On a Deceptive Intersection. Data Subjects’ Rights and Labour Protection:Building the Labour Scope of Data Protection

The General Data Protection Regulation (GDPR, EU Reg. 2016/679) grants several individual rights and principles to the employee: information, purpose limitation and consent are cornerstones for a lawful data processing by the data controller (the employer). As a result of the widespread use of employee digital surveillance, the sphere of control and protection over the data subject's personal information has been transposed by mainstream labour law literature as a counterbalance to the new digital authority of the employer.Yet, the new data-intensive systems such Artificial Intelligence (AI) and the Internet of Things (IoT) are still perpetrating ‘one-way mirror’ effects in workplace surveillance, with significant externalities on social rights such as trade union rights or equal treatment; in addition to the doubts raised by data protection authorities on the effectiveness of freely given consent in subordinate employment. From these premises, the present contribution aims to highlight the deceptive application of data subjects' rights in the guises of labour rights to protect fundamental freedoms at work. The recent literature has in fact questioned the threshold of transparency and purpose limitation ensured by individual rights regimes in curbing the impact of such surveillance on employees' rights. The contemporary data processing requires a regulatory approach that – besides personality rights – addresses the scope of data protection at work according to the proper function of labour regulation: interfering in the (data) market for a proper balance between economic needs and fundamental labour rights.To this end, the present contribution classifies the three relevant intersections between data and labour protection in the existing regulatory framework: the rights of the data subject (Art. 12-22 GDPR); social consultation and data processing (Art. 88 GDPR); data protection impact assessment (Art. 32-35 GDPR, Proposal for an AI Regulation). Reasoning from the available literature, legislation and case law, this paper shows how the GDPR can be receptive to the purposes of labour regulation through a systematic application of impact assessments and social consultation. The legality and legitimacy of data processing at work ought to be shaped through collective bargaining and impact assessments, thus preventing the sphere of labour protection from being channelled only through the individual rights of the data subject. Informing data protection principles with labour-oriented ones, thus, overcomes the deceptive labour protection offered by the individual rights of data subjects in the times of AI and IoT, laying the foundations to build the labour scope of data protection.