# Standards and Regulatory References — Employment Consent Limits

## Primary Legislation

### GDPR Article 4(11) — Definition of Consent
Consent of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

### GDPR Article 7 — Conditions for Consent
- Art. 7(1): Controller must demonstrate that the data subject has consented.
- Art. 7(2): Written consent requests must be clearly distinguishable, intelligible, easily accessible, and in clear and plain language.
- Art. 7(3): Data subject has the right to withdraw consent at any time; withdrawal must be as easy as giving consent.
- Art. 7(4): Consent is not freely given if performance of a contract is conditional on consent to processing not necessary for the contract.

### GDPR Article 88 — Processing in the Employment Context
- Art. 88(1): Member States may provide more specific rules for processing in the employment context.
- Art. 88(2): Such rules must include suitable and specific measures to safeguard human dignity, legitimate interests, and fundamental rights.

### GDPR Recital 43
Consent should not provide a valid legal ground where there is a clear imbalance between the data subject and the controller.

## WP29 and EDPB Guidance

### WP29 Opinion 2/2017 on Data Processing at Work (WP249)
- Section 5.1: Employees are almost never in a position to freely give, refuse, or revoke consent due to dependency.
- Section 5.2: Alternative lawful bases should be used for employment processing.
- Section 5.3: Consent may be valid in exceptional circumstances where no consequences at all follow refusal.

### EDPB Guidelines 05/2020 on Consent
- Section 3.1.1: Consent is highly unlikely to be a legal basis for data processing at work unless employees can refuse without adverse consequences.
- Section 3.3: Specific consent — consent must be given for each distinct purpose.
- Section 3.4: Informed consent — controller identity, purpose, data types, right to withdraw.

## National Art. 88 Implementations

### Germany — BDSG Section 26
- Section 26(1): Employee data processing permitted if necessary for employment decision, performance, exercise of rights, or termination.
- Section 26(2): Consent valid only if employee derives legal or economic advantage or employer and employee pursue same interest; must be in writing.
- Section 87(1)(6) BetrVG: Works council co-determination for monitoring systems.

### France — Labour Code
- Art. L.1121-1: Proportionality principle for employee data restrictions.
- Art. L.1222-4: Transparency obligation for personal data collection.

### Netherlands — UAVG
- Art. 30 UAVG: Employee consent deemed not freely given due to dependency.
- Works council consent rights under Art. 27(1)(k) and (l) WOR.

### Spain — LOPDGDD
- Art. 87-91: Digital rights in employment context.

### Italy — Workers' Statute
- Art. 4: Remote monitoring restrictions require trade union agreement.

## Enforcement Precedents

| Authority | Reference | Fine | Issue |
|-----------|-----------|------|-------|
| Hellenic DPA | Decision 26/2019 | EUR 150,000 | Consent for CCTV invalid due to power imbalance |
| Austrian DPA | DSB-D123.270/0009-DSB/2018 | EUR 4,800,000 | Monitoring based on invalid consent |
| LfDI Baden-Württemberg | H&M case, 2020 | EUR 35,258,707.95 | Health data collected based on non-free consent |
| CNIL | SAN-2022-018 | EUR 600,000 | Excessive employee data collection purportedly based on consent |
| ICO | Mermaids, 2023 | Enforcement notice | Special category data without valid basis |