Article 88 — Processing in the context of employment

Article 88 recognises that employment is not an ordinary relationship between two equal parties. Employers exercise considerable power over recruitment, pay, promotion, discipline, workplace surveillance and termination, while employees often have little practical ability to refuse processing. The provision therefore allows Member States and collective bargaining parties to create employment-specific data protection rules, but only if those rules genuinely protect employees and remain compliant with the GDPR.

The simplest way to understand Article 88 is:

The GDPR remains the basic law for employee data. Article 88 permits Member States and qualifying collective agreements to make that law more specific for the workplace. It does not permit them to reduce the GDPR to an empty formality or authorise unnecessary employee surveillance.

Article 88 has three components:

1. Paragraph 1 creates an opening clause. Member States may adopt more specific employment-data rules through legislation or collective agreements.
2. Paragraph 2 limits that freedom. Those rules must contain suitable and specific safeguards for dignity, legitimate interests and fundamental rights, particularly concerning transparency, group transfers and workplace monitoring.
3. Paragraph 3 requires notification. Member States must notify relevant laws and amendments to the European Commission.

The provision covers the whole employment lifecycle, from recruitment to termination and, in some situations, post-employment administration. Its official text expressly identifies recruitment, employment-contract performance, workplace management, equality, health and safety, protection of property, employment benefits and termination.gdpr-info+1

1. Why employment data requires special treatment

An employment relationship normally contains a structural imbalance of power.

An employer may decide:

• whether a person is hired;
• how work is assigned;
• whether performance is satisfactory;
• whether an employee is promoted;
• whether a bonus is paid;
• whether misconduct is investigated;
• whether employment is terminated.

The employee may depend on the employer for income, healthcare benefits, immigration sponsorship, accommodation or professional references. This makes apparent “choice” in personal-data processing potentially misleading.

Illustration

An employer asks employees to consent to continuous webcam monitoring while they work from home. The form says the monitoring is voluntary. An employee may understand that refusal will make them appear:

• uncooperative;
• unproductive;
• dishonest;
• unsuitable for remote work. Even if the employer never expressly threatens the employee, the imbalance may prevent consent from being freely given. Article 88 exists partly because ordinary abstract data-protection rules need workplace-specific interpretation. Questions such as whether monitoring is necessary, whether employee consent is valid and whether group-wide HR transfers are proportionate cannot be answered properly without recognising the employer’s authority and the employee’s dependence. The CJEU has expressly connected Article 88 with this relationship of subordination. It has treated the existence of employer direction and control, rather than whether the employer belongs to the private or public sector, as central to the provision.dpcuria+1

---

2. Article 88 is an opening clause, not an exemption

Article 88 allows Member States to make certain GDPR rules more specific. It does not remove employee processing from the GDPR.

A national law or collective agreement under Article 88 must operate within the GDPR framework. The employer must still consider, among other things:

• Article 5 principles;
• Article 6 lawful bases;
• Article 9 special-category rules;
• Article 10 criminal-offence information;
• transparency;
• data-subject rights;
• controller accountability;
• security;
• data protection impact assessments;
• international transfers;
• remedies and compensation.

This point was firmly confirmed in MK v K GmbH, Case C-65/23, decided on 19 December 2024. The CJEU held that employment rules adopted under Article 88 must require compliance not only with Article 88(2), but also with Articles 5, 6(1), and 9(1) and (2). A collective or works agreement cannot declare processing necessary and thereby prevent a court from examining whether it really is necessary under the GDPR.europa+2

Illustration

A works agreement allows an employer to transfer employees’ complete HR records to a group company in another country to test new software. That agreement does not settle the matter conclusively. The employer must still establish:

• a lawful basis;
• necessity;
• data minimisation;
• appropriate Article 9 condition for health or trade-union data;
• transparency;
• transfer compliance;
• security;
• appropriate retention. If realistic dummy data or a smaller dataset could test the software, transferring complete live employee records may not be necessary.

---

3. “Member States may”

The word“may” means that Member States are permitted, but not required, to adopt a separate comprehensive employee-data law.

