Data Processing in the Employment Context | EU | Global Data and Cyber Handbook

Data Processing in the Employment Context

Jump to

Data Processing in the Employment Context Start Comparison

Is an identified legal basis required in order to collect or process personal data or sensitive personal data in the employment context?

Last review date: January 2025

Yes

Can consent be validly obtained in the employment context?

Last review date: January 2025

Yes, but this consent is typically more difficult to establish in an employment context (specify details below)

There are some concerns that the consent is unlikely to be freely given in the employment context.

Pursuant to recital 43 of the GDPR "consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller", which could be the case in the employment relationship.

The European Data Protection Board has indicated in its Guidelines on Consent under the GDPR, that it "deems it problematic for employers to process personal data of current or future employees on the basis of consent as it is unlikely to be freely given". Thus, "given the imbalance of power between an employer and its staff members, employees can only give free consent in exceptional circumstances, when it will have no adverse consequences at all whether or not they give consent".

Has the data privacy regulator issued guidance on use of artificial intelligence, automated decision making or profiling in an employment context – for example, relating to use in employee monitoring or hiring?

Global Data and Cyber Handbook

EU

Select a Topic