The Three-Tier Structural Legal Deficit Undermining the Protection of Employees’ Personal Data in the Workplace

Even though personal data protection is a fundamental right, and legislation and the courts aim to pursue it, in practice, employees have no meaningful protection of their personal data within the workplace and have few opportunities to act, individually or collectively, to ensure the security of their data. In this article, I argue that a central reason for this state of affairs is the intersection of labour law and personal data protection regulation that creates a three-tier structural legal deficit. The three tiers are: the basic structure of labour law that ensures employer prerogative to use new technologies that are based on datafication almost unlimitedly; the consumer orientation of personal data protection regulation under the General Data Protection Regulation; and lack of specific labour law tools to protect personal data. By building on the structural understanding of the law, and by unravelling the three tiers, the article proposes robust labour law tools to enhance the protection of employees’ personal data.