A Member State may choose to regulate employment data through:

• a general data protection statute;
• labour legislation;
• workplace-surveillance law;
• occupational health and safety law;
• sector-specific rules;
• collective bargaining legislation;
• binding collective agreements;
• works agreements.

If no qualifying national rule exists, the GDPR still applies directly. Employees do not lose GDPR protection merely because their Member State did not use Article 88.

Illustration

Member State A has a detailed statute regulating:

• recruitment screening;
• workplace cameras;
• email monitoring;
• employee health records;
• biometric attendance. Member State B has no dedicated employee-data statute. In Member State B, the employer must apply the GDPR directly, together with any other relevant labour or privacy law. Article 88’s optional character does not create a regulatory vacuum.

---

4. “More specific rules”

A national rule must add genuine employment-specific normative content. It cannot merely repeat the GDPR in general language.

This was the central lesson of Hauptpersonalrat der Lehrerinnen und Lehrer, Case C-34/21. The CJEU held that national legislation cannot qualify as a “more specific rule” if it fails to satisfy Article 88(2). Rules adopted under Article 88 must contain safeguards tailored to employment, not simply restate that employee data may be processed where necessary. If a purported Article 88 rule is invalid, a national court must disregard it unless it independently qualifies under another GDPR legal route, such as a compliant Article 6(3) legal basis.dpcuria+2

Weak rule

“Employers may process employee data where necessary for employment.”

This largely repeats the GDPR and offers little guidance concerning:

• necessity;
• monitoring;
• transparency;
• access;
• retention;
• sensitive data;
• employee dignity.

Genuinely specific rule

“An employer may use video surveillance to protect high-value property only where a documented risk assessment establishes necessity, less intrusive measures are inadequate, employees receive prior notice, cameras exclude break and sanitary areas, access is restricted, recordings are retained for a defined short period, and covert use is permitted only for a time-limited investigation of a concrete suspicion.”

The second rule addresses the realities of employment and provides actual protective safeguards.

4.1 Particularisation, not deregulation

“More specific” does not necessarily mean “more restrictive for employers” in every respect. A national rule can clarify when processing is lawful and thereby provide legal certainty to both sides.

But its objective must remain the protection of employees’ rights and freedoms.

A Member State cannot use Article 88 simply to give employers wider powers without corresponding safeguards.

5. By law

Article 88 permits more specific rules to be created by national law.

Such law should be:

• accessible;
• sufficiently clear;
• foreseeable;
• compatible with the GDPR;
• directed at employment processing;
• accompanied by appropriate safeguards.

The rule must allow employers, employees, unions, courts and supervisory authorities to understand:

• what processing is permitted;
• for which purposes;
• subject to which limits;
• with what rights and remedies.

A vague ministerial practice, employer custom or unpublished government instruction would not normally provide the legal certainty expected of a lawful rule.

Recital 8 permits Member States, where the GDPR allows national specification, to reproduce elements of the GDPR where necessary for coherence and comprehensibility. That does not permit a Member State to present a mere repetition of GDPR wording as a complete Article 88 regime.europa+1

6. By collective agreements

Article 88 also permits employment-data rules through collective agreements. Recital 155 includes works agreements within this idea.

A collective agreement ordinarily involves:

• an employer or employer organisation;
• a trade union, works council or other recognised employee representation body;
• rules governing employment conditions or workplace relations.

Collective bargaining may be particularly suitable for employee data protection because workers can negotiate collectively rather than being asked individually to accept intrusive processing.

Illustration

An employer plans to introduce GPS tracking in company vehicles. A works agreement may define:

• permitted purposes;
• working-hour tracking;
• emergency use;
• prohibition of private-time tracking;
• access rights;
• retention period;
• disciplinary-use restrictions;
• employee information;
• audit rights. The agreement may provide more practical protection than an individually drafted employer notice.

6.1 A collective agreement is not automatically valid

The fact that employee representatives agreed does not prove GDPR compliance.

