Why consent is problematic at work
Consent looks easy but should be a measure of last resort. Valid consent must be freely given, specific, informed and unambiguous - and the imbalance of power in the employer–employee relationship means employees rarely have genuine free choice. Recital 43 says consent is not a valid ground where there is a clear imbalance between data subject and controller. The EDPB confirms consent is usually problematic at work.
DPAs say reliance on consent should be confined to cases where a worker has genuine free choice and can withdraw consent without suffering any detriment. When consent is not free, it is not valid. Employees may fear that refusing would prejudice their employment.
- Recital 43 - consent is not valid where there is a clear imbalance between data subject and controller.
- The EDPB says for most workplace processing the lawful basis cannot and should not be employee consent.
- Exception: only where there are no adverse consequences to the employee whatever they decide (exceptional circumstances).
- Even valid consent does not cure other breaches - processing may still be unlawful, unfair or disproportionate under local law.
- Some EU countries nonetheless require written employee consent in specific situations.
Even if an employee consents, the employer must still comply with every other part of data protection law. Consent to disproportionate collection, or where local law forbids consent for that processing, is still unlawful.