The Legal Basis, and Why It Is Not Consent
Employers need a ground to monitor. Knowing which one they are using tells you what conditions attach to it.
General orientation, not legal advice; requirements differ substantially by jurisdiction.
The boundary described in “The Legal Basis, and Why It Is Not Consent” should be settled before any workforce platform is configured. An organisation reviewing employee monitoring under GDPR for gdpr employee monitoring can make the use more transparent by naming the purpose, selecting only necessary settings and documenting who may see or correct each record.
Monitoring processes personal data about you, which requires a basis. Which basis applies determines what the employer must do and what you can expect.
For an independent perspective related to “The Legal Basis, and Why It Is Not Consent”, consult the European Commission data-protection resources; it provides a useful external check on privacy, fairness and governance assumptions before a policy or configuration is approved.
Why it is usually not consent
Consent must be freely given, and an employee asked to accept monitoring to keep their job is not in a position to refuse freely.
Several regimes say so explicitly.
Which means an employer relying on your consent has probably chosen the wrong basis, and the practical consequence is that your signature at induction is not what makes the monitoring lawful.
What they usually rely on instead
Legitimate interests: the employer has a genuine business reason, balanced against the rights you have.
Legal obligation, in regulated sectors where recording is required by a rule.
Occasionally contractual necessity, for specific narrow purposes.
The first is the common one and it carries the most conditions.
What legitimate interests requires
A stated purpose, specifically.
A necessity test: is monitoring needed for that purpose.
A balancing exercise: your interests and rights against theirs, documented.
And transparency: you have to be told.
That balancing assessment should exist on paper, and asking whether one was done is a reasonable question.
Why consent being wrong matters to you
If they rely on consent, you can withdraw it — and they will have no basis.
Which is why they should not rely on it, and why claiming you consented is not an answer to a concern about proportionality.
The real question is whether the monitoring is necessary and proportionate, which has its own note and is a stronger line of enquiry than whether you agreed.
Regulated obligations
Some monitoring is required: recorded communications in parts of financial services, access logging in clinical systems, specific safety recording.
Here the employer has no discretion and neither do you.
Knowing that it is a rule rather than a choice about you is worth establishing, and they can usually point at the rule.
Special categories
Health, beliefs, trade union membership, sexual orientation and similar attract stronger protection in most regimes.
Monitoring that captures these — browsing related to a health condition, union communications — is a materially different proposition.
Its own note covers this, and it is the area where the strongest arguments are available.
What to ask
What is your lawful basis for this monitoring?
Has a balancing assessment been carried out?
May I see its conclusions?
All three are ordinary questions to a data protection function and all three are informative whatever the answer.
What to check
Do you know what basis your employer relies on?
Were you asked to sign something that calls it consent?
Is any of the monitoring required by a rule they can name?
And has anybody mentioned a balancing assessment?