In MK v K GmbH, the CJEU held that collective bargaining parties may have a margin of discretion, but national courts retain full authority to review necessity under Articles 5, 6 and 9.ipcuria+2

Illustration

A works council agrees that the employer may record:

• every keystroke;
• every website;
• every private message;
• webcam images;
• microphone audio to evaluate productivity. The agreement cannot make such surveillance necessary merely by contractual declaration. A court must independently assess:
• purpose;
• necessity;
• proportionality;
• less intrusive alternatives;
• human dignity;
• special-category data;
• transparency.

6.2 Binding legal effect

Whether a collective agreement can itself support an Article 6(1)(c) legal obligation depends on whether it has binding legal effect under the applicable national framework.

A non-binding staff-consultation document may be important evidence but may not create a legal obligation.

The employer should identify precisely whether the agreement operates as:

• a statutory legal obligation;
• a rule governing employment-contract performance;
• evidence in a legitimate-interests balance;
• an additional safeguard;
• a limitation on management powers.

7. Meaning of “employee”

The GDPR does not define “employee.”

The CJEU has interpreted the concept autonomously and broadly. The essential characteristics are that, for a period of time, a person performs services for and under the direction of another person in return for remuneration. Public-sector employment is included.dpcuria+1

Article 88 may therefore cover:

• permanent employees;
• fixed-term employees;
• part-time workers;
• apprentices;
• public officials;
• teachers;
• agency workers, depending on the relationship;
• probationary staff;
• some platform or gig workers if the factual relationship is one of subordination.

Illustration

A delivery platform calls a rider an “independent partner,” but the platform:

• determines working methods;
• controls prices;
• assigns jobs;
• evaluates performance;
• imposes sanctions;
• restricts substitution. The contractual label is not necessarily decisive. If the factual relationship is one of subordination, employment protections, potentially including Article 88 rules, may apply.

7.1 Applicants and former employees

Paragraph 1 expressly covers recruitment and termination. Article 88 therefore extends beyond currently active employees.

It can cover:

• job applicants;
• unsuccessful candidates;
• employees serving notice;
• former employees where post-employment processing remains connected with employment.

Illustration

An unsuccessful applicant’s CV is retained for five years for unspecified future opportunities. The processing remains connected with recruitment even though no employment contract was formed. The employer should consider:

• lawful basis;
• notice;
• necessity;
• retention period;
• whether separate consent is genuinely voluntary;
• future vacancy relevance.

---

8. Recruitment

Recruitment commonly involves processing:

• CVs;
• qualifications;
• references;
• interview notes;
• identity information;
• salary expectations;
• background checks;
• aptitude tests;
• online profiles;
• criminal-record data;
• health information;
• automated rankings.

The fact that information may be useful does not make it necessary.

Illustration: social-media screening

An employer reviews a candidate’s public professional profile to verify experience relevant to the role. That may be easier to justify than secretly investigating:

• political views;
• relationships;
• religious affiliation;
• photographs from private life. A publicly accessible post remains personal data. Public availability does not authorise unlimited employment use.

8.1 Recruitment algorithms

Automated systems may rank applicants using:

• language;
• employment history;
• postcode;
• facial analysis;
• personality inference;
• behavioural data.

Risks include:

• hidden discrimination;
• inaccurate inference;
• proxy variables;
• lack of explanation;
• exclusion without human review.

The employer must assess:

• lawful basis;
• necessity;
• transparency;
• Article 22;
• DPIA requirements;
• data quality;
• bias;
• meaningful human involvement.

An external recruitment platform does not remove the employer’s responsibility. The employer may be controller, joint controller or customer of a processor, depending on actual decisions about purposes and means.

9. Performance of the employment contract

Article 88 expressly covers processing necessary for performance of the employment contract.

Common examples include:

• payroll;
• scheduling;
• work allocation;
• contact information;
• leave administration;
• performance management;
• business travel;
• provision of equipment.

But the Article 6(1)(b) contractual basis is narrow. Processing must be objectively necessary to perform the contract, not merely mentioned in it.

Illustration

Processing an employee’s bank details is necessary to pay salary. Continuous monitoring of the employee’s precise location may not be necessary merely because the employment contract says: “The employee accepts any monitoring selected by management.” A contract cannot manufacture necessity. The employer should distinguish processing necessary for:

• the specific employment bargain;
• general business convenience;
• legal compliance;
• security;
• optional services;
• analytics. Each may require a different lawful basis.

