A N A LYS I S Giovanni Gaudio and Justin Nogarede December 2025 Worker Data Rights under the GDPR and Beyond Enforcement and Legal Mobilisation Across the EU Competence Centre on the Future of Work

Imprint Published by Friedrich-Ebert-Stiftung e.V. Godesberger Allee 149 53175 Bonn, Germany info@fes.de Issuing Department Competence Centre on the Future of Work Cours Saint Michel 30a, 1040 Brussels, Belgium For more information about the Competence Centre on the Future of Work, please consult: https://www.futureofwork.fes.de Responsibility for Content and Editing Justin Nogarede justin.nogarede@fes.de Proofreading Isabelle St-Hilaire Design/Layout pertext| corporate publishing www.pertext.de Cover picture Cecilie Skjold Wackerhausen / peopleimages.com The views expressed in this publication are not necessarily those of the Friedrich-Ebert-Stiftung(FES). Commercial use of media published by the FES is not permitted without the written consent of the FES. Publications by the FES may not be used for electioneering purposes. December 2025 © Friedrich-Ebert-Stiftung e.V. ISBN 978-3-98628-807-5 Further publications of the Friedrich-Ebert-Stiftung can be found here: ↗ www.fes.de/publikationen

Giovanni Gaudio and Justin Nogarede December 2025 Worker Data Rights under the GDPR and Beyond Enforcement and Legal Mobilisation Across the EU

Contents 1. Worker data rights and the limits of the GDPR: The reasons behind this report .....................................  3 The rise of data-driven surveillance and algorithmic management, and the relevance of the GDPR ....................................  3 Mapping GDPR enforcement in the workplace across the EU ............  4 2. Better regulation starts with better evidence: Fixing the GDPR’s reporting gap ...................................  6 3. Empirical findings: How GDPR enforcement works(and fails) in practice ..................  8 Introduction: a landscape of fragmentation and underenforcement.................  8 The GDPR and more specific rules on data processing at work: where fragmentation starts .......................................  9 Where enforcement happens: workers’ data protection rights before DPAs and courts ...............  11 Workers’ representatives and collective enforcement: the untapped potential of the GDPR ...............................  13 4. Policy recommendations .........................................  16 Bibliography .....................................................  17

1. Worker data rights and the limits of the GDPR: The reasons behind this report The rise of data-driven surveillance and algorithmic management, and the relevance of the GDPR Digital monitoring and algorithmic management systems are on the rise in workplaces across the EU. The European Working Conditions Survey of 2024(Euro found 2024) reports that 42,3% of EU workers have their work influenced by algorithmic management. Although exact numbers and definitions differ, these results dovetail with various recent studies from the European Commission(EC 2023), the OECD(OECD 2025), and the Eu ropean Parliament Research Service(Barslund et al. 2025). For example, the last study expects that close to 50% of European workers will be subjected to one or more forms of algorithmic management by 2030. From the perspective of a worker, the essence of algorithmic management is the automation of managerial tasks, irrespective of the exact techniques used and their complexity. Therefore, for the purpose of this report, we rely on a broad definition of algorithmic management, in line with the study from the European Commission (EC 2023: 11–12). This is not restricted to automated deci sions, but also includes data collection and surveillance as such. Existing research confirms that algorithmic management is no longer a niche phenomenon, restricted to the platform economy, but it is already widespread across more traditional workplaces(Wood 2021; Baiocco et al. 2022; Uma et al. 2024). While some uses may be harm less and bring efficiency gains, there are real concerns. Ubiquitous surveillance undermines workers’ fundamental rights and workplace trust, as well as workers’ motivation and mental health. Algorithmic systems can also be used to accelerate the pace of work, with increased stress and health and safety risks for workers. A study from the Foundation for European Progressive Studies examining various Nordic countries(FEPS 2024) shows that the negative effects are already being felt by workers in, for instance, logistics and telemarketing. Many algorithmic management systems rely on workers’ individual data(Mateescu 2023). That means that their use is highly likely to be regulated by the General Data Protection Regulation(GDPR), that employers must have a valid legal ground to process workers’ personal data, and that workers can benefit from legal rights to learn, access, restrict and retrieve what personal data is being collected and used, and, in the case of automated decision-making, to object to it. However, many commentators consider that the GDPR, while important, is not fully equipped to address the specificities of workplace data governance. In the past, several attempts were made to develop a dedicated EU framework for workplace data protection, but these initiatives failed to advance due to a lack of consensus among stakeholders(De Hert& Lammerant 2013; Aloisi, Joppe& Abraha 2025). As a result, the protection of workers’ data is governed primarily by the general framework of the GDPR, which nonetheless acknowledges the gaps and the special nature of employment-related data processing through Article 88, allow ing Member States to adopt more specific rules in this area. While this has encouraged diverse and sometimes innovative regulatory approaches, it has also contributed to fragmentation, legal uncertainty, and uneven implementation, interpretation and enforcement across Member States(Abraha 2022), mirroring the situation that ex isted prior to the GDPR under Directive 95/46/EC(Hen drickx 2002). Another core concern is that the GDPR is conceptually framed around data subjects’ individual rights, which is insufficient in a context marked by structural power imbalances: effective protection in the workplace would often require collective forms of oversight and enforcement to provide a counterweight to an employer’s power(Hendrickx 2019; Todolí-Signes 2019; Nog arede 2021; De Stefano& Wouters 2022; Abraha 2023; Adams& Wenckebach 2023; EC 2023; Otto 2026). In oth er words, individual rights alone cannot adequately safeguard workers – collective data rights are also needed. These criticisms have informed the Platform Work Directive, which in its Chapter III on algorithmic management introduces, for the first time, workplace-specific data protection safeguards that go beyond the minimum harmonisation logic of the GDPR(Otto 2022; Aloisi, Joppe& Abraha 2025) and, crucially, extends these rights not only to individual workers but also to their representatives(Rainone 2025). At the same time, the Platform Work Directive applies exclusively to platform workers, creating a situation in which they benefit from stronger rights than traditional employees. Given that algorithmic management is now widespread well beWorker data rights and the limits of the GDPR 3

yond the platform economy, there is a strong argument for extending these workplace-specific, and explicitly collective, data rights to all workers, irrespective of their sector or type of relationship(Adams-Prassl et al. 2025; ETUC 2025a). This call has been taken up by the European Parliament’s Committee on Employment and Social Affairs which has voted for an own-initiative report calling for a new law on algorithmic management(EP 2025). The Eu ropean Commission is more focused on improving the enforcement of existing legislation like the GDPR and the AI Act, but has left the door open to a new legal initiative, provided it is targeted and complementary to the existing legal framework(EC 2025). Yet, despite the al leged shortcomings of the current framework, there has been little analysis of how the GDPR is actually applied in the workplace – how is it being implemented, used, and especially enforced. How does it interact with analogous national labour law provisions, which in many Member States provide more specific and more protective rules on workplace data protection? Although hard numbers are difficult to come by, there is strong circumstantial evidence that many workplace surveillance and algorithmic management technologies are being adopted without respecting existing data protection laws. For instance, in a survey among managers of EU firms(OECD 2025), 69% of employers said their al gorithmic systems did not process the personal data of workers – which is very unlikely given the expansive concept of personal data under the GDPR. As the authors infer,“it is likely that managers in these countries underestimate(or underreport) data collection”(OECD 2025: 49). In addition, several studies highlight the intru sive software being offered within the EU, with default functionality that is very hard to square with established GDPR principles like data minimisation and fairness (Christl 2021; Christl 2023; Christl 2024). In other words, significant non-compliance is suspected. Therefore, questions of implementation and enforcement are central. As has been observed(McDonald 2020), many of the EU’s digital laws, like the GDPR, ena ble the EU-wide and global exchange of personal data, whilst paying comparatively little attention to how these rules are to be implemented and enforced in practice. The latter are left to national authorities that – especial ly in the absence of a centralised system, harmonised procedures, and adequate resources(Magierska& Hassel 2025) – may be ill-equipped to adjudicate the dis putes arising from the increased processing of personal data. Unsurprisingly, there has been criticism of the lack of GDPR enforcement(ICCL; BEUC; Magierska& Hassel 2025), which has been echoed to some extent by the Eu ropean Commissions’ own evaluations(EC 2020; EC 2024). These have led to the imminent adoption of the GDPR procedural rules regulation. 1 Mapping GDPR enforcement in the workplace across the EU The EU, and data protection authorities(DPAs), have been criticised for not sufficiently enforcing the GDPR. Yet, there has been little specific investigation into the situation for workplace data protection. Therefore, the Arbeiterkammer Vorarlberg, together with the FriedrichEbert-Stiftung’s Competence Centre on the Future of Work, commissioned a team of experts to map the state of play around workplace data protection in Austria, Belgium, France, Germany, Ireland, Italy, Luxembourg, Poland, Spain and the Netherlands. 2 Based on a questionnaire, experts provided insights into the enforcement of the GDPR in the workplace in general, as well as the enforcement of other data protection rights provided under national labour laws; the complaints, decisions and oth er activities of DPAs in the field of workplace data protection; and the activities of courts dealing with work place-related data protection issues. Experts were also asked to examine the provisions that may enable collective enforcement, starting with Articles 80(1) and 80(2) GDPR and their national implementation, as well as other domestic mechanisms that may allow trade unions and works councils to bring actions to enforce data-protection rights. The study finds that there is a general underenforcement of data protection rights in the workplace, as well as significant divergence across the EU when it comes to the implementation of the GDPR in employment contexts, and how it complements national labour laws. Among the possible solutions, one would consist in the full and effective implementation of Article 80 GDPR, which remains largely unused. While this provision could help with the collective enforcement of worker data rights, it is universally not(fully) implemented. A first recommendation would be to remedy that situation by making the full Article 80 GDPR mandatory, instead of voluntary. This could be done in the Digital Omnibus Act that is now being negotiated at the EU level. Second, there is lack of available and standardised data that would give a clear picture of the situation around the application of the GDPR to workplace contexts. DPAs use different definitions of“workplace” or employee data processing and routinely do not publish follow-ups to complaints, let alone specify how many com1  https://www.europarl.europa.eu/doceo/document/TA-10-2025-0238_EN.html. 2  The experts have collected information on DPA activity until 31 December 2024, and on relevant court cases and legal developments until 30 September 2025. The exception is the Netherlands, where the inventory of relevant court cases and legal developments runs until February 2025. 4 Friedrich-Ebert-Stiftung e.V.

