Introduction
With its decision of 9 November 2020 (72/2020), the Litigation Chamber of the Data Protection Authority (DPA) provided welcome clarifications concerning the validity of employee consent (Article 4.11 and Recital 43 of the EU General Data Protection Regulation (GDPR)). The Litigation Chamber also gave practical guidelines concerning the purpose limitation principle (Article 5(1)(b) of the GDPR).
In the case at hand, the DPA decided that:
the free consent of employees was possible and could be valid if all other conditions of Article 4.11 of the GDPR were fulfilled; and
the data was collected for a specified and legitimate purpose but the purpose of the processing was not explicit.