---

10. Legal and collective-agreement obligations

Employers process data to comply with:

• tax law;
• social-security law;
• immigration obligations;
• occupational safety;
• working-time rules;
• equality reporting;
• collective agreements;
• court orders;
• wage garnishment;
• statutory leave.

The likely Article 6 basis is often legal obligation or public task.

Illustration

An employer reports salary and tax-identification information to the tax authority because national law requires it. The employer should not seek employee consent for that mandatory processing. Doing so misleadingly suggests the employee can refuse. The legal obligation must be sufficiently clear concerning:

• purpose;
• categories;
• recipients;
• retention;
• affected persons.

---

11. Management, planning and organisation of work

This category may cover:

• staffing levels;
• rota planning;
• productivity analysis;
• resource allocation;
• skill mapping;
• succession planning;
• restructuring;
• workforce analytics.

Such processing may be legitimate, but it can easily become excessive.

Illustration

A call centre measures:

• number of calls handled;
• average response time;
• customer resolution rate. These metrics may help organise work. Now suppose it also records:
• every keystroke;
• all screen content;
• private messages;
• bathroom breaks;
• webcam images;
• continuous emotional analysis. The second system intrudes much more deeply into human dignity and requires far stronger justification. Workforce analytics should use:
• aggregated information where possible;
• pseudonymisation;
• limited access;
• defined purposes;
• short retention;
• safeguards against individual adverse decisions based on unreliable metrics.

12. Equality and diversity

Employers may process data to:

• monitor pay equality;
• identify discrimination;
• support inclusion;
• meet reporting duties;
• provide accommodations;
• assess promotion patterns.

The difficulty is that diversity information may include Article 9 data, such as:

• racial or ethnic origin;
• disability or health;
• religion;
• sexual orientation;
• trade-union membership.

An Article 6 lawful basis is not enough. The employer also needs an Article 9 condition.

Illustration

An employer asks staff to complete a voluntary diversity questionnaire. Safeguards may include:

• genuine voluntariness;
• “prefer not to say” option;
• separation from individual HR files;
• aggregate reporting;
• restricted access;
• no use in performance decisions;
• transparent explanation;
• defined deletion. The employer should not promise anonymity if responses can be reidentified from small teams.

12.1 Positive purpose does not remove risk

A diversity initiative may have a beneficial objective, but poor design can expose employees to:

• discrimination;
• stigma;
• unwanted disclosure;
• retaliation.

A good intention does not substitute for legal basis, necessity and safeguards.

13. Health and safety at work

Health and safety processing may include:

• occupational-health assessments;
• workplace injuries;
• fitness for work;
• disability accommodations;
• exposure monitoring;
• sickness absence;
• emergency contacts;
• vaccination status where legally relevant.

Health data are special-category data.

Illustration

An occupational physician assesses whether an employee can safely perform a role. The manager may need to know:

• fit for work;
• fit with restrictions;
• not fit. The manager may not need:
• diagnosis;
• medication;
• complete medical history;
• counselling notes. Data minimisation requires separation between clinical information and management decisions.

13.1 Absence records

An employer may need to record sickness absence for pay and leave administration. It does not follow that every manager needs the diagnosis.

Access should be limited according to function:

• payroll may need absence dates;
• HR may need statutory certificates;
• occupational health may need clinical details;
• line managers may need restrictions, not diagnosis.

14. Protection of employer or customer property

Employers may process data to prevent:

• theft;
• fraud;
• cyberattacks;
• misuse of vehicles;
• unauthorised disclosure;
• damage to property;
• threats to customers.

Possible measures include:

• CCTV;
• access cards;
• security logs;
• vehicle tracking;
• fraud analytics;
• email-security tools.

The purpose may be legitimate, but the method must be necessary and proportionate.

Illustration

A warehouse has repeated theft of high-value goods. Cameras focused on access points and storage areas may be justified. Installing cameras in:

• bathrooms;
• changing rooms;
• permanent rest areas would seriously interfere with dignity and will ordinarily be unacceptable.