plaints relate to the workplace. This should be a concern, especially for a European Commission that is committed, under the flag of“Better Regulation”, to make laws with the best available evidence. The evidence available shows that the majority of cases deal with established technologies, like video surveillance and email. Outside the platform economy, there is hard ly anything around algorithm management and Article 22 GDPR – a circumstance that further illustrates the ex tent of underenforcement, given the widespread use of these technologies. Third, although the role of DPAs is crucial, and they have broad competences, their level of engagement with workplace data protection issues varies greatly. To give two examples at opposite ends of the spectrum, whereas the Italian DPA has worked – even ex officio on vari ous high-profile cases, the Irish DPA has shown considerably less activity in this area. Broadly, there is a lack of adequate guidance tailored for the workplace(Hendrickx 2022). There is an opportunity here for the combined au thorities in the European Data Protection Board(EDPB), to come up with specific guidance for workplace data protection, which could help align and harmonise the work of national DPAs(Otto 2024). Worker data rights and the limits of the GDPR 5

2. Better regulation starts with better evidence: Fixing the GDPR’s reporting gap The GDPR has been in force for over seven years, but it is very difficult to get a systematic picture of its implementation and enforcement across Member States. It is even more challenging to assess how it is being applied in specific domains, like the workplace. After over 20 years of better regulation policies from the European Commission, starting with the European Commission’s Action Plan on“Simplifying and improving the regulatory environment”(EC 2002), there are still severe gaps in the data available for proper evaluation and assessment. The GDPR does contain various monitoring and evaluation requirements. According to Article 59, each data protection authority should publish annual reports, which“may include a list of types of infringement notified and types of measures taken”. In addition, Article 71 GDPR stipulates that the European Data Protection Board should draw up annual reports on the state of play on data protection in Europe. Finally, Article 97 GDPR obliges the European Commission to evaluate the law every four years, starting in 2020. However, these provisions together make up a woefully inadequate picture to base evaluations on, and to understand how the GDPR is being implemented and used across the EU. In this study, we endeavoured to collect data on DPA activities in the area of worker data rights – how many and what types of complaints do workers and/or their representatives bring, and how do DPAs process and handle these complaints? That information proves to be hard to come by, and there is a very large variance across the 10 countries surveyed. For the majority of DPAs that were analysed, it was not possible to track any specific and systematic information about complaints received, let alone processed, in the area of workplace data protection. Beyond that, most DPAs do not publish all their decisions, nor reliable statistics on those decisions. A positive exception is, for example, the Italian DPA, which includes a dedicated section on workplace data protection in its annual report and provides systematic access to past decisions, although the lack of detailed figures and the limited search functionality still make precise quantification difficult. A big part of better regulation – as understood by the Euro pean Commission – is about making sure citizens and busi nesses understand the law and how it applies to them. The European Commission’s communication on“Better regulation for better results – An EU agenda”(EC 2015), called on all EU co-legislators to commit to:“agree that legislation should be comprehensible and clear, allow parties to easily understand their rights and obligations[,] include appropriate reporting, monitoring and evaluation requirements, avoid disproportionate costs, and be practical to implement”. To heed this call, any future changes to the GDPR should include more detailed and harmonised reporting requirements. Better reporting is possible, as authorities in other domains show. For instance, the Netherlands’ Authority for Consumers and Markets provides detailed annual statistics on the number of consumer complaints received, investigations started and completed, and number of fines handed out, all broken down by sector(ACM 2024). Specifying and streamlining the DPAs’ reporting requirements, and making enforcement data more accessible, would provide a tangible simplification and improvement for workers, lawyers, and authorities themselves, when it comes to understanding and interpreting the GDPR. There is a significant decisional practice across Europe that is difficult to access, or not accessible at all. Were it to be made available in a more unified format, this could help create convergence on the interpretation of the GDPR(see divergent interpretation of Amazon’s surveillance, under 3a). In addition, there is a lack of specific and up-to-date guidance for the application of the GDPR in employment contexts. For core provisions around workplace data processing, such as what can be considered an employer’s legitimate interest, existing EU-level guidance is dated and for example does not mention algorithmic management and AI(Article 29 WP 2001; Article 29 WP 2017). More recent guidance, like the draft EDPB Guidelines on legitimate interest, lack specificity. For instance, the document mentions that when determining whether the interests and fundamental rights of a data subject take precedence over the legitimate interests of a data controller,“the employer-employee relationship will likely require an assessment that is 6 Friedrich-Ebert-Stiftung e.V.

different from the one concerning a service provider-customer relationship”(EDPB 2024: para. 43). However, the guidelines refrain from providing further guidance for the employment context. The same document, when providing guidance on legitimate interests in specific contexts, only refers to employment in an ancillary manner, in the context of processing for internal administrative purposes within a group of undertakings(EDPB 2024: para. 124). There, the guidance recalls that employers should pay attention to specific national rules under Article 88 GDPR. However, as this report will discuss later, such rules often follow very different logics across Member States and, rather than ensuring consistent application, have contributed to further fragmentation. In addition, guidance relevant to the employment context has to be collected, piecemeal, across various documents, including in guidance on the right of access(EDPB 2023), consent(EDPB 2020b), and video sur veillance(EDPB 2020a). Neither has the EDPB or any national DPA developed or authorised any certification scheme or privacy seal that specifically tackles personal data processing in a workplace context(EDPB Registry). Such schemes, however, could facilitate compliance and reduce the enforcement burden on DPAs. Better regulation starts with better evidence 7

3. Empirical findings: How GDPR enforcement works(and fails) in practice Introduction: a landscape of fragmentation and underenforcement The national reports confirm – and align with – findings re peatedly observed elsewhere(Nogarede 2021; De Stefano& Wouters 2022; Abraha 2023; Müllensiefen 2025), converging on a clear and consistent diagnosis: enforcement of the GDPR in the field of workers’ rights remains limited, fragmented, and uneven across the EU. Despite the rapid diffusion of digital monitoring tools and data-intensive algorithmic management systems, relatively few cases have effectively relied on the GDPR to protect workers’ data rights in general, and even fewer in relation to these emerging practices – suggesting that many potential violations may have remained under the radar, given the growing centrality of data as the fuel for these tools. In terms of subject matter, the majority of national decisions still concern conventional forms of monitoring and data usage(such as CCTV monitoring, corporate email usage, GPS tracking of company vehicles) or procedural infringements (such as the failure to respond to access requests under Article 15). By contrast, truly novel issues related to algorithmic management have generated only a handful of cases(Hiessl 2025), particularly against major platform companies provid ing food-delivery or ride-hailing services in Italy 3 (Agosti et al. 2023; EDRi 2025b) and the Netherlands 4 (Worker Info Exchange 2023) respectively, and against Amazon in France 5 and Germany 6 (Warter 2025) for its warehouse algorithmic management systems, which have nonetheless produced divergent outcomes. Overall, the emerging picture is one of asymmetry, with significant national disparities not only in the number of cases processed but also in the types of issues they address and in their outcomes. Fragmentation is also apparent in the types of violations addressed. Most cases continue to revolve around traditional and foundational provisions of the Regulation – pri marily the general principles of data processing and the lawfulness criteria under Articles 5 and 6 GDPR, together with information and access rights under Articles 13, 14 and 15 GDPR. Far fewer touch upon more innovative provisions such as Article 22 which regulates automated deci sion-making, with only a few notable exceptions, mostly confined to the platform economy. In Italy, for instance, the DPA initiated landmark investigations against Glovo and Deliveroo, leading to significant fines, 7 while in the Netherlands, similar issues were adjudicated by courts in disputes involving Uber and Ola focused specifically on the GDPR. 8 The comparative analysis across Member States thus shows that GDPR enforcement in the workplace is fragmented and incomplete. One main reason for this lies in the division of enforcement responsibilities between DPAs and judicial authorities. National procedures differ widely, undermining both comparability and coherence. While some variation is to be expected before courts, which are fully governed by national law, DPAs should theoretically not exhibit the same disparities, given their operation within what was intended to be a harmonised legal framework. Nevertheless, national reports indicate that institutional fragmentation results in uneven DPA practices, with significant differences in administrative procedures, investigative approaches, sanctioning policies, and prioritisation of labour-related cases – a central factor behind underenforce ment and inconsistent protection of workers’ data rights across Member States. A second reason for this dispersed enforcement landscape is the intersection between EU data protection law and domestic laws(Abraha 2022), which often provide more spe cific rules for protecting the personal data and the privacy of workers(Hendrickx, Mangan& Gramano 2023 and EC 2023). While data protection law is harmonised at EU level, 3 Italian DPA 10 June 2021 no. 234[9675440] – later partially overturned in relation to the excessive nature of the sanction imposed, on which see Cass. 22 September 2023, no. 27189; Italian DPA 22 July 2021 no. 285[9685994]; and Italian DPA 13 November 2024 no. 675[10074601]. 4  Court of Appeal Amsterdam, 7 March 2023, ECLI:NL:GHAMS:2023:796; Court of Appeal Amsterdam, 4 April 2023, ECLI:NL:GHAMS:2023:793; and Court of Appeal Amster dam, 4 April 2023, ECLI:NL:GHAMS:2023:804. 5  French DPA, Délibération de la formation restreinte n°SAN-2023-021 du 27 décembre 2023 concernant la société AMAZON FRANCE LOGISTIQUE. 6 LfD Niedersachsen, 28/12/2020(later overturned by VG Hannover – 10 A 6199/20). 7 See Italian DPA 10 June 2021 no. 234[9675440] – later partially overturned in relation to the excessive nature of the sanction imposed, on which see Cass. 22 September 2023, no. 27189; Italian DPA 22 July 2021 no. 285[9685994]; and Italian DPA 13 November 2024 no. 675[10074601]. 8  Court of Appeal Amsterdam, 7 March 2023, ECLI:NL:GHAMS:2023:796; Court of Appeal Amsterdam, 4 April 2023, ECLI:NL:GHAMS:2023:793; Court of Appeal Amsterdam, 4 April 2023, ECLI:NL:GHAMS:2023:804. 8 Friedrich-Ebert-Stiftung e.V.

