Is an identified legal basis required in order to collect or process personal data or sensitive personal data in the employment context?
Last review date: 20 January 2025
Yes.
The potential legal bases for data processing in the employment context are:
The same as required for processing of any other non-sensitive or sensitive data as set out in the response to Questions 7 and 8 above, as applicable.
Can consent be validly obtained in the employment context?
Last review date: 20 January 2025
Yes, but this consent is typically more difficult to establish in an employment context:
Pursuant to recital 43, "consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller", which could be the case in the employment relationship.
Has the data privacy regulator issued guidance on use of artificial intelligence, automated decision making or profiling in an employment context – for example, relating to use in employee monitoring or hiring?
☒ Yes
Please see below guidance from the ICO on the use of AI and data protection:
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/explaining-decisions-made-with-artificial-intelligence/
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ai-and-data-protection-risk-toolkit/
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/toolkit-for-organisations-considering-using-data-analytics/
- https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/ico-consultation-series-on-generative-ai-and-data-protection/