14.1 Customer property

A bank may monitor access to customer accounts to detect employee misuse.

The monitoring protects customers and may be required by financial regulation.

Safeguards should include:

• clear access rules;
• logging;
• risk-based alerts;
• limited review;
• separation of duties;
• fair investigation procedure.

15. Rights and benefits related to employment

Article 88 covers individual and collective rights and benefits, such as:

• pensions;
• insurance;
• bonuses;
• leave;
• parental benefits;
• employee assistance;
• union rights;
• occupational benefits;
• disability support;
• training entitlements.

Illustration

An employer shares employee and dependent data with an insurance provider. The employer should disclose only information necessary for:

• enrolment;
• eligibility;
• premium administration;
• claim support where authorised. The insurer should not receive complete HR files. The employer should also clarify whether:
• the insurer is an independent controller;
• a broker is involved;
• family members receive notices;
• health information is processed;
• cross-border transfers occur.

---

16. Termination and post-employment processing

Termination can involve:

• disciplinary records;
• exit interviews;
• severance;
• litigation holds;
• return of property;
• access removal;
• references;
• pension administration;
• investigations;
• legal claims.

The end of employment does not require immediate deletion of every record. Some information must be retained for:

• tax;
• pensions;
• legal claims;
• statutory reporting;
• contractual obligations.

But indefinite retention of complete personnel files is rarely justified.

Illustration

An employer retains:

• payroll records for the statutory period;
• pension data for long-term administration;
• disciplinary notes forever;
• all emails indefinitely. Each category requires a separate retention analysis. A disciplinary warning that expired years ago should not automatically remain available for future decisions without a clear need.

---

17. Consent in employment

Consent is lawful only if freely given.

Because of the employer’s power, it is frequently unsuitable.

The EDPB’s consent guidance and earlier European workplace guidance emphasise the need for genuine choice and careful proportionality in employment.europa+2

Illustration: invalid consent

Employees are asked to consent to facial recognition for attendance. Refusal requires signing in manually at a distant office, causes delays and attracts management criticism. The alternative is disadvantageous, so consent may not be freely given.

[!example] Illustration: potentially valid consent An employer asks whether volunteers want their photograph displayed in an optional social-event newsletter. Refusal has no workplace consequence and photographs can be removed easily. Consent may be more realistic. The employer must not use consent simply because it appears administratively easy. It should first ask whether another lawful basis applies and whether the employee truly has a consequence-free choice.

18. Monitoring systems at the workplace

Article 88(2) specifically highlights workplace monitoring because it creates exceptional risks to dignity and autonomy.

Monitoring can include:

• CCTV;
• email review;
• web-usage logs;
• keystroke logging;
• screen capture;
• location tracking;
• attendance monitoring;
• biometric systems;
• call recording;
• productivity scoring;
• wearable devices;
• AI-based behavioural assessment.

Employees retain privacy rights at work. An employer’s ownership of equipment does not eliminate those rights. European supervisory guidance similarly states that workplace monitoring is not automatically prohibited, but necessity, less intrusive alternatives and privacy safeguards must be assessed.europa+2

18.1 A structured monitoring test

Before monitoring, the employer should ask:

1. What precise problem is being addressed?
2. Is the problem real and documented?
3. Will monitoring actually solve it?
4. Is a less intrusive method available?
5. Which employees and data are involved?
6. Will private information be captured?
7. How long will monitoring continue?
8. Who may access results?
9. Can results lead to disciplinary action?

10. Is a DPIA required?

11. Must a works council be consulted?

12. Have employees been clearly informed?

18.2 Continuous productivity surveillance

Continuous monitoring is especially intrusive because employees may feel permanently observed.

Illustration

Software records every minute without keyboard activity and automatically reduces pay. The system may misinterpret:

• meetings;
• reading;
• thinking;
• telephone calls;
• offline work;
• disability-related breaks. A metric that is technically measurable is not necessarily a fair measure of work.