these workplace-specific rules remain national and less harmonised. In practice, especially before courts, the protection of workers’ personal data is frequently absorbed or overshadowed by national labour frameworks. This duality has produced a structurally asymmetric regulatory field, in which enforcement patterns and substantive protections vary significantly across Member States. Notably, the GDPR tends to play a comparatively more prominent role than labour law where labour protections are weaker, such as for platform workers classified as independent contractors. This approach is consistent and readily explained: in these cases, it is strategically advantageous to focus directly on GDPR rights rather than on the preliminary question of employment status as data protection rights are in principle guaranteed to all workers, regardless of their classification(Hendrickx 2022). In addition, in this context, union involvement seems to be higher, reflecting the use of GDPR-driven claims as a tool for mobilisation and proselytism in contexts where union density and collective bargaining are weak(Gaudio 2024). A third and more conceptual difficulty concerns the individualistic architecture of the GDPR itself(Hendrickx 2019; Todolí-Signes 2019; Nogarede 2021; De Stefano& Wouters 2022; Abraha 2023; Adams& Wenckebach 2023; EC 2023; Otto 2026). Unlike labour law, which recognises collective representation and confers rights upon workers’ representatives, the GDPR is built around individual entitlements and complaint mechanisms. This asymmetry is especially evident in the workplace, where data processing concerns groups of workers collectively, and where the conscious and effective exercise of data protection rights presupposes technical knowledge and procedural resources that individual workers rarely possess. Article 80 GDPR offers a poten tial channel for collective enforcement through representative entities. However, the national reports consistently indicate that this provision has had little to no tangible impact in practice. In sum, the GDPR’s universalist framework encounters the fragmented realities of national implementation. The lack of harmonised DPA procedures, the coexistence of divergent workplace-specific rules, and the residual role of collective enforcement mechanisms have produced a patchwork of protections where workers’ data rights are unevenly recognised and, above all, weakly enforced. This gap between the GDPR’s universal ambition and the fragmented reality of data governance in the European workplace exposes a structural fault line at the heart of EU data protection enforcement. The GDPR and more specific rules on data processing at work: where fragmentation starts The limited enforcement of the GDPR in employment matters cannot be understood in isolation from the coexistence of data protection and labour law frameworks. In most Member States, national laws or collective bargaining agreements already provide more specific and generally more protective rules governing workers’ privacy and the use of their data – some of which predate the GDPR itself (Hendrickx, Mangan& Gramano 2023). These protections exist both at the individual and collective levels, reflecting the dual nature of labour rights, and remain crucial in defining the limits of managerial prerogatives, even after the GDPR entered into force. At the individual level, several jurisdictions, such as Italy, have long incorporated safeguards that restrict employers’ monitoring powers and protect workers’ personal information and privacy. At the collective level, the complementarity between data protection and labour law becomes even clearer. While the GDPR recognises rights only for individual data subjects, labour law traditionally grants not only individual workers, but also their representatives, autonomous rights that have direct or indirect implications for data protection. These typically take the form, in most Member States, of information and consultation rights, and in some cases extend to co-determination powers over the introduction of new technologies, as in Austria, Germany, Italy and Luxembourg. Through this latter mechanism, workers’ representatives may not only restrict or veto certain forms of data processing that could undermine workers’ dignity or autonomy, but also use such powers as a bargaining chip to bring employers to negotiate more tailored rules via collective bargaining – a mechanism identi fied early on as the most suitable regulatory tool for addressing not only general data protection challenges, but also those arising from the introduction of algorithmic management systems(De Stefano 2019, De Stefano& Taes 2022 and ETUC 2025b). That said, co-determination rights over technology can be significantly weakened in practice wherever union or works council representation is limited. Even in Germany— where workers’ representatives enjoy strong statutory co-determination rights— only around 45% of workers are actually represented by a works council(DE Statistics Office). In practice this means that such protections may not be effectively operative for a large share of the workforce. Moreover, for those workers and firms where works councils and unions are present, anecdotal evidence suggests that the respect of labour rights around technology are not guaranteed. As reported in the French report, Orange, a telecom operator, has been working on an automated quality management tool that records and analyses conversations in real time, without consultation of the works council. This corresponds with findings from earlier studies suggesting that works councils may not be able or willing to use their information, consultation and co-determination rights to prevent the deployment of intrusive surveillance and performance management systems(Christl 2021; Staab and Geschke 2020). More recently, certain countries have even updated their labour law frameworks to introduce provisions specifically addressing algorithmic management(EC 2023; Müllen Empirical findings 9

siefen 2025). Both Spain and Italy now require employers to disclose the logic and impact of algorithmic management systems, thereby expanding information and access rights beyond the GDPR’s scope – particularly by granting such prerogatives to workers’ representatives and not only to individual workers. 9 Germany has moved in a similar direction, modernising its works council legislation to clarify that co-determination rights also apply when key employment decisions are taken or supported by artificial intelligence(AI), 10 and strengthening the ability of works councils to rely on external technical expertise – at the employ er’s expense – whenever AI systems are introduced or used in the workplace. 11 At the opposite end of the spectrum, other countries, notably Ireland, have not recognised any significant role for workers’ representatives either in relation to data processing more generally or, needless to say, with respect to algorithmic management in the workplace, although in countries such as Poland there have been legislative discussions moving in that direction. As a result, several Member States – particularly Germany, Spain, and Italy – already provide enhanced rights enabling deeper scrutiny and shared regulation of workplace technologies, whereas others lag behind. However, even in jurisdictions with more sophisticated labour protections, the lack of concrete harmonisation continues to undermine the overall coherence of workers’ data protection and therefore their consistent enforcement. This interplay also brings Article 88 GDPR into focus. Arti cle 88(1) allows Member States to introduce“more specific” rules on data processing in the employment context, either through legislation or collective bargaining agreements. Furthermore, Article 88(2) requires that such rules include “suitable and specific measures” to safeguard workers’“human dignity, legitimate interests and fundamental rights”. Two recent judgments of the CJEU have clarified that Member States may indeed adopt more specific rules, but only provided that they contain normative content that is genuinely distinct from the general provisions of the GDPR and, as required by Article 88(2), that they include suitable and specific measures, with particular regard to, inter alia, transparency of processing and monitoring systems in the workplace. 12 This interpretation has raised particular concern in Germany, not least because both CJEU judgments concluded that existing national and collectively agreed rules did not fully meet the standards set by the CJEU. On the one hand, this ap proach of the CJEU is welcome in confirming that the GDPR follows a“minimum-harmonisation logic”, thereby validating national provisions that go beyond this minimum floor. On the other hand, the approach perpetuates the uncertainty regarding the GDPR-compatibility of domestic workplace-specific data protection provisions that may fall short of the Article 88 requirements. Some commentators have taken these decisions as confirmation that Article 88 has so far contribut ed to further fragmentation, legal uncertainty and inconsistent enforcement(Abraha 2022 and Müllensiefen 2025) – thereby reinforcing calls for workplace-specific data protection legislation(Aloisi, Joppe& Abraha 2025). The tension between the GDPR’s harmonising ambitions and the autonomy of national labour laws now risks shifting from what was initially a purely vertical EU-national relationship issue to one that is also becoming an intra-EU problem of coherence and fragmentation. The Platform Work Directive illustrates this evolution. It introduces rights inspired by the GDPR but tailored to workplace realities(Otto 2022 and Aloisi, Joppe& Abraha 2025) – notably by strengthen ing transparency obligations and involving workers’ representatives in the information process, impact assessments, and oversight mechanisms(Rainone 2025). These measures reduce informational asymmetries and actively involve representatives in the co-design of workplace data governance. Given their superior technical and operational capacity at least compared with individual workers, representatives are better positioned to deliver effective and context-specific safeguards, preventing violations of workers’ data rights. The Directive also has the potential to enhance enforcement by consolidating existing avenues, opening new ones and reinforcing interpretations, while simultaneously exposing gaps in guidance and addressing fragmentation. The main – and crucial – limitation of the Directive is that it applies exclusively to platform workers, leaving employees, and other categories of workers, in more traditional employment settings exposed to comparable algorithmic risks. This creates an unjustified regulatory disparity and sharply underscores the urgent need for a comprehensive EU-wide framework(Dubal& Filgueiras 2024; Ad ams-Prassl et al. 2025; ETUC 2025a; Aloisi, Joppe& Abraha 2025; De Micheli et al. 2025; Otto 2026). As a result, the harmonised EU framework laid down in the GDPR undoubtedly provides an important common baseline, which has had an upward-levelling effect, especially in those Member States that previously lacked any meaningful regulation of workers’ data rights – whether under data protection law or labour law. However, the EU legal landscape remains fragmented along two distinct but interrelated dimensions. Vertically, the absence of a comprehensive EU framework on workers’ data protection leaves the interaction between EU data law and national labour law 9  The reference is, for Spain, to Article 64(4)(d) of Royal Legislative Decree 2/2015, introduced by Law 12/2021 of 28 September, and, for Italy, to Article 1-bis of Legislative Decree no. 152/1997, introduced by Legislative Decree no. 04/2022. 10 § 95(2)(a) BetrVG added by the 2021 Works Councils Modernisation Act(BRMG). 11 § 80(3) BetrVG as supplemented by the BRMG. 12  CJEU Case C-34/21 Hauptpersonalrat 30 March 2023 ECLI:EU:C:2023:270 and CJEU Case C-65/23 K GmbH 19 December 2024 ECLI:EU:C:2024:1051. 10 Friedrich-Ebert-Stiftung e.V.

