Content area

Full text

This article critically examines how the European General Data Protection Regulation (GDPR) defines and applies the legal categories of "data subject" and "data controller" within employment relationships. Under the GDPR, employers who collect and process personal data are classified as data controllers, while employees are designated as data subjects. However, this article argues that such a "translation" of data protection categories, rights, and obligations into the regulation of workplace dynamics requires closer examination. The focus is on evaluating whether the GDPR's rights and obligations for data subjects and data controllers accurately capture the agency and interests of employee and employer roles in the workplace. Through an analysis of data subject rights (GDPR, Articles 12-22) and selected data controller obligations (GDPR, Articles 24, 25, and 35), this article identifies a "Lost in Translation" effect, where the GDPR's assumptions of autonomy and agency conflict with the hierarchical nature of employment relationships and with the information asymmetries between employers and data processors (GDPR, Article 28). Ultimately, this analysis highlights the need to reconsider and adapt these legal categories to better reflect the unique characteristics of employment in the regulation of data processing.

Keywords: Labour Law Protection, Data Protection, Privacy, GDPR

I. INTRODUCTION: THE LEGAL CATEGORIES OF EUROPEAN DATA PROTECTION AND LABOUR LAW.......... 554

II. EMPLOYEES AS DATA SUBJECTS.......... 557

A. Data Subjects and Their Rights.......... 558

B. Who Is the Data Subject?.......... 560

C. Lost in Translation: Consumer Protection Disguised as Labour Law Protection.............. 564

III. EMPLOYERS AS DATA CONTROLLERS.......... 567

A. Employers as Consumers of Data Processing Tools.......... 569

B. Data Controllers and Processors.......... 570

C. Lost in Translation: Employers Disguised as Creators of Data Processing.................... 572

IV. IN SEARCH OF A PROPER TRANSLATION: ADDRESSING AGENCY GAPS.......... 575

V. CONCLUSION.......... 577

VI. REFERENCES.......... 579

I. INTRODUCTION: THE LEGAL CATEGORIES OF EUROPEAN DATA PROTECTION AND LABOUR LAW

RESEARCH INTERSECTING LABOUR LAW and data protection has fascinated scholars for decades (Finkin, 1995; Simitis, 1986). New technologies bring in new organisational patterns where collecting and processing employees' personal data is integrated into the company's operation. The employer's right to monitor is carefully investigated by European courts and scholars since it ostensibly shows signs of hypertrophy: monitoring and managing employees is easier thanks to the increasing availability of digital tools and...

Show less