18.3 Covert monitoring

Secret monitoring normally requires exceptional justification, such as:

• concrete suspicion of serious misconduct;
• ineffectiveness of less intrusive methods;
• narrow targeting;
• short duration;
• restricted access;
• legal authorisation;
• protection of privileged or private communications.

General suspicion that “someone may be wasting time” does not justify covert surveillance of the whole workforce.

18.4 Remote work

Home monitoring can capture:

• family members;
• private spaces;
• medical information;
• domestic conversations;
• non-working activity.

Employers should normally prefer performance based on:

• outputs;
• agreed tasks;
• deadlines;
• availability arrangements

rather than continuous home surveillance.

19. Transparency

Article 88(2) gives particular importance to transparency.

Employees should understand:

• what is collected;
• why;
• lawful basis;
• recipients;
• retention;
• monitoring logic;
• consequences;
• rights;
• complaint routes.

A privacy notice should not say merely:

“We may monitor systems for business purposes.”

A meaningful notice should explain:

• systems monitored;
• content or metadata;
• active hours;
• triggers;
• persons with access;
• disciplinary use;
• automated analysis;
• retention.

19.1 Transparency does not cure excessive processing

Informing employees about continuous surveillance does not make it proportionate.

Transparency is necessary, but it is not a substitute for:

• necessity;
• lawful basis;
• minimisation;
• fairness;
• safeguards.

20. Transfers within corporate groups

Article 88(2) specifically highlights transfers within a group of undertakings or enterprises engaged in joint economic activity.

A corporate group is not one controller merely because it shares ownership.

Each transfer requires analysis of:

• the receiving legal entity;
• controller or processor role;
• purpose;
• necessity;
• lawful basis;
• access;
• international-transfer rules;
• employee information.

Illustration

A subsidiary transfers complete employee files to its parent company for global talent planning. The parent may need:

• role;
• qualifications;
• performance category;
• mobility preferences. It may not need:
• local medical certificates;
• detailed disciplinary files;
• union information;
• family insurance documents. The employer should use field-level minimisation and access separation rather than copying complete files into a global HR platform. The MK v K GmbH case demonstrates that a works agreement authorising a group transfer does not prevent full judicial review of necessity.europa+2

---

21. Human dignity

Human dignity is expressly protected by paragraph 2.

In employment, dignity means that employees should not be reduced to:

• productivity scores;
• behavioural profiles;
• risk labels;
• objects of constant observation.

Illustration

An AI system labels employees:

• “likely to resign”;
• “emotionally unstable”;
• “low loyalty”;
• “fraud risk.” The labels may affect promotion or termination even though employees cannot understand or challenge them. Safeguards should address:
• data quality;
• explainability;
• human review;
• contestability;
• bias;
• prohibition of degrading monitoring;
• limits on high-impact inferences. Dignity is not merely about secrecy. It concerns how information processing changes the human relationship between employer and employee.

---

22. What happens when national law fails Article 88?

If a national rule claims to rely on Article 88 but merely repeats the GDPR or lacks suitable and specific safeguards, it cannot function as a valid Article 88 rule.

Following Hauptpersonalrat, the national court must disregard the deficient provision as an Article 88 measure. It should then examine whether the rule may independently qualify under another GDPR basis, particularly Article 6(3).dpcuria+2

Illustration

A national statute says: “Public employers may process employee data where necessary.” It contains no rules concerning:

• transparency;
• monitoring;
• safeguards;
• dignity;
• purpose;
• limits. The court may conclude that it is not sufficiently specific under Article 88. The employer must then identify a valid basis directly under the GDPR or another compliant legal provision. It cannot rely on the defective Article 88 label.

---

23. Paragraph 3: Notification to the Commission

Member States had to notify the Commission by 25 May 2018 of laws adopted under paragraph 1 and must notify later amendments without delay.

The Commission publishes Member State GDPR notifications, including employment-processing provisions notified under Article 88(3).europa

Notification supports:

• transparency;
• comparison of national regimes;
• Commission oversight;
• detection of invalid or overly broad rules;
• legal certainty for cross-border employers.

The wording refers to provisions of Member State law. It does not clearly require notification of every individual collective agreement, which would be impractical.

