Stricter consent of workers: are you ready?

Some conditions are already required in order to gain the consent of workers in order for their personal data to be processed. From 25 May 2018, new, stricter conditions laid down by the GDPR will enter into force. Are you prepared to ask for the new “yes” of your workers?

At present, consent already constitutes one of the legal bases to justify personal data processing. The GDPR has tightened its conditions.

New conditions

Consent for personal data processing will have to be given by the data subject by a clear affirmative act, for instance by ticking a box on a website. Implicit consent, pre-ticked boxes or inactivity will no longer be sufficient.

Moreover, a data subject’s consent must now be freely given, specific, informed and unambiguous. For consent to be informed, the data subject must be aware at least of the identity of the controller and the purposes of the processing. Consent is presumed not to be freely given if the performance of a contract is dependent on the consent despite such consent not being necessary for such performance. Data subjects are also entitled to withdraw their consent later. As they must be informed of this right to withdraw their consent at any time, consent will become a less solid base for processing of personal data.

The GDPR also lays down that when the processing has multiple purposes, consent must be given for all of them. If consent is given as part of a written declaration which also concerns other matters, the request for consent must be presented in a manner which is clearly distinguishable from the other matters.

This means that the clause in an employment contract by which the worker agrees to the processing of his personal data will have to be adapted to the new conditions. This is important since the controller must be able to demonstrate – when the data processing is based on consent – that the data subject has consented to his data being processed.

Observations

Please note that the national legislator has the possibility of providing for more specific conditions in the employment context. Hence, conditions for workers’ consent could be tightened by the Belgian lawmaker in the future.

Consent is not the only legal basis for data processing. Regarding employment, it is recommended to use other legal bases such as the necessity for the performance of a contract on the basis of current legislation. Since the employer must inform his workers of certain aspects of data processing anyway, he could make good use of this information to ensure workers’ consent as an additional legal basis in order to validate the processing.