The Three-Tier Structural Legal Deficit Undermining the Protection of Employees' Personal Data in the Workplace.

This article examines the structural legal deficit undermining the protection of employees' personal data in the workplace, arising from the intersection of labour law and personal data protection regulation, particularly the EU's General Data Protection Regulation (GDPR). It identifies three tiers of this deficit: (1) labour law’s broad employer prerogative to introduce and use data-driven technologies with limited restrictions; (2) the GDPR’s consumer-oriented framework that inadequately addresses the power imbalance inherent in employment relationships and treats employees merely as data subjects; and (3) the absence of specific, non-waivable labour law rules and collective representation mechanisms to safeguard employees’ personal data. To address these gaps, the article proposes adopting robust labour law tools alongside the GDPR, including treating workplace technologies analogously to accessibility requirements, establishing clear non-waivable rules limiting data use and requiring compensation, and mandating employee representation in decisions about data-driven technologies. These measures aim to create a more balanced legal regime that better protects employees’ fundamental rights to privacy and personal data security in the evolving digital workplace.