Extract to table

The ICO's Employment Practices Code — Monitoring at Work similarly acknowledges that the imbalance of power may affect the voluntariness of any consent provided by employees and that employers must be especially cautious when processing employee data

NorthPulse data must not be used for any employment decision to the detriment of the data subject, and this prohibition must be enforced through binding policy, technical access controls, and ongoing governance oversight

However, legitimate interest under Article 6(1)(f) cannot serve as the lawful basis for the processing of special category data under Article 9 — a separate condition must be identified and satisfied under Article 9(2)

The burden is on the controller to demonstrate that these requirements are satisfied, and the controller must accept that consent may be withdrawn at any time without detriment to the data subject

In particular, where processing is based on explicit consent (Schedule 1, Condition 1 — consent of the data subject), the controller must prepare and maintain an appropriate policy document in accordance with Schedule 1, Part 4

The proportionality of the monitoring must be assessed in light of the objective pursued, and the monitoring must not disproportionately intrude on employees' fundamental rights and freedoms