employment-consent-limits
Employment Consent Limits
Overview
Consent is rarely a valid lawful basis for processing employee personal data under GDPR. The Article 29 Working Party's Opinion 2/2017 on data processing at work (WP249) and the EDPB's subsequent guidance establish a clear presumption against reliance on consent in the employment context. The rationale is straightforward: the inherent power imbalance between employer and employee means that consent cannot be "freely given" as required by Art. 4(11) GDPR when refusal or withdrawal of consent may result in real or perceived adverse consequences for the employee.
Art. 88(1) GDPR explicitly empowers Member States to provide more specific rules for processing in the employment context, and many have enacted legislation that further restricts or modifies the role of consent in employment data processing. This skill maps the consent prohibition landscape, identifies the narrow exceptions where consent may be valid, and provides a decision framework for selecting appropriate alternative lawful bases.
The Consent Problem in Employment
Art. 4(11) — Definition of Consent
Consent must be:
- Freely given: The data subject must have a genuine and free choice and must be able to refuse or withdraw consent without detriment
- Specific: Consent must be given for one or more specific purposes
- Informed: The data subject must be informed about the controller's identity, the purpose, the data processed, the right to withdraw, and any automated decision-making
- Unambiguous indication: A clear affirmative action is required