4. Policy recommendations EU legal framework on worker data rights: improvements, simplification, and better implementation The role of the GDPR in the protection and advancement of worker data rights is modest at the moment, compared to the role of existing labour law provisions in most Mem­ber States. However, it has the potential to gain significant­ly in importance, thereby complementing national labour law frameworks and addressing the observed lack of en­forcement of workers´ data protection rights. GDPR: better implementation → Make sure that future evaluations of – and amendments to – the GDPR will be evidence-based(Dixon 2025). That requires specifying the DPAs monitoring and data gathering requirements, encouraging the publi­cation of DPA decisions , as well as adopting EDPB guidelines to standardise annual reports . Specifically, introduce reporting and transparency obligations on decisions and possibly on complaint handling to address the“black box” between complaint submission and deci­sion, with specific figures regarding the workplace con­text. → The EDPB should develop workplace-specific GDPR guidance , including for instance when companies can rely on“legitimate interest”, by updating guidance that precedes the applicability of the GDPR. This would re­duce legal uncertainty for both workers and employers. → The EDPB and DPAs should complement work­place-specific guidance by facilitating and encouraging certification schemes and codes of conduct that specif­ically focus on workplace data processing(Nogarede, Silberman& Bronowicka 2024). This will reduce the en ­forcement burden on DPAs and foster compliance. Changes to the GDPR Under the banner of simplification, the Digital Omnibus Act proposes several changes to the GDPR. However, these proposed changes leave potential areas for harmonisation unaddressed, whereas they suggest to weaken provisions that are crucial for workplace data protection. → To address the divergent implementation of representa­tive actions for workers under Article 80 GDPR and har ­monise the legal framework, the EU should: • Explicitly recognise workers’ representatives as rep­resentative entities under Article 80 GDPR, depend ­ing on national labour law. • Make Article 80(2) mandatory for Member States. Not only will this simplify the legal environment, but it will also make it easier for workers´ representatives to act in the interest of workers, thereby helping the DPAs in ensuring observance of the law. → Harmonise procedural rules across Member States, en­suring clearer, simpler, and more transparent DPA proce­dures, simplifying those now in the process of being adopted by the EU in relation to cross-border cases. 29 → Preserve the strength of Articles 12 and 15 GDPR by re­jecting the proposed amendments in the Digital Om­nibus Act that would allow controllers to charge a fee or refuse access requests where a data subject is per­ceived to“exploit” the rights conferred by the GDPR for purposes other than data protection . Weakening the right to access would undermine transparency and workers’ ability to gather evidence to support labour and data protection claims. Given its proven effectiveness, limiting access rights would significantly hamper work­place GDPR enforcement. Beyond the GDPR: ensuring a dedicated EU legal framework for data protection in the workplace In the future, the EU should establish a general EU-level data protection framework specifically tailored to the employment context . This would provide a higher and more context-sensitive level of protection than the GDPR, with the algorithmic management safeguards currently en­visaged for platform workers under the Platform Work Di­rective serving as a reference model for all workers. Such a law should recognise at EU level the collective dimension of data protection in the workplace , by granting explicit and enforceable rights to workers’ representatives. 29  https://www.europarl.europa.eu/doceo/document/TA-10-2025-0238_EN.html. 16 Friedrich-Ebert-Stiftung e.V.