Last review date: 30 December 2024

No.

Last review date: 30 December 2024

☒        Yes, but this consent is typically more difficult to establish in an employment context (specify details below)

The Data Protection Act does not address consent in the employment context. Therefore, the conditions of the GDPR apply, in particular, consent must be freely given. This is possible in the employment context but care must be taken in light of recital 43 of the GDPR, pursuant to which "consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller" which could be the case in the employment relationship. In the Icelandic DPA’s guidelines on consent, the employment relationship is specifically mentioned as an example of circumstances where an imbalance of power may exist. More precisely, it is stated that it is unlikely that an employee is able to provide valid consent, as it is unlikely that they can refuse without the risk of direct or indirect negative consequences.

No.

However, in the 2022 annual report of the Icelandic DPA it was noted that workplaces are increasingly adopting artificial intelligence to assess the competence and productivity of employees. This technology constitutes a significant intervention in people’s lives. It is anticipated that employees, whether under the scrutiny of artificial intelligence or other technologies, are subject to the Data Protection Act. It is crucial to uphold respect for the fundamental rights of individuals in every aspect of this process.

In the 2023 annual report of the Icelandic DPA, the importance of personal data protection in relation to artificial intelligence was reiterated in general, but not specifically in relation to use in employment context.