uneven and inconsistent across Member States. Horizontal ly, EU law itself is split between the GDPR and the AI Act as general regimes with different scopes, and the Platform Work Directive as a more protective and sector-specific instrument limited to platform workers. This combination generates asymmetries for workers exposed to similar risks. Addressing these inconsistencies is essential, as fragmentation at the substantive level inevitably produces fragmentation in enforcement. Where enforcement happens: workers´ data protection rights before DPAs and courts Assessing enforcement empirically remains challenging due to limited and inconsistent data. Nonetheless, a general pattern emerges: cases based solely on the GDPR are primarily handled by DPAs(and, subsequently, by ordinary or administrative courts when DPA decisions are appealed), whereas in labour courts GDPR provisions typically serve an ancillary role, supporting national labour rights rather than forming the main basis for litigation. Cases before the DPAs The evidence emerging from the national reports confirms that DPA enforcement in the field of workplace data processing and algorithmic management varies across Member States, but it is generally scarce – partly because most DPAs do not seem to consider the workplace a priority area for their enforcement activities(Nogarede 2021; Abraha 2023; Müllensiefen 2025). In several Member States – such as Austria, Ireland and the Netherlands – the enforcement of workers’ data protection rights before DPAs has been described as relatively restrained or weak. However, a number of Member States – notably Belgium, Germany and Spain – have displayed in creased levels of DPA activity regarding the enforcement of the GDPR in the workplace, although the overall numbers seem to remain modest. For instance, the German report indicates that, for Bavaria, in 2024, there were less than 5 complaints per 100,000 workers. Italy stands out as the only positive outlier for both the variety and the visibility of its cases, including ex officio investigations, some of which have received widespread media coverage, such as those targeting algorithmic management systems in the platform economy(Agosti et al. 2023). 13 Such proactive initiatives are rare elsewhere, though they have occurred in high-profile but rather isolated instances, such as the Amazon warehouse cases in Germany 14 and France 15 (Müllen siefen 2025). However, most DPAs adopt a reactive stance, primarily responding to individual complaints. Structural limits – in cluding resource constraints, discretion in case selection, and procedural complexity – further restrict consistent en forcement. In some jurisdictions, such as Austria and particularly Ireland, DPA operations seem to be opaque: complaint follow-up procedures are unclear and/or publicly available data on outcomes are scarce. A striking issue lies in the discrepancy between the number of complaints received and the number of formal decisions issued. This gap may suggest informal resolutions, procedural stagnation or the withdrawal of complaints, but the lack of transparency makes it impossible to know. DPAs also differ widely in their level of engagement and in the guidance they provide. In key jurisdictions hosting the headquarters of large multinational employers such as Ireland and, to some extent, Luxembourg and the Netherlands, the enforcement record seems comparatively weak – a serious concern given their pivotal role in the digital labour market. Cross-border coordination remains another critical weakness. The enforcement trajectories of Amazon’s perfor mance management systems in France and Germany illustrate this incoherence: while the French DPA imposed a €32 million fine, 16 a similar initiative by the German authority of Lower Saxony was later overturned by a court. 17 A more positive example is the Uber case, where the French and Dutch DPAs cooperated effectively, imposing fines of€10 million and€290 million to Uber in 2023 and 2024 respectively. 18 Notwithstanding the strong record of the Italian DPA and the increased activity of DPAs in for instance Belgium, Germany, and Spain, overall the evidence points to a structural underenforcement of the GDPR in the workplace. On the one hand, the existence of these isolated cases shows that DPAs are structurally well-positioned to carry out this type of enforcement: they possess specialised expertise in data protection and emerging technologies, and they hold investigative and sanctioning powers that go beyond those available to courts(Agosti et al. 2023). However, DPAs of ten operate with limited financial and human resources, as for example explicitly noted in the German report and in the Austrian one. The latter further observes that this lack of resources has led the DPA to develop various“techniques” to ensure that cases are closed as quickly as possi13 See Italian DPA 10 June 2021 no. 234[9675440] – later partially overturned in relation to the excessive nature of the sanction imposed, on which see Cass. 22 September 2023, no. 27189; Italian DPA 22 July 2021 no. 285[9685994]; Italian DPA 13 November 2024 no. 675[10074601]. 14 LfD Niedersachsen, 28/12/2020(later overturned by VG Hannover – 10 A 6199/20). 15 French DPA, Délibération de la formation restreinte n°SAN-2023-021 du 27 décembre 2023 concernant la société AMAZON FRANCE LOGISTIQUE. 16  Ibid. 17 LfD Niedersachsen, 28/12/2020(later overturned by VG Hannover – 10 A 6199/20). 18  https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to-the-us. Empirical findings 11

