The employer-employee situation is generally considered as an imbalanced relationship in which the employer wields more power than the employee. Since consent has to be freely given, and in light of the imbalanced relationship, your employer in most cases can’t rely on your consent to use your data.
There might be situations in which processing of an employee’s personal data based on the employee’s consent is lawful, especially if it’s in the interest of the employee. For example, if a company grants benefits to the employee or their family members (e.g. discounts on the company’s services), processing of the employee's personal data is allowed and lawful, if informed prior consent was given.
Consent not valid
Your employer believes that work productivity needs to be improved. To do this he intends to install CCTV cameras in the corridors and at the entrance to the bathrooms. He asks you to give your consent so that he can monitor your movements and the time spent out of office. Even if you do consent, it would be considered invalid and your employer can’t install CCTV based on that consent.
- Articles 7 and 88 and Recital (43) of the GDPR
- Article 29 Working Party Guidelines on Consent under Regulation (EU) 2016/679 (WP 259)
- Article 29 Working Party Opinion 2/2017 on data processing at work (WP 249)