Worker Data Rights under the GDPR and Beyond: Enforcement and Legal Mobilisation Across the EU

The report by FES Future of Work and the Arbeiterkammer Vorarlberg finds widespread underenforcement of workplace data rights and major differences in how EU countries apply the GDPR alongside national labour laws. It recommends enabling collective enforcement under the GDPR, streamlining DPA activities and guidance, and ultimately creating an EU-wide data protection framework for the workplace. 

The EU, and data protection authorities (DPAs), have been criticised for not sufficiently enforcing the GDPR. Yet, there has been little specific investigation into the situation for workplace data protection. Therefore, the Arbeiterkammer Vorarlberg, together with FES Future of Work, commissioned a team of experts to map the state of play around workplace data protection in Austria, Belgium, France, Germany, Ireland, Italy, Luxembourg, Poland, Spain and the Netherlands. Based on a questionnaire, these experts provided insights into the enforcement of the GDPR in the workplace in general, as well as the enforcement of other data protection rights provided under national labour laws; the complaints, decisions and other activities of DPAs in the field of workplace data protection; and the activities of courts dealing with workplace-related data protection issues. They were also asked to examine the provisions that may enable collective enforcement, starting with Articles 80(1) and 80(2) GDPR and their national implementation, as well as other domestic mechanisms that may allow trade unions and works councils to bring actions to enforce data-protection rights.