ble – for instance, by accelerating case closure whenever feasible, using short objection deadlines for data subjects, or discontinuing proceedings when controllers demonstrate belated compliance. The most significant weakness thus concerns the absence of a clear and harmonised procedural framework(Magierska& Hassel 2025; Dixon 2025). The EU is in the final stages of adopting a Regulation intended to improve coordination among DPAs in cross-border cases 19 , but the upcoming law has already attracted substantial criticism for creating overly complex procedures and for failing to establish a genuinely centralised coordination mechanism (noyb 2025a; Mustert 2025; EDRi 2025). Moreover, the pro posal focuses exclusively on cross-border cases. What is equally, if not more, important to highlight is that in purely national cases – which are likely to constitute the vast majority of complaints brought before DPAs in the employment context – there is no harmonisation at all, argu ably posing an even more serious challenge to the uniform enforcement of the GDPR. The national reports also point to a widespread lack of transparency regarding the number of complaints received and decided by DPAs. Here, too, differences are striking: at one end of the spectrum, the Irish DPA provides very limited information, while, at the other end, the Italian DPA at least offers some qualitative guidance and maintains a searchable database of past decisions on its website. Yet even these remain incomplete: no authority publishes detailed statistics specifically concerning workplace-related cases. Lastly, there are more substantive issues as well. Not all DPAs have developed guidance on the application of the GDPR in employment contexts – guidance that could meaningfully support employers in implementing the rules and workers in enforcing their rights. In addition, even in those Member States where such guidance exists, fragmentation persists because each authority acts independently. At the EU level, no dedicated guidance exists under the GDPR on workplace data processing as a coherent domain. Instead, references to workers’ rights appear only incidentally within guidelines on specific GDPR provisions, where concepts remain general and are not adapted to sector-specific or workplace-specific realities(Müllensiefen 2025). Therefore, the development of more coherent EU-level guidance would be beneficial for harmonisation purposes, especially if developed by the EDPB(Otto 2024). Taken to gether, the lack of harmonisation on all these procedural and even substantive aspects further exacerbates inconsistency and opacity in GDPR enforcement across Member States. Cases before courts Most reports show that tracking judicial activity remains challenging: lower-court decisions are often unpublished and higher courts rarely cite the GDPR explicitly. In the majority of countries, most litigation arises(i) before ordinary or administrative courts in the context of appeals from DPA decisions, or(ii) before labour courts where workers seek to enforce the GDPR directly in the first instance proceedings, without first going through the DPA. However, in these latter cases, the GDPR typically plays an ancillary role: it is generally invoked alongside national labour provisions rather than serving as the primary legal basis for a claim. A notable exception is the widely reported case in the Netherlands, where courts have adjudicated disputes purely grounded in the GDPR involving Uber and Ola. 20 ­ As noted in the introduction, this seems to reflect the weaker labour protections available to platform workers classified as independent contractors, for whom GDPR claims are more feasible than labour claims because preliminary disputes over employment status do not need to be resolved first, – a feature that similarly char acterises the Platform Work Directive, which applies most of its algorithmic management provisions irrespective of employment status(Countouris& De Stefano 2025). In practice, national reports seem to suggest that, before labour courts, judges and lawyers tend to rely on familiar labour law norms protecting comparable interests rather than invoking GDPR provisions directly. Nevertheless, positive normative interactions have emerged. Reports from Belgium, Germany, Italy, and Luxembourg highlight that GDPR provisions are invoked – directly or indirectly – particularly in dismissal disputes, to exclude evidence obtained in breach of data protection rules, thereby reinforcing procedural fairness and facilitating decisions declaring the unlawfulness of dismissals. Similarly, the Irish, French and German reports in particular emphasise the complementary use of the right of access under Article 15 GDPR as a de facto discovery tool, ena bling workers to obtain evidence for pending or future labour disputes, which can be useful especially in jurisdictions, such as most continental European ones, lacking formal discovery mechanisms. Germany and, to a lesser extent Luxembourg, seem to represent rather distinctive cases where GDPR provisions have not only been used to establish violations, but also to ground claims for non-material damages, signalling a more assertive and integrated approach to the enforcement of data protection rights in the workplace. 19  https://www.europarl.europa.eu/doceo/document/TA-10-2025-0238_EN.html. 20 Court of Appeal Amsterdam, 7 March 2023, ECLI:NL:GHAMS:2023:796; Court of Appeal Amsterdam, 4 April 2023, ECLI:NL:GHAMS:2023:793; Court of Appeal Amster dam, 4 April 2023, ECLI:NL:GHAMS:2023:804. 12 Friedrich-Ebert-Stiftung e.V.

Overall, a division of labour appears to have crystallised: pure GDPR cases are primarily brought before DPAs and only appealed before ordinary or administrative courts, while labour courts generally engage with data protection indirectly, as a complementary framework. This differentiation is not inherently problematic, as it reflects the respective competencies of the two fora. DPAs possess specialised expertise and investigative and sanctioning powers, while labour courts provide a contextualised understanding of working relationships. The challenge lies in ensuring coordination, consistency and mutual reinforcement between these parallel enforcement tracks. From this perspective, the Digital Omnibus Act proposed by the European Commission risks undermining one of the few successful points of interaction between the GDPR and labour law. Indeed, in amending Article 12, the proposal ap pears to restrict data subjects’ access requests, by allowing controllers to charge a fee or refuse requests because a data subject“exploits the rights conferred by the GDPR for purposes other than data protection”. This is difficult to justify, as the right of access is a self-standing right whose exercise cannot depend on the individual’s underlying purpose, 21 and such an amendment may also potentially conflict with Article 8(2) of Charter of Fundamental Rights of the EU(noyb 2025b). From our perspective, such a restric tion would also be counterproductive. Several national reports show that the right of access is one of the few GDPR rights having achieved a good level of enforcement in the workplace, and that workers have used it as an innovative de facto discovery tool. This has strengthened enforcement not only in relation to data protection violations, but also – and especially – in disputes before labour courts regarding the enforcement of pure labour rights, generating a positive dynamic in the broader protection of workers’ rights. One example is the first Italian case in which a platform worker was judicially recognised as an employee: 22 the worker had exercised the right of access to obtain information that was later used as evidence in court, an especially effective strategy in cases where there is no formal discovery mechanism and the burden of proof lies with the claimant(Gaudio 2022). A revision of Article 12 along the lines proposed in the Digital Omnibus Act would likely prejudice this type of legitimate and socially valuable use of the right of access, through which workers file access requests that may reveal other labour law violations. For instance, in a dispute over unpaid hours, an employee may request access to digital records of working time or shift allocations (noyb 2025b). It would also be difficult to justify, given that this is one of the few areas where GDPR enforcement in the workplace has proved both meaningful and effective. Workers’ representatives and collective enforcement: the untapped potential of the GDPR In principle, workers’ representatives are better positioned than individual workers to enforce data protection rights. They possess collective legitimacy, as well as better technical expertise and organisational resources(Agosti et al. 2023; Gaudio 2024). Yet in practice, national reports gener ally show that their role remains marginal and largely underutilised. Across Member States, collective enforcement of data protection rights in the workplace remains the exception rather than the rule. The main structural obstacle lies in the GDPR’s individual-rights model, which recognises only data subjects, not collective entities. While national labour laws often grant standing to representatives to defend their own rights, extending this capacity to the enforcement of workers’ data rights requires explicit legal authorisation. Article 80 GDPR may have bridged this gap, offering two mechanisms for representative litigation(Federico 2023). Under Article 80(1), a data subject may mandate a repre sentative entity to lodge a complaint on his or her behalf. Under Article 80(2), Member States may empower such en tities to lodge complaints independently, without a mandate. While the first mechanism is directly applicable, the second – far more powerful, as it is intended to enable pri vate organisations to bring complaints directly in response to GDPR infringements – requires national implementation, though this need not necessarily take the form of a specific provision where domestic law already grants legal entities direct standing in representative actions. 23 This research confirms previous findings that implementation of Article 80 is at best uneven(Pato 2019) and further highlights that it has had minimal practical impact in the employment context – an unsurprising finding for those fa miliar with the field. The first reason is that it is not entirely clear whether workers’ representatives fall within the scope of representative entities. It should be noted that this provision guarantees legal standing to any“not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects’ rights and freedoms with regard to the protection of their personal data”. The CJEU has so far interpreted this provision quite broadly 24 and, on the basis of this case law, it may be argued that Member States cannot restrict it in a way that would exclude workers’ representatives as such from qualifying as 21 CJEU Case C-579/21 Pankki 22 June 2023 ECLI:EU:C:2023:501, para 88; CJEU Case C-307/22 FT 26 October 2023 ECLI:EU:C:2023:811, paras 29-52. 22  Trib. Palermo 20 November 2020, no. 3570. 23 CJEU Case C-319/20 Meta 28 April 2022 ECLI:EU:C:2022:322; CJEU Case C-757/22 Meta Platforms Ireland 11 July 2024 ECLI:EU:C:2024:598. 24  CJEU Case C-319/20 Meta 28 April 2022 ECLI:EU:C:2022:322, paras 60-66. Empirical findings 13

