Employment Consent Limits

Employment Consent Limits

Overview

Consent is rarely a valid lawful basis for processing employee personal data under GDPR. The Article 29 Working Party's Opinion 2/2017 on data processing at work (WP249) and the EDPB's subsequent guidance establish a clear presumption against reliance on consent in the employment context. The rationale is straightforward: the inherent power imbalance between employer and employee means that consent cannot be "freely given" as required by Art. 4(11) GDPR when refusal or withdrawal of consent may result in real or perceived adverse consequences for the employee.

Art. 88(1) GDPR explicitly empowers Member States to provide more specific rules for processing in the employment context, and many have enacted legislation that further restricts or modifies the role of consent in employment data processing. This skill maps the consent prohibition landscape, identifies the narrow exceptions where consent may be valid, and provides a decision framework for selecting appropriate alternative lawful bases.

The Consent Problem in Employment

Art. 4(11) — Definition of Consent

Consent must be:

• Freely given: The data subject must have a genuine and free choice and must be able to refuse or withdraw consent without detriment
• Specific: Consent must be given for one or more specific purposes
• Informed: The data subject must be informed about the controller's identity, the purpose, the data processed, the right to withdraw, and any automated decision-making
• Unambiguous indication: A clear affirmative action is required

Why Consent Fails in Employment — WP29 Opinion 2/2017

The Article 29 Working Party stated in Section 5.1 of Opinion 2/2017:

"Employees are almost never in a position to freely give, refuse, or revoke consent, given the dependency that results from the employer/employee relationship. Given the imbalance of power, employees can only give free consent in exceptional circumstances, when no consequences at all are connected to acceptance or rejection of an offer."

Key factors that negate free consent in employment:

Recital 43 — Imbalance of Power

Recital 43 GDPR states: "Consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller." The employer-employee relationship is the paradigmatic example of this imbalance.

EDPB Confirmation

The EDPB Guidelines 05/2020 on consent under Regulation 2016/679 (Section 3.1.1) reaffirmed that consent is "highly unlikely to be a legal basis for data processing at work, unless employees can refuse without adverse consequences."

Narrow Exceptions — When Consent May Be Valid

Despite the general presumption against consent in employment, there are limited scenarios where genuine free choice may exist:

Exception 1: Purely Voluntary Benefits

Where an employer offers an optional benefit and participation is genuinely voluntary with no consequence for declining:

• Optional corporate wellness programme with health data processing
• Voluntary employee discount programme requiring sharing of personal preferences
• Optional employee photo directory

Conditions: The benefit must be genuinely optional, non-participation must have no negative consequences, and the employee must be able to withdraw at any time with immediate cessation of processing.

Atlas Manufacturing Group Example: Atlas offers an optional cycle-to-work scheme that requires processing of home address data for distance calculation. Employees who decline are not disadvantaged in any way. The DPO approved consent as the lawful basis with documented safeguards: the consent form explicitly states that non-participation has no employment consequences, and the scheme administrator is separate from line management.

Exception 2: Employee-Initiated Processing

Where the employee specifically requests processing for their own benefit:

• Employee requests a reference letter (requiring disclosure of employment data to a third party)
• Employee requests salary advance (requiring additional financial data processing)
• Employee requests flexible working arrangement (requiring processing of personal circumstances)

Exception 3: Art. 9(2)(a) Explicit Consent for Special Category Data

In limited circumstances, explicit consent under Art. 9(2)(a) may be appropriate for special category data where:

• No other Art. 9(2) condition applies
• The processing is genuinely in the employee's interest
• Refusal has absolutely no adverse consequence
• National law does not prohibit or restrict consent for this purpose

Example: An employee voluntarily discloses a disability to access workplace adjustments, and no legal obligation to process this data exists under national disability discrimination law.

Alternative Lawful Bases for Employment Processing

Art. 6(1)(b) — Performance of the Employment Contract

Scope: Processing necessary for the performance of the contract of employment.

Limitation: The processing must be genuinely necessary for the contract, not merely useful or convenient. The EDPB has emphasised that "necessary" must be interpreted strictly — what is necessary is determined by the nature of the contract, not the employer's business model.

Art. 6(1)(c) — Legal Obligation

Scope: Processing required by law, including employment law, tax law, social security law, and health and safety law.

Art. 6(1)(f) — Legitimate Interest

Scope: Processing necessary for the legitimate interests of the employer, provided these interests are not overridden by the interests, rights, or freedoms of the employee.

