, is also at risk as the legal environment, made by the EPS and GDPR, puts constraints on individual contributions to the system. Thus, further examination of how the requirements of the EPS complies with GDPR as experience grows and longitudinal comparison can be made is important.

It is important that data protection and privacy issues do not hinder the implementation of international or national standards or the development of collaborative communication platforms as PKR. It is also important that government officials improve work procedures to minimize the complexity of the implementation process of EPS. Lack of funding, paucity of staff or lack of certification services may cause the experience of a bottleneck syndrome with a slow rise in certified organizations and, therefore, negatively impact all possible advantages of the EPS. These obstacles may be rectified and the results can benefit other countries that choose to follow Iceland´s lead in the struggle against the gender pay gap.

Despite limitations, this research bridges an important gap in a rapidly growing interdisciplinary field of information governance. It provides a multi-professional, empirical example of how and why organizations were not as prepared for the EPS or GDPR as, perhaps, expected. Whilst the EPS has only been established in Iceland so far it may be expected that other countries will show interest in implementing a similar standard. The balance between updated documentation of the education of employees as required by EPS and done in PKR and the necessity to protect personal data as required by GDPR is an ongoing challenge for organizations all over.

Figures

Figure 1.

Conceptual model of PKR

Figure 2.

The role of information and records professionals as enablers of the EPS

Table 1.

An overview the eight participating organizations, their sectors, general types of business and total number of staff

A	B	E	F	H	I	K	L
Financial Private	Technology/ Communication Private	Financial Public	Surveillance Public	E-commerce Private	Industrial/ Consultancy Private	Industrial/ energy Public	Industrial Public
Nearly 1000 employees	Around 500 employees	Nearly 200 employees	Almost 240 employees	Around 270 employees	About 350 employees	460 employees	50 employees

Table 2.

An overview of the number of interviews and their timing in the eight participating organizations

First interviews in 2010-2012 and 2014-2016
	Private				Public
	A	B	H	I	E	F	K	L	Total
HR Manager	1	1		1	1	1			5
Education and Training Manager	1	1	1		1	1**			5
Information and Records Manager	1	1			1	1	1	1	6
									16
Second interview in January 2018
	Private				Public
	A	B	H	I	E	F	K	L	Total
HR Manager				1		1			2
Education and Training Manager			1		1				2
Information and Records Manager	1	1					1	1	4
									8
						TOTAL			24

Note:

**An employee responsible for Education and Training and Quality Management

A	B	K	L
Involved in the documentary preparations and implementation of the EPS. PKR was still in the hands of HR	Not involved in the preparation or the implementation process. The project belonged to the legal department or HR	Not involved in the preparation or the implementation process. The project belonged to the legal department or HR	Had taken part in meetings with an external advisor for the preparation of the EPS and expected to be involved in the implementation process