representative entities under Article 80 when enforcing workers’ data rights(Gaudio 2024). In any event, further guidance may soon come from the CJEU, as a pending case directly concerns the extent to which Member States may limit the standing of representative entities under Article 80. 25 That said, at the current stage, few Member States have expressly recognised workers’ representatives as representative entities under Article 80. At one end of the spectrum, France has explicitly included them, whereas Italy has expressly excluded them. Most other Member States remain silent or provide only vague provisions, thereby creating interpretative ambiguity regarding eligibility. In others, such as Ireland and the Netherlands, workers’ representatives may act through pre-existing national representative-action mechanisms, although the interplay between these systems and Article 80 is not always clear. In any case, the de bate remains largely theoretical, as Article 80 has seen vir tually no application in employment-related disputes. An alternative strategic avenue could be to foster cooperation with NGOs active in the data protection field, for which there is no particular doubt that they are authorised to act – for instance, noyb, cited in the Austrian and Bel gian reports for its technical expertise and for its various enforcement actions across the EU. Indeed, such an approach could help overcome some of the limitations that may affect enforcement efforts by workers’ representatives, as these NGOs possess specific technical expertise on data and digital systems, as well as specialised know-how on GDPR enforcement, that trade unions and works councils do not generally have(Agosti et al. 2023; Gaudio 2024). There are already examples of such cooperation, for instance when UNI Global Union worked together with noyb to coordinate the exercise of the right of access under Article 15 GDPR by Amazon warehouse workers across several EU Member States(noyb 2022). However, while this ap proach could combine the representational role of trade unions with the technical skills in data law enforcement of such NGOs, it may nonetheless generate organisational frictions and ultimately depends on whether both actors are strategically aligned. The second reason for the general ineffectiveness of Article 80 is that very few Member States have implemented Arti cle 80(2) at all(EC 2024), despite the European Parlia ment’s explicit calls in this direction(EP 2021). France has implemented the provision expressly, while the Netherlands has done so indirectly through general regimes of representative actions. Poland has followed a similar path, although only after prolonged litigation, which ultimately led to the recognition of representatives’ role in protecting employees’ data through own-initiative complaints. The remaining Member States have not expressly implemented Article 80(2), at least with respect to workers’ data protec tion litigation. The CJEU has held that the non-implementation of Article 80(2) does not undermine a consistent level of protection across the EU, since uniform substantive rules and individual remedies under the GDPR would, in its view, suffice to avoid enforcement fragmentation. 26 In practice, however, the availability of Article 80(2) would likely make collective complaint actions in the workplace significantly less complex and burdensome. As the Belgian report shows, the DPA refused to allow a representative entity to use Article 80(1) to coordinate multiple individual complaints into a single action – effectively preventing an attempt to practi cally compensate for the absence of an Article 80(2) mech anism. Consequently, in the absence of Article 80(2)’s im plementation, the only way to achieve the functional equivalent of a collective action has been to file multiple individual complaints(Magierska& Hassel 2025). This strategy risks not only being more burdensome for the actors involved – especially workers and DPAs – but also, contrary to the CJEU’s assumption, undermining the consistency of GDPR enforcement by allowing multiple individual complaints to proceed instead of single collective complaints brought by actors who are structurally better positioned than individuals to initiate such actions. For these reasons, the role of workers’ representatives under Article 80 has been almost non-existent in practice. Na tional representative action mechanisms – many of which have been amended recently in transposing the Collective Redress Directive – could theoretically fill this gap(Feder ico 2023; Magierska& Hassel 2025). However, reports show that, even when they exist on paper, they are rarely used – either because they are legally unfeasible for workplace complaints or because workers’ representatives, at least at the current stage, perceive them as misaligned with their strategic priorities. Spain appears to be a partial exception, as a few cases have been reported where workers’ representatives have initiated proceedings in the field of data protection. The picture changes where national labour law grants representatives direct standing to enforce rights explicitly conferred on trade unions or works councils. In such systems, collective enforcement has been both possible and, when exercised, decidedly effective. In Italy, for example, the trade union CGIL, through its affiliated works councils, has brought strategic litigation against platform companies, enforcing labour law provisions – including new informa tion and access rights relating to algorithmic management 25 CJEU Request for preliminary ruling Stichting Data Bescherming Nederland Case C-523/25 17 November 2025 C/2025/5934. On this, see: https://www.mlex.com/mlex/ articles/2411747/eu-court-asked-to-clarify-if-dutch-collective-action-rules-align-with-gdpr. 26 CJEU Case C-21/23 ND 4 October 2024 ECLI:EU:C:2024:846, para 68. 14 Friedrich-Ebert-Stiftung e.V.

systems that go beyond the GDPR. 27 These cases show that workers’ representatives may possess the technical and organisational capacity to secure successful outcomes, while also increasing the union’s leverage in a sector where its presence was previously limited(Gaudio& Guidetti 2024). It is no coincidence that a similar trend can be ob served in Spain, where CGT union delegates have recently brought a successful legal action resulting in a finding of a violation of trade union freedom due to the company’s failure to inform workers’ representatives about the algorithmic systems used for workforce management, pursuant to recently enacted statutory provisions on the matter. 28 These national experiences illustrate that when labour law provides substantive rights and clear standing to workers’ representatives, enforcement becomes not only possible but structurally more effective than under the current GDPR architecture(as envisaged by Adams-Prassl et al. 2023). This is because litigation around data protection can be strategically valuable for workers’ representatives: it can be used to mobilise workers, strengthen collective bargaining and – even through the promotion of a limited number of high-impact strategic cases – can ultimately incentivise a more systemic protection of data protection rights in the workplace(Gaudio 2024). The lesson from the Italian and Spanish experiences is that such effects are more easily attainable when certain data protection rights – notably in formational and procedural rights – are granted directly to collective actors rather than to individual workers, or, at a minimum, when workers’ representatives can clearly act as representative entities for the enforcement of workers’ individual rights, which, in cases of data protection violations, typically affect a plurality of workers simultaneously. In conclusion, the comparative research has shown that enforcement initiatives promoted by workers’ representatives remain extremely limited across the EU. This constitutes a missed opportunity, as workers’ representatives, potentially also in cooperation with NGOs active in the data protection field, are structurally better positioned than individual employees to engage in this form of enforcement. The EU legislator appeared aware of this potential when introducing Article 80 GDPR, which is particularly suited to the em ployment context as it could compensate, at the enforcement level, for the absence of substantive data protection rights explicitly conferred upon workers’ representatives. However, its uneven and often incomplete national implementation has ultimately undermined its effectiveness, leaving the role of collective actors in GDPR enforcement largely residual and highly fragmented across Member States, with the most interesting examples emerging precisely in those jurisdictions where national legislation clearly grants workers’ representatives substantive rights and unequivocal standing before the courts. 27 Trib. Palermo 3 April 2023, no. 14491; Trib. Palermo 20 June 2023; Trib. Torino 5 August 2023. 28  National Court(Audiencia Nacional) 4 July 2025, no. 101/2025. Empirical findings 15

4. Policy recommendations EU legal framework on worker data rights: improvements, simplification, and better implementation The role of the GDPR in the protection and advancement of worker data rights is modest at the moment, compared to the role of existing labour law provisions in most Member States. However, it has the potential to gain significantly in importance, thereby complementing national labour law frameworks and addressing the observed lack of enforcement of workers´ data protection rights. GDPR: better implementation → Make sure that future evaluations of – and amendments to – the GDPR will be evidence-based(Dixon 2025). That requires specifying the DPAs monitoring and data gathering requirements, encouraging the publication of DPA decisions , as well as adopting EDPB guidelines to standardise annual reports . Specifically, introduce reporting and transparency obligations on decisions and possibly on complaint handling to address the“black box” between complaint submission and decision, with specific figures regarding the workplace context. → The EDPB should develop workplace-specific GDPR guidance , including for instance when companies can rely on“legitimate interest”, by updating guidance that precedes the applicability of the GDPR. This would reduce legal uncertainty for both workers and employers. → The EDPB and DPAs should complement workplace-specific guidance by facilitating and encouraging certification schemes and codes of conduct that specifically focus on workplace data processing(Nogarede, Silberman& Bronowicka 2024). This will reduce the en forcement burden on DPAs and foster compliance. Changes to the GDPR Under the banner of simplification, the Digital Omnibus Act proposes several changes to the GDPR. However, these proposed changes leave potential areas for harmonisation unaddressed, whereas they suggest to weaken provisions that are crucial for workplace data protection. → To address the divergent implementation of representative actions for workers under Article 80 GDPR and har monise the legal framework, the EU should: • Explicitly recognise workers’ representatives as representative entities under Article 80 GDPR, depend ing on national labour law. • Make Article 80(2) mandatory for Member States. Not only will this simplify the legal environment, but it will also make it easier for workers´ representatives to act in the interest of workers, thereby helping the DPAs in ensuring observance of the law. → Harmonise procedural rules across Member States, ensuring clearer, simpler, and more transparent DPA procedures, simplifying those now in the process of being adopted by the EU in relation to cross-border cases. 29 → Preserve the strength of Articles 12 and 15 GDPR by rejecting the proposed amendments in the Digital Omnibus Act that would allow controllers to charge a fee or refuse access requests where a data subject is perceived to“exploit” the rights conferred by the GDPR for purposes other than data protection . Weakening the right to access would undermine transparency and workers’ ability to gather evidence to support labour and data protection claims. Given its proven effectiveness, limiting access rights would significantly hamper workplace GDPR enforcement. Beyond the GDPR: ensuring a dedicated EU legal framework for data protection in the workplace In the future, the EU should establish a general EU-level data protection framework specifically tailored to the employment context . This would provide a higher and more context-sensitive level of protection than the GDPR, with the algorithmic management safeguards currently envisaged for platform workers under the Platform Work Directive serving as a reference model for all workers. Such a law should recognise at EU level the collective dimension of data protection in the workplace , by granting explicit and enforceable rights to workers’ representatives. 29  https://www.europarl.europa.eu/doceo/document/TA-10-2025-0238_EN.html. 16 Friedrich-Ebert-Stiftung e.V.