Three-part legitimate interest test (Art. 6(1)(f) + WP217):

1. Purpose test: Is there a legitimate interest? (Business security, fraud prevention, IT security, organisational efficiency)
2. Necessity test: Is the processing necessary for that interest, or could the aim be achieved by less intrusive means?
3. Balancing test: Do the employer's interests override the employees' fundamental rights? Consider:
   • The nature of the data (sensitive vs. non-sensitive)
   • The reasonable expectations of employees
   • The impact on the employee
   • The safeguards in place

Art. 6(1)(e) — Public Interest (Public Sector Employers)

For public sector employers, processing may be based on the performance of a task carried out in the public interest or in the exercise of official authority.

Art. 88 — National Derogations

Art. 88(1) permits Member States to provide more specific rules for processing in the employment context by law or collective agreements. Key national implementations:

Germany — Section 26 BDSG

• Employee data may be processed if necessary for the employment decision, performance of the employment contract, exercise or enjoyment of rights from collective agreements, or termination of employment
• Consent in the employment context is valid only if the employee derives a legal or economic advantage or the employer and employee pursue the same interest
• Consent must be in writing (unless electronic consent is appropriate due to circumstances)
• The works council (Betriebsrat) has co-determination rights under Section 87(1)(6) BetrVG for any technical monitoring of employee behaviour

France — Labour Code (Code du travail)

• Art. L.1121-1: No employer may restrict the rights of individuals or individual and collective freedoms unless justified by the nature of the task and proportionate to the aim pursued
• Art. L.1222-4: No information concerning an employee personally may be collected by a device that has not been previously brought to their attention
• CNIL Deliberation No. 2019-160: Specific requirements for employee monitoring transparency and proportionality

Netherlands — UAVG (Implementing Act GDPR)

• Art. 30 UAVG: Employee consent for processing by the employer is deemed not freely given due to the dependency relationship, unless the processing is clearly in the interest of the employee
• Works council (ondernemingsraad) has consent rights under Art. 27(1)(k) and (l) WOR for personal data processing decisions

Spain — Organic Law 3/2018 (LOPDGDD)

• Art. 87-91: Specific provisions for digital rights in the employment context
• Art. 87: Right to digital privacy at work
• Art. 89: Right to digital privacy in relation to video surveillance and sound recording at the workplace — employees must be informed of monitoring in advance
• Art. 90: Right to digital privacy in the context of geolocation at work

Italy — Workers' Statute (Legge 300/1970) and Jobs Act (D.Lgs. 151/2015)

• Art. 4: Remote monitoring of employees is permitted only for organisational, production, safety, or asset protection purposes, and only with trade union agreement or labour inspectorate authorisation
• Individual performance monitoring through remote control systems remains prohibited

Decision Framework: Selecting the Lawful Basis

START: Employer needs to process employee personal data
│
├─ Is the processing required by a specific law or regulation?
│  ├─ YES → Art. 6(1)(c) — Legal Obligation
│  └─ NO → Continue
│
├─ Is the processing necessary for performance of the employment contract?
│  ├─ YES → Art. 6(1)(b) — Contract Performance
│  │  └─ Apply strict necessity test: would the contract fail without this processing?
│  └─ NO → Continue
│
├─ Is the employer a public authority processing for a public task?
│  ├─ YES → Art. 6(1)(e) — Public Interest
│  └─ NO → Continue
│
├─ Does the employer have a legitimate interest?
│  ├─ YES → Conduct three-part LIA under Art. 6(1)(f)
│  │  ├─ Balancing test favours employer → Art. 6(1)(f) — Legitimate Interest
│  │  └─ Balancing test favours employee → Processing cannot proceed on this basis
│  └─ NO → Continue
│
├─ Is the processing genuinely voluntary with zero employment consequences?
│  ├─ YES → Art. 6(1)(a) — Consent (with documented safeguards)
│  │  └─ Document: (1) no consequence for refusal, (2) easy withdrawal, (3) separate from employment terms
│  └─ NO → Consent is not valid. Reassess whether processing is necessary at all.
│
└─ END: If no lawful basis can be identified, the processing must not proceed.

Common Compliance Failures

Enforcement Precedents

Integration Points

• Employee Monitoring DPIA: DPIAs for monitoring must confirm that consent is not relied upon (see employee-monitoring-dpia skill).
• Employee Biometric Data: Biometric processing requires Art. 9 condition — consent validity is even more constrained (see employee-biometric-data skill).
• Employee Health Data: Health data processing has specific Art. 9(2)(b) and (h) alternatives to consent (see employee-health-data skill).
• BYOD Privacy Policy: BYOD arrangements may appear to require consent but often have alternative bases (see byod-privacy-policy skill).