Global Data and Cyber Handbook

Belgium

Select a Topic
Start Comparison
Data Processing in the Employment Context
Jump to
Data Processing in the Employment Context Start Comparison
Is an identified legal basis required in order to collect or process personal data or sensitive personal data in the employment context?

Last reviewed: January 2025

Yes.

The potential legal bases for data processing in the employment context are:

Non-sensitive data:

  • the personal data is necessary to perform a contract with the data subject
  • the personal data is necessary to comply with a legal obligation
  • the personal data is necessary to protect the vital interests of a natural person
  • the personal data is necessary to fulfil a legitimate interest of the controller (provided that the interest is not overridden by the data subject's own interests or fundamental rights and freedoms)

Sensitive data:

  • the processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law
  • the processing relates to personal data which are manifestly made public by the data subject
  • the processing is necessary for the establishment, exercise or defense of legal claims.

Data relating to criminal convictions and offences:

  • the processing is necessary for the management of the controller's own litigation.
Can consent be validly obtained in the employment context?

Last reviewed: January 2025

Yes, but this consent is typically more difficult to establish in an employment context (specify details below)

There are some concerns that consent is unlikely to be freely given in the employment context.

Pursuant to recital 43 of the GDPR "consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller", which could be the case in the employment relationship.

The European Data Protection Board has indeed indicated in its Guidelines on Consent under the GDPR, that it "deems it problematic for employers to process personal data of current or future employees on the basis of consent as it is unlikely to be freely given". Thus, "given the imbalance of power between an employer and its staff members, employees can only give free consent in exceptional circumstances, when it will have no adverse consequences at all whether or not they give consent".

Has the data privacy regulator issued guidance on use of artificial intelligence, automated decision making or profiling in an employment context – for example, relating to use in employee monitoring or hiring?

Yes

The Belgian Data Protection Authority has provided limited guidance on the use of artificial intelligence in the context of CCTV monitoring on the workplace available in French and Dutch.

The Belgian Data Protection Authority has furthermore issued two opinions in 2022 and 2020 (Opinion 94/2022 of 13 May 2022 available in French and Opinion 90/2020 on 11 September 2020 available in French and in Dutch) concerning two draft Walloon decrees with respect to coaching and solution-focused support for job seekers. The contemplated processing activities notably relied on artificial intelligence and profiling, for which the Belgian Data Protection Authority recommended a series of safeguards.

Please see section "Has the data privacy regulator issued guidance on data privacy and artificial intelligence, automated decision-making or profiling?" for more information on the Belgian Data Protection Authority's guidance.

See the separate section on artificial intelligence, automated decision making and profiling for general EU guidance.

{{ $store.state.loadingScreen.message }} ...