Bibliography Abraha, Halefom(2022): A pragmatic compromise? The role of Article 88 GDPR in upholding privacy in the workplace, in: International Data Privacy Law 12(4), pp. 276–296. doi: https://doi.org/10.1093/idpl/ipac015. Abraha, Halefom(2023): Regulating algorithmic employment decisions through data protection law, in: European Labour Law Journal 14(2), pp. 172–191. doi: https://doi. org/10.1177/20319525231167317. Adams-Prassl et al.(2025): Open Letter: Algorithmic Management and the Future of Work in Europe, Social Europe, https://www.socialeurope.eu/open-letter-algorithmicmanagement-and-the-future-of-work-in-europe. Adams-Prassl, Jeremias; Abraha, Halefom; Kelly-Lyth, Aislinn; Silberman, Michael “Six”; Rakshita, Sangh(2023): Regulating algorithmic management: A blueprint, in: European Labour Law Journal 14(2), pp. 124–151. doi: https://doi.org/10.1177/­ 20319525231167299. Adams, Zoe; Wenckebach, Johanna(2023): Collective regulation of algorithmic ­management, in: European Labour Law Journal 14(2), pp. 211–229. doi: https://doi. org/10.1177/20319525231167477. Agosti, Claudio; Bronowicka, Joanna; Polidoro, Alessandro; Priori, Gaetano(2023): Exercising workers’ rights in algorithmic management systems: Lessons learned from the Glovo-Foodinho digital labour platform case, European Trade Union Institute, https://www.etui.org/sites/default/files/2023-10/Exercising%20workers%20rights%20 in%20algorithmic%20management%20systems_Lessons%20learned%20from%20 the%20Glovo-Foodinho%20digital%20labour%20platform%20case_2023.pdf . Aloisi, Antonio; Joppe, Anne; Abraha, Halefom(2025): From“general” to“context-­ specific” data protection for workers: Insights from the EU rules on platforms, algorithmic management and AI systems, in: European Labour Law Journal 16(4), pp. 538–564. doi: https://doi.org/10.1177/20319525251375031. Article 29 Working Party(2001): Opinion 8/2001 on the processing of personal data in the employment context, https://ec.europa.eu/justice/article-29/documentation/ opinion-recommendation/files/2001/wp48_en.pdf. Article 29 Working Party(2017): Opinion 2/2017 on data processing at work, https:// ec.europa.eu/newsroom/article29/items/610169/en. Autoriteit Consument& Markt(ACM)(2024): ACM Jaarverslag 2024 – Maart 2025, https://www.acm.nl/system/files/documents/jaarverslag-2024.pdf. Autoriteit Persoonsgegevens(2024): Dutch DPA imposes a fine of 290 million euro on Uber because of transfers of drivers’ data to the US, https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to-the-us. Baiocco, Sara; Fernandez-Macías, Enrique; Rani, Uma; Pesole, Annarosa(2022): ­ The algorithmic management of work and its implications in different contexts, https://www.ilo.org/sites/default/files/wcmsp5/groups/public/%40ed_emp/docu ments/publication/wcms_849220.pdf. Barslund, Mikkel; De Micheli, Barbara; Dente, Giancarlo; Faioli, Michele; Smilari, Alessandro; Patras, Sophie; Ravaglia, Martina; Vancauwenbergh, Sophie; Tobback, Ilse; Omersa, Ela(2025): Digitalisation, artificial intelligence and algorithmic management in the workplace: Shaping the future of work , European Parliamentary Research Service, https://www.europarl.europa.eu/RegData/etudes/STUD/2025/ 774670/EPRS_STU(2025)774670_EN.pdf. BEUC(2020): The long and winding road. Two years of the GDPR: A cross-border data protection enforcement case from a consumer perspective, https://www.beuc.eu/sites/ default/files/publications/beuc-x-2020-074_two_years_of_the_gdpr_a_cross-border_ data_protection_enforcement_case_from_a_consumer_perspective.pdf. Christl, Wolfie(Cracked Labs)(2021): Digital überwachung und kontrolle am arbeitsplatz: von der ausweitung betrieblicher datenerfassung zum algorithmischen management? https://crackedlabs.org/dl/CrackedLabs_Christl_UeberwachungKontrolleArbeitsplatz.pdf. Christl, Wolfie(Cracked Labs)(2023): Monitoring work and automating task allocation in retail and hospitality: A case study on software for worker monitoring and performance control in retail stores, restaurants and hotels , https://crackedlabs.org/en/ data-work/publications/retail-hospitality. Christl, Wolfie(Cracked Labs)(2023): Monitoring, streamlining and reorganizing work with digital technology: A case study on software for process mining, https://crackedlabs.org/en/data-work/publications/processmining-algomanage. Christl, Wolfie(Cracked Labs)(2024): Employees as risks: A case study on intrusive surveillance and behavioral profiling for cybersecurity, insider risk detection and“compliance” , https://crackedlabs.org/en/data-work/publications/securityriskprofiling. Christl, Wolfie(Cracked Labs)(2024): Managing and monitoring mobile service workers via smartphone app: A case study on worker monitoring, algorithmic management and software for“field service management” , https://crackedlabs.org/en/data-work/ publications/mobilework. De Hert, Paul; Lammerant, Hans(2013): Protection of personal data in work-related relations, https://www.europarl.europa.eu/RegData/etudes/etudes/join/2013/ 474440/IPOL-LIBE_ET(2013)474440_EN.pdf. De Stefano, Valerio(2019): Negotiating the algorithm: Automation, artificial intel­ ligence, and labor protection, in: Comparative Labor Law& Policy Journal 41(1), pp. 15–46. doi: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3178233. De Stefano, Valerio; Taes, Simon(2022): Algorithmic management and collective bargaining, in: Transfer: European Review of Labour and Research 29(1), pp. 21–36. doi: https://doi.org/10.1177/102425892211410. De Stefano, Valerio; Wouters, Mathia(2022): AI and digital tools in workplace management and evaluation: An assessment of the EU’s legal framework , Panel for the Future of Science and Technology – European Parliamentary Research Service, https://www.europarl.europa.eu/thinktank/en/document/EPRS_STU(2022)729516. Dixon, Helen(2025): GDPR is not loved, but does it work?, in: International Data Privacy Law 15(2), pp. 101–107. doi: https://doi.org/10.1093/idpl/ipaf019. Dubal, Veena; Filgueiras, Vitor(2024): Digital Labor Platforms as Machines of Pro duction, in: Yale Journal of Law& Technology 26(3), pp. 560–594. doi: https://yjolt. org/digital-labor-platforms-machines-production. EDRi(2025): A missed opportunity for enforcement: What the final GDPR Procedural Regulation could cost us, https://edri.org/our-work/a-missed-opportunity-forenforcement-what-the-final-gdpr-procedural-regulation-could-cost-us/. ETUC(2025a): The EU needs a dedicated directive on algorithmic management and AI at work, https://www.etuc.org/en/circular/eu-needs-dedicated-directive-algorithmic-management-and-ai-work. ETUC(2025b): Negotiating the algorithm: Trade union manual, https://www.etuc.org/ sites/default/files/publication/file/2025-09/Negotiating%20the%20Algorithm%20 -%20Trade%20Union%20Manual_ETUC%20%28updated%29.pdf. Eurofound(2024): European working conditions survey 2024: First findings, https:// www.eurofound.europa.eu/en/publications/all/european-working-conditions-survey-­ 2024-first-findings. European Commission(2002): Action plan on“Simplifying and improving the regulatory environment” , Brussels, COM(2002)278 final, https://www.europarl.europa.eu/ meetdocs/committees/juri/20040218/020278EN.pdf. European Commission(2015): Communication on“Better regulation for better results – An EU agenda”, Strasbourg, COM(2015)215 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52015DC0215. European Commission(2020): Communication on“Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition – two years of application of the General Data Protection Regulation” , Brussels, COM(2020)264 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020DC0264. European Commission(DG EMPL)(2023): Study exploring the context, challenges, opportunities, and trends in algorithmic management in the workplace, https://op.­ europa.eu/en/publication-detail/-/publication/5afb4511-0ddf-11f0-b1a3-01aa75ed71a1/language-en. European Commission(2024): Communication on“Second Report on the application of the General Data Protection Regulation”, Brussels, COM(2024)357 final, https:// eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52024DC0357. Bibliography 17