Notification does not amount to Commission approval. A notified law may still be challenged before a national court or interpreted by the CJEU.

24. Practical compliance example

Assume an employer wants to introduce an AI productivity platform that collects:

• login times;
• application usage;
• keystrokes;
• email metadata;
• meeting attendance;
• location;
• performance scores.

A lawful analysis would proceed as follows.

First, the employer defines the purpose. “Improving productivity” is too broad. It must explain whether the system addresses:

• staffing;
• billing;
• security;
• working-time compliance;
• performance management.

Second, it checks applicable Article 88 national law and collective agreements.

Third, it identifies lawful bases for each operation.

Fourth, it tests necessity. Could the employer use:

• project completion;
• output measures;
• ordinary supervision;
• periodic reporting?

Fifth, it conducts a DPIA if high risk is likely.

Sixth, it consults employee representatives where required.

Seventh, it removes unnecessary features, such as continuous keystroke capture.

Eighth, it defines safeguards:

• working-hours-only collection;
• no private-content capture;
• short retention;
• limited access;
• no automatic dismissal;
• employee challenge rights;
• accuracy checks;
• human review.

Ninth, it provides detailed transparency.

Tenth, it reviews the system regularly and removes it if the purpose no longer justifies the intrusion.

Article 88 does not produce a simple yes-or-no answer. It requires employment-specific governance grounded in necessity and dignity.

25. Corrections and qualifications to the supplied commentary

Several points require qualification.

First, Article 88 does not necessarily mean that Member States may only increase protection. They may clarify and particularise workplace processing, but they cannot fall below the GDPR or omit Article 88(2) safeguards.

Second, a collective agreement is not automatically an Article 6 legal basis. Its legal effect depends on the applicable system and the particular processing.

Third, parties to a collective agreement do not have final authority to declare processing necessary. Courts must conduct full review, as confirmed in MK v K GmbH.europa+1

Fourth, employee consent is not always invalid, but the power imbalance makes it exceptional and context-dependent.

Fifth, Article 88 covers public-sector employment. The legal nature of the employer is not decisive.

Sixth, self-employed workers are not automatically outside every protection. They remain data subjects under the GDPR, even if a particular Article 88 employment rule does not apply.

Seventh, national law cannot merely reproduce general GDPR wording. It must provide genuinely more specific safeguards.

Eighth, workplace transparency alone does not legalise unnecessary monitoring.

Ninth, data transfers inside a corporate group remain disclosures between legal entities and require a lawful basis, necessity and safeguards.

Finally, Article 88 does not displace Articles 5, 6 and 9. The CJEU has now authoritatively confirmed that employment-specific rules and collective agreements operate alongside those provisions, not instead of them.ipcuria+1

Conclusion

Article 88 allows national employment traditions to coexist with the GDPR, but only within strict limits. Member States and collective bargaining parties may create specific rules for:

• recruitment;
• contract performance;
• payroll and statutory duties;
• work organisation;
• equality and diversity;
• occupational health;
• property and security;
• employment benefits;
• workplace monitoring;
• termination and post-employment administration. Those rules must do more than authorise employers to process data. They must contain suitable and specific safeguards for:
• human dignity;
• legitimate interests;
• fundamental rights;
• transparency;
• group transfers;
• workplace monitoring. The most important legal principles are:

1. The GDPR remains fully relevant.
2. Article 88 is an opening clause, not an exemption.
3. National rules must be genuinely specific.
4. Collective agreements cannot override necessity.
5. Consent is often unreliable because of workplace power imbalance.
6. Monitoring must be necessary, proportionate and transparent.
7. Corporate-group transfers are not automatically lawful.
8. Special-category employee data require Article 9 compliance.
9. Courts retain full review over national and collectively agreed processing.

10. Invalid Article 88 rules must be disregarded unless another valid GDPR basis exists.

The clearest summary is:

An employer does not acquire broad rights over personal data merely because it pays the employee or owns the workplace systems. Article 88 permits employment-specific rules because work creates genuine organisational needs, but those rules must respect the employee as a person rather than treating them as a permanently observable business resource.