EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
4.3 Employment Privacy Law In the employment context, the GDPR applies as a baseline, but Article 88 permits member states to adopt more specific workplace rules. As a result, data protection obligations are often complemented by national labour laws, works council rights or col - lective agreements. Employee monitoring, whether through time-recording systems, IT usage controls or CCTV, must be justified, proportionate and transparent. Employers commonly rely on legitimate interests, but this requires a careful balancing exercise given the imbalance of power in employment relationships. Consent is generally not considered freely given in this setting. Remote work and bring-your-own-device (BYOD) arrangements require appropriate technical and organisational measures, particularly to ensure data security and a clear separation between professional and private information. In recruitment, processing must be limited to what is necessary for the role. Special categories of data require a specific legal basis, and information relat - ing to unsuccessful applicants should not be retained longer than necessary. In many member states, national labour law imposes additional safeguards, especially regarding workplace surveillance. 4.4 Data Protection in M&A During due diligence throughout an M&A transaction, any personal data disclosed to potential buyers must be limited to what is necessary and proportionate. In practice, secure and access-restricted virtual data rooms (VDRs) are used, with encryption, logging and tiered access controls. Sensitive information should be anonymised or redacted where feasible. Disclosure must rely on a lawful basis, typically legitimate inter - ests, and be supported by appropriate confidential - ity arrangements, including NDAs and documented access restrictions. In asset deals, the transfer of personal data to the purchaser requires a lawful basis and must remain compatible with the original purposes of processing.
granular, prior consent for analytics and advertising cookies, typically via consent management platforms. Legitimate interests cannot substitute for consent at the device-access stage under Article 5 (3), even if they may be relied upon for subsequent processing under the GDPR in limited contexts. 4.2 Personalised Advertising and Other Online Marketing Practices Personalised and targeted advertising in the EU is regulated primarily under the GDPR and the ePrivacy Directive, supplemented, in the case of large online platforms, by the Digital Services Act (DSA). Under the GDPR, personalised advertising must rely on a valid lawful basis under Article 6 and comply with transparency, purpose limitation and data minimisa - tion principles. In practice, consent is frequently relied upon in online advertising environments, particularly where advertising is based on user-level data. The use of special categories of data for marketing pur - poses is generally prohibited unless explicit consent is obtained. The DSA introduces additional constraints for online platforms, notably prohibiting targeted advertising based on profiling using sensitive data and restrict - ing targeted advertising directed at minors based on profiling. Rules governing unsolicited electronic marketing (such as email or SMS campaigns) derive from the ePrivacy Directive as implemented in national law. While most member states apply an opt-in model for business- to-consumer (B2C) communications, the treatment of business-to-business (B2B) marketing varies. Some jurisdictions extend consent requirements to commu - nications addressed to corporate contacts, whereas others allow opt-out systems for professional com - munications, subject to national conditions. Accordingly, although the core data protection stand - ards applicable to personalised advertising are har - monised, practical compliance in online marketing remains partly dependent on national implementation choices.
100 CHAMBERS.COM
Powered by FlippingBook