An employer requires staff to accept workplace CCTV monitoring as a take-it-or-leave-it condition of keeping their jobs and treats that acceptance as GDPR consent. Why is that approach typically problematic?
Select an answer to reveal the explanation.
Short Explanation
When saying "no" costs your paycheck, "yes" is not really free. Employment creates a power imbalance, so consent for monitoring is often shaky. Controllers usually need a better Art. 6 basis and careful necessity analysis—not a forced tick-box.
Full Explanation
GDPR consent must be freely given. Recital 43 and EDPB guidance emphasise that a clear imbalance—especially employer versus employee—can undermine freeness when refusal carries negative consequences for the person’s job. Treating take-it-or-leave-it acceptance of workplace CCTV as “consent” therefore typically fails Article 4(11) and Article 7 analysis: staff cannot realistically say no without risking employment, so the “yes” is not a genuine exercise of control. Civic and private employers alike should treat workplace monitoring as a necessity and proportionality problem under a more suitable Article 6 basis (often legitimate interests or legal obligation, depending on facts and national law), paired with transparency, DPIA where required, and safeguards—not as a forced tick-box.
Saying consent is never allowed for any workplace processing overstates the rule: consent is not categorically banned in employment, but it is often inappropriate for mandatory monitoring. Adequacy decisions govern international transfers of personal data, not the domestic lawfulness of installing CCTV on premises. Works Council or collective-agreement arrangements may be relevant under national labour law and can support transparency or consultation, but they do not by themselves cure an invalid consent construct if freeness is absent.
Exam caveat: distinguish the freeness problem from other consent defects (specificity, information, unambiguous indication). Also separate the Article 6 basis question from special-category or biometric issues if the system uses techniques that engage Article 9—those require their own pathway in addition to Article 6.
Operational check: if monitoring is necessary, document the chosen Article 6 basis, the balancing or legal-obligation analysis, retention limits, access controls, notice to staff, and any DPIA; do not rely on a condition-of-employment consent form as the primary lawfulness story when refusal is not a realistic option.