GDPR – Are Your Interests Legitimate?

Until now, most employers have relied upon their employees' consent in order to process their personal data. But, under the GDPR, the requirements for consent will be much stricter. Particularly in the employment context, where it is generally accepted that the imbalance of power between the employer and employee is likely to invalidate any consent given by the employee.

Nevertheless, all is not lost. Consent is only one of a number of potential legal bases for processing employees' data. Employers will therefore need to consider whether any of the available alternatives are appropriate for their processing requirements.

In this context, employers may turn increasingly to "legitimate interests" as a lawful basis for processing. The legitimate interests ground is potentially wide in scope and flexible but, as the Information Commissioner's Office (ICO) warns in its latest guidance, employers should not assume it will be appropriate in all cases. Essentially, a