European Commission(2025): Communication on“Quality Jobs Roadmap”, Brussels, COM(2025)944 final, https://employment-social-affairs.ec.europa.eu/document/ download/82975aa7-bdd6-4a64-b3e3-82433901f8f7_en?filename=Quali ty-Jobs-Roadmap_Communication_2025.pdf. European Data Protection Board(EDPB)(2020a): Guidelines 3/2019 on processing of personal data through video devices: Version 2.0, https://www.edpb.europa.eu/sites/ default/files/files/file1/edpb_guidelines_201903_video_devices_en_0.pdf. European Data Protection Board(EDPB)(2020b): Guidelines 05/2020 on consent under Regulation 2016/679: Version 1.1 , https://www.edpb.europa.eu/sites/default/ files/files/file1/edpb_guidelines_202005_consent_en.pdf. European Data Protection Board(EDPB)(2023): Guidelines 01/2022 on data subject rights – Right of access: Version 2.1, https://www.edpb.europa.eu/system/ files/2023-04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf. European Data Protection Board(EDPB)(2025): Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR: Version 1.0(for public consultation), https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2024/ guidelines-12024-processing-personal-data-based_en. European Data Protection Board(EDPB): Register of certification mechanisms, privacy seals and marks , https://www.edpb.europa.eu/our-work-tools/accountability-tools/ certification-mechanisms-seals-and-marks_en(accessed: 4 December 2025). European Parliament(2021): European Parliament Resolution of 25 March 2021 on the Commission evaluation report on the implementation of the General Data Protection Regulation two years after its application(2020/2717(RSP), Official Journal of the European Union, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=oj:JOC_2021_494_R_0012. European Parliament(2025): Report with recommendations to the Commission on digitalisation, artificial intelligence and algorithmic management in the workplace – shaping the future of work , https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/2080(INL). Federico, Marina(2023): European Collective Redress and Data Protection Challenges and Opportunities, in: MediaLaws, pp. 86–103. doi: https://www.medialaws.eu/ wp-content/uploads/2023/06/1-23-RDM.pdf. Foundation for European Progressive Studies(FEPS)(2024): Computer in command: Consequences of algorithmic management for workers, https://feps-europe.eu/publication/computer-in-command/. Gaudio, Giovanni(2022): Algorithmic bosses can’t lie! How to foster transparency and limit abuses of the new algorithmic managers, in: Comparative Labor Law and Policy Journal 42(3), pp. 707–741. doi: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3927954. Gaudio, Giovanni(2024): Litigating the Algorithmic Boss in the EU: A(Legally) Feasible and(Strategically) Attractive Option for Trade Unions?, in: International Journal of Comparative Labour Law and Industrial Relations 40(1), pp. 91–130. doi: https:// doi.org/10.54648/ijcl2024002. Gaudio, Giovanni; Guidetti, Caterina(2024): Trade unions, strategic litigation and digital labour platforms: A case study of the CGIL, in: Revista Giuridica AmbienteDiritto.it 2, pp. 1–23. doi: https://www.ambientediritto.it/wp-content/uploads/2024/06/ TRADE-UNIONS-STRATEGIC-LITIGATION-AND-DIGITAL-LABOUR-PLATFORMS-ACASE-STUDY-OF-THE-CGIL._-Gaudio_Guidetti.pdf. German Federal Statistics Office(Statistisches Bundesamt)(2024): Qualität der arbeit: Arbeitnehmervertretungen , https://www.destatis.de/DE/Themen/Arbeit/Arbeitsmarkt/Qualitaet-Arbeit/Dimension-5/arbeitnehmervertretungen.html(accessed: 4 December 2025). Hendrickx, Frank(2002): Protection of workers’ personal data in the European Union: Two studies. https://books.google.it/books/about/Protection_of_Workers_Personal_ Data_in_t.html?id=YDQYoAEACAAJ&redir_esc=y. Hendrickx, Frank(2019): Privacy 4.0 at work: Regulating employment, technology and automation, in: Comparative Labor Law& Policy Journal, 41(1), pp. 147–172. doi: https://cllpj.law.illinois.edu/archive/vol_41/. Hendrickx, Frank(2022): Protection of workers’ personal data: General principles, ILO Working Paper 62, https://www.ilo.org/sites/default/files/wcmsp5/groups/public/%40ed_protect/%40protrav/%40travail/documents/publication/wcms_844343. pdf. Hendrickx, Frank; Mangan, David; Gramano, Elena(2023): Privacy@work: A European and comparative perspective, Bulletin of Comparative Labour Relations , https:// law-store.wolterskluwer.com/s/product/privacy-at-work/01t4R00000P470XQA R?srsltid=AfmBOoqhyYhrI2FbVN2lTsUXO3VGItzy8MnTNFEZJ7SsO1z51MRSkqO4. Hießl, Christina(2021): Case law on algorithmic management at the workplace: Cross-European comparative analysis and tentative conclusions(updated April 2025), http://dx.doi.org/10.2139/ssrn.3982735. Irish Council for Civil Liberties(ICCL)(2023): 5 years: GDPR’s crisis point, https://www.iccl.ie/wp-content/uploads/2023/05/5-years-GDPR-crisis.pdf. Magierska, Maria; Hassel, Sophia(2025): 7 Years of Enforcing the GDPR: 7 Lessons for the AI-driven Europe, in: EU Law Live Weekend edition(forthcoming). doi: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5331496. Mateescu, Alexandra(2023): Explainer: Challenging worker datafication, Data& Society, https://datasociety.net/wp-content/uploads/2023/11/DS_Explainer-Challenging-Worker-Datafication.pdf. McDonald, Sean Martin(2020): A Novel, European Act of Data Governance, https://www.cigionline.org/articles/novel-european-act-data-governance/. Müllensiefen, Tobias(2025): Algorithmic management in the workplace: Existing regulations and their limitations, Centre for a Digital Society , https://digitalsociety.eui.eu/ publication/algorithmic-management-in-the-workplace-existing-regulations-and-their­limitations/. Mustert, Lisette(2025): From cooperation to confusion: The state of cross-border GDPR enforcement, Review of European Administrative Law, https://realaw. blog/2025/06/27/from-cooperation-to-confusion-the-state-of-cross-border-gdpr-enforcement-by-lisette-mustert/. Nogarede, Justin(2021): No digitalisation without representation: An analysis of policies to empower labour in the digital workplace , https://feps-europe.eu/publication/826-no-digitalisation-without-representation/. Noyb(2022): Amazon workers demand data-transparency, https://noyb.eu/en/amazon-workers-demand-data-transparency. Noyb(2025a): EU pledged to improve GDPR cooperation – and made it worse, https://noyb.eu/en/eu-pledged-improve-gdpr-cooperation-and-made-it-worse. Noyb(2025b): Digital Omnibus: First Analysis of Select GDPR and ePrivacy Proposals by the Commission(Version 1.0), https://noyb.eu/sites/default/files/2025-12/ noyb%20Digital%20Omnibus%20Report%20V1.pdf. Organisation for Economic Co-operation and Development(OECD)(2025): Algorithmic management in the workplace: New evidence from an OECD employer survey , https://www.oecd.org/en/publications/algorithmic-management-in-the-workplace_287c13c4-en.html. Otto, Marta(2022): A step towards digital self-& co-determination in the context of algorithmic management systems, in: Italian Labour Law E-Journal 15(1), pp. 51–61. doi: https://doi.org/10.6092/issn.1561-8048/15220. Otto, Marta(2024): Privacy at work and the right to private life outside work, in: Davidov, Guy; Langille, Brian; Lester, Gillian(eds): The Oxford Handbook of the Law of Work, pp. 633–644. doi: https://doi.org/10.1093/oxfordhb/9780192870360.013.48. Otto, Marta(2026)(forthcoming): The rise of algorithmic surveillance: Legal and ethical implications for the future of work, in: Biasi, Marco(ed): Artificial Intelligence& Labour Law: A Global Overview. Pato, Alexia(2019): The collective private enforcement of data protection rights in the EU. doi: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3303228. Rainone, Silvia(2025): The collective rights dimension of the Platform Work Directive: Assessing regulatory effectiveness in the digital labour context, in: European Labour Law Journal 16(4), pp. 494–515. Rani, Uma; Pesole, Annarosa; Gonzalez Vazquez, Ignacio(2024): Algorithmic management practices in regular workplaces: Case studies in logistics and healthcare , ­European Commission – Joint Research Centre, https://publications.jrc.ec.europa.eu/ repository/handle/JRC136063. Staab, Philipp; Geschke, Sascha-Christopher(2020): Ratings als arbeitspolitisches konfliktfeld: Das beispiel Zalando, Hans-Böckler-Stiftung, https://www.boeckler.de/ fpdf/HBS-007864/p_study_hbs_429_2.pdf. Todolí-Signes, Adrián(2019): Algorithms, artificial intelligence and automated decisions concerning workers and the risks of discrimination: The necessary collective governance of data protection, in: Transfer: European Review of Labour and Research 25 (4), pp. 465–481. doi: https://doi.org/10.1177/1024258919876416. Warter, Johannes(2025): The legitimacy of modern data processing in the workplace, in: European Labour Law Journal 16(2), pp. 179–194. doi: https://doi. org/10.1177/20319525251332923. Wood, Alex(2021): Algorithmic management: Consequences for work organisation and working conditions, European Commission – Joint Research Centre, https://publications.jrc.ec.europa.eu/repository/handle/JRC124874. 18 Friedrich-Ebert-Stiftung e.V.

About the authors Giovanni Gaudio is Assistant Professor(RTT) at the University of Turin. Justin Nogarede is Senior Policy Officer at the FriedrichEbert-Stiftung’s Competence Centre on the Future of Work. Acknowledgement This report has been based on questionnaires answered by the experts listed below. The authors and foundations involved in this project would like to thank them for their constructive input and efforts, without which this report would not have been realised. However, the responsibility for the content of this report lies solely with the authors of the study. → Alba Navalón-Arnal , PhD Candidate, University of Valencia(for Spain) → Anton Ekker , Lawyer(for The Netherlands) → Christina Hießl , Professor of labour law, KU Leuven(for Germany) → Frank Hendrickx , Professor of labour law, KU Leuven, in cooperation with Emma Beirinckx, Research Master Student – KU Leuven(for Belgium) → Giovanni Gaudio , Assistant Professor(RTT), University of Turin(for Italy) → Johannes Warter , Post-Doc, University of Salzburg(for Austria) → Johnny Ryan , Director, Enforce(Irish Council for Civil Liberties)(for Ireland) → Marta Otto , Assistant Professor, University of Warsaw (for Poland) → Nastazja Potocka-Sionek , post-doctoral researcher, Faculty of Law, Economics and Finance(FDEF), University of Luxembourg(for Luxembourg) → Thomas Le Bonniec , Sociology PhD candidate, DiPlab research group, Numérique, Organisation et Société, Institut Interdisciplinaire de l’Innovation, Sciences Economiques et Sociales; Institute Polytechnique de Paris(for France)

Worker Data Rights under the GDPR and Beyond The report finds widespread underenforcement of workplace data rights and major differences in how EU countries apply the GDPR alongside national labour laws. It recommends enabling collective enforcement under the GDPR, streamlining DPA activities and guidance, and ultimately creating an EU-wide data protection framework for the workplace. Further information on the topic can be found here: ↗ fes.de