Consent is valid only when it is freely given. An employee is legally and economically dependent on the employer, so their consent is rarely regarded as free. The exception is narrow: consent may be valid where it is so trivial that nobody could doubt either that it was given freely or that it could be withdrawn without any negative consequences.
The practical conclusion is unwelcome for an employer who wants to “sort everything out with one signature”: a consent annex to the employment contract usually creates risk rather than protection. Below: why, and what is used instead.
Where the problem comes from
Article 4(11) GDPR defines consent as a freely given, specific, informed and unambiguous indication of wishes. In an employment relationship, the first word falls apart.
Two other provisions confirm the same point. Article 7(3) GDPR gives the right to withdraw consent at any time, and withdrawing it must be as easy as giving it. Article 7(4) GDPR states that, when assessing whether consent is freely given, utmost account is taken of whether the performance of a contract is made conditional on consent to the processing of data that is not necessary for the performance of that contract.
Now apply this to employment. Can an employee realistically refuse to sign what everyone else signs? Can they withdraw consent and expect nothing to happen? If the answer to even one of these questions is “not really”, the consent is not free, and the processing that relies on it has no valid basis.
In one case we did not prepare the document
A client asked for a consent annex to be prepared for individual processing activities. The instruction was clear, it was paid work, and technically it was easy to deliver.
The answer was that it was not worth doing. An employee, being legally and economically dependent on the employer, cannot give consent freely, unless that consent is so trivial that nobody could doubt either that it was given freely or that it could be withdrawn without any negative consequences. We said plainly that by preparing such an annex we would risk committing an infringement.
The annex was not prepared. This is the most important point on this page. The document the client asked for was not produced, not because there was no way to write it, but because it would have created risk rather than protection. A sheet of paper with signatures looks like evidence. If the basis is wrong, it is evidence against the employer itself: it sets out what data was processed and for what purpose, and it names a basis that is not valid.
If not consent, then what
The Regulation provides for several legal bases for processing, and in an employment relationship one of three almost always fits.
- Legal obligation. Where the law requires the data to be processed: working time records, taxes, occupational safety and health, social insurance. Here consent need not be asked for, and must not be — if consent were withdrawn, the obligation would not go away.
- Performance of a contract. Data without which the employment contract cannot be performed: contact details, a bank account for the salary, the job title.
- Legitimate interest (Article 6(1)(f) GDPR). Suitable for what is neither a legal obligation nor part of the contract, but is justified: protection of property, investigation of incidents, access control. This basis comes at a cost. The GDPR does not directly require a written assessment, but under Article 5(2) GDPR the employer must be able to demonstrate that the basis is appropriate, so in practice a written balancing test is needed, weighing the employer’s interest against the employee’s privacy and showing that the purpose cannot be achieved in a less intrusive way. A legitimate interest that is not written down is, in practice, the same as not having one.
With video and audio monitoring in the workplace, the question of consent does not arise at all — the question is one of informing. Article 5(4) of the Law on the Legal Protection of Personal Data (ADTAĮ) requires employees to be informed of such processing against their signature or by another means that proves they were informed. This is information, not consent: the employee’s signature there means “I have been told”, not “I allow it”.
Where consent really works in employment
There is one area in which consent is not only possible but the only correct basis. This is the employee’s image and voice where they are not needed for the job:
- a photo on the company website or social media;
- the employee’s image in the company’s visual identity;
- a statement or quotation in marketing material.
These cases differ in one respect: refusing has no consequences for the job. An employee who does not want their photo on the website has neither fewer duties nor fewer opportunities as a result. That is why their consent is free.
In such cases Article 7(2) GDPR requires the request for consent to be clearly distinguishable from other matters. The Regulation does not require a separate document, but our recommendation is this: record consent in a separate document, not in an annex to the employment contract that everyone signs. An annex to the contract is signed at the moment of hiring, together with everything else, and that is exactly when it is hardest to speak of free will. A separate consent can also be withdrawn without touching the employment contract — and under Article 7(3) GDPR the possibility of withdrawal is a condition for consent to be valid.
How to start
The most useful place to start is a single list: which consents you ask employees for today, and what would happen if any of them withdrew it. If the answer is “we would still need to process the data”, consent does not fit there and must be replaced with a proper legal basis, not collected again.
Send us your employment contract annex or consent form and tell us what purposes you use it for. We will review it and tell you which clauses are fine, which need changing and which can be dropped altogether. The first answer is free — email info@linden.lt.
You can check whether your organisation needs a record of processing activities with the Privacio tool, built by Linden (in Lithuanian).
More about this service: GDPR audit, compliance documents and advice.