On 28th November 2017, the Article 29 Working Party (WP29) released their Guidelines on Consent under Regulation 2016/679 (General Data Protection Regulation – GDPR). Herewith, they have confirmed their scepticism in the ability of controllers to process the personal data of employees based on consent. They refer, as they did in Opinion 2/2017 on data processing at work (8 June 2017), that it is problematic for employers to rely on the consent of employees due to an imbalance of power in the employment context, namely that employees are unlikely to be able to give consent ‘freely’ without fear of detrimental effects. The WP29 states that ‘for the majority of such data processing at work, the lawful basis cannot and should not be the consent of the employees (Article 6(1a)) due to the nature of the relationship between employer and employee’ (p. 8). They state, however, that free consent may still exist in the workplace – but only in exceptional circumstances.

Although this is not an outright ban on the ability to utilise consent as a lawful basis for personal data processing under the GDPR, this reiteration from the WP29 that consent should not be the basis for employee personal data processing should encourage employers to consider another legal basis for the processing activities involving employee personal data. How this topic develops before the courts in the future will be of keen interest for legal minds and employers alike.