Between The Lines Of Consent: A Cross-Jurisdictional Analysis Of Exceptions To Exemptions Related To Employee Data Under Digital Personal Data Protection Act, 2023

INTRODUCTION

The amplification of biometrics and algorithmic monitoring in the workplace has escalated the Workplace Data Rights Conflicts, thereby increasing the tension between employers and employees in accordance with the compliance and consent management and employee rights over the use of their personal information with consent. This is because employers hold all the power and leave employees with no choice. Employees fear that saying no would lead to termination of their job, which places them in a take- it or leave- it situation. Therefore, where there is no bargaining , there exists no real consent.

As a result, regulatory systems across global jurisdictions have fragmented. Both EU and UK GDPR restrict the use of consent in the workplace due to the lack of power balance between the employee and employer because consent is rarely considered as the freely given consent. Therefore, employers must rely on other lawful bases such as the necessity of contractual performance or legitimate interest. Asian regions promote pragmatic, business-oriented approach, where Indian DPDPA Section 7(i) and Chinese PIPL Article 13 expressly allow non-consensual processing for human resource management and protection of assets. Japan's APPI uses structured joint-use schemes, while the US continues with its fragmented, patchwork regime founded on the concept of at-will employment, whereas California Privacy Rights Act (CPRA) grants employees strict rights over their workplace data.

This article addresses such compliance dilemmas. It argues that to solve the problem, we must abandon the myth of free consent since employees can rarely provide a free consent. Therefore, law should provide clear rules for handling the standard business tasks while strictly mandating them to delete the data as soon as data is not required.

THE ANATOMY OF SECTION 7 OF THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023

It describes why they do not meet the criteria of a regular workplace activity and explains the precise legal obligations of employers, as provided by Indian legislation:

Section 7 of the DPDP Act, 2023, addresses the processing of personal information without explicit consent for the purpose of employment under the legal provision of "Legitimate Use." Two clauses, in particular, affect business and employment.

Section 7 of the DPDP Act, 2023, elaborates on the legal justification for the processing of personal data without explicit consent under the idea of "Legitimate Use." Within this section, Section 7(a) describes situations in which a person voluntarily provides their data for a specific and concrete purpose. The provision, in this case, is based on a strict threefold test: the sharing of data must be completely voluntary, the data must be shared as narrowly as possible for the purpose for which it was shared, and the individual must retain a clear right to withdraw.

On the other hand, Section 7(i) disregards the requirement of consent altogether and operates as a safe harbour for employment, thereby allowing the uninterrupted execution of routine workplace activities. In this case, the provision authorizes employers to process employee data in the domains of financial infrastructure (payroll and statutory compliance of PF, ESI, and income tax), management of human resources (onboarding, background checks, and performance evaluations), and corporate safety/security (protection of corporate assets and anti-corporate espionage measures).

DATA LIFECYCLE IN EMPLOYMENT

When handling the data specifically for the purpose of employment, employee data is processed at each and every stage of the employment. Therefore, it is necessarily for the employer to take the consent from the employee for the processing of data during the whole cycle of employment:- Pre- Employment During Employment Post- Employment

PRE- EMPLOYMENT	DURING EMPLOYMENT	POST- EMPLOYMENT
Data gathered from applicants who are ultimately rejected, their data cannot be permanently retained under the legitimate use of employment operations.	When data is transferred for internal operations or third-party service providers, the primary employer remains directly accountable.	When an employee is terminated or resigns, the active employment comes to an end. Therefore, maintaining the employee profiles is not justifiable under Section 7 (i) of DPDP Act, 2023. The data must be maintained to the extent that is required for tax purposes or labour laws and any other legal requirements.
The following legal rulings illustrate the instances where employers violated data protocols, directly interacting with data laws and attracting regulatory fines.
*Re Kingsforce Management Services Pte Ltd¹* The Personal Data Protection Commission (PDPC) penalized an employment agency as they maintained inactive resume pool, which got leaked. The court ruled that data fiduciaries either delete the inactive applicant data or maintain the robust oversight.	*Re People Central Pte Ltd²* This ruling penalized a cloud- based HR SaaS as it was negligent in maintaining security oversight, like having multi- factor authentication or firewalls; therefore, they will be liable to direct liability where the employee payroll & personal data got leaked.	*Neuruppin Labor Court, Germany³* The German labour court ruled that a company needs to maintain an offboarding checklist as employee identity data have personal rights upon it, and ordered financial compensation for keeping the photograph and professional biography of a former employee on its marketing website.

EXCEPTIONS TO EXEMPTIONS

These are circumstances that are exceptions to the rule. In these cases, employers cannot refer to the general “employment exemption” under Section 7(i) of the DPDP Act, 2023, to process data without consent. In these instances, as these high-risk activities subvert standard employment practices, they either call for a completely voluntary, stand-alone consent of the concerned employee or severe compliance with very strict security regimes.

This framework is created by considering how advanced data privacy legislations and judicial systems in the world, particularly in Europe, China, Japan, and Germany, implement regulations where employers go beyond standard administrative procedures.

The comparative analysis that follows identifies these high-risk actions, as well as the reasons that justify them as employment-related actions and the standards of regulatory compliance in Indian laws these actions are subjected to:

PROCESSING ACTIVITY	REASON FOR NON-COVERAGE	COMPLIANCE REQUIREMENT
Pre- Employment Screening (Resume Sharing, submitting email ID, onboarding transactions, )	Retaining the data of candidates who never enter into an employment relationship for future openings will not fall under the active employment purpose.	The employer should either take the explicit consent under DPDPA Section -6 by providing a Section 5 Notice to the candidates or delete the data upon non-selection.
Surveillance in the workplace (hidden keyloggers, automated desktop screenshots, continuous webcam monitoring on laptops, GPS tracking, monitoring web browsing history)	The tracking of employees round the clock, their logging activity, and their private communications are beyond the standard employment purposes and fall outside the principle of proportionality.	For any digital tracking of the employees an explicit consent of the employee should be taken and data protection impact assessment should be
Employee Data for Non – Statutory Perks (gym memberships, hotel discounts, private health apps, weekend shuttle service, premium credit cards)	The processing of data for club memberships, hotel bookings, etc. are not the activities that fall under the employment requirement.	The employees should take separate consent other than the employment contract for the processing of such information, and if an employee denies such consent, they should not be liable to any penalty.
Third – Party Commercialization (Selling or sharing the internal data of the employee with loan providers or credit card providers.)	Disclosing the information of the employees to marketing firms, corporate lenders have no nexus with the activities involved in the employment.	The employer must obtain an explicit, clear and unambiguous consent by providing the clear details about the receiver of and the purpose of processing.
Biometric Data (scanning fingerprints, facial recognition or retina scans for attendance, digital signature stroke paths or capturing voiceprint frequencies)	Biometric data is immutable. So, making its collection mandatory for daily operations will fall outside the scope of business operations.	Separate explicit consent should be taken, and to bypass the strict collection, passwords or non-biometric ID cards should be provided as an alternative to biometric collection
Cross – Border Data Transfer (Uploading or sharing the data for payroll, family insurance, into the global server or transmitting performance evaluation for promotions.)	Sharing the data on the global cloud server or with parent companies situated outside the country, this activity will be beyond the local employment.	Employers should provide a notice to the employee stating which foreign jurisdiction is involved and must comply with section 16 of the DPDP Act, 2023, which provides for the processing of personal data outside India.
Post- Employment (utilizing the former employee photograph or biographic data for websites or using the name in their brochure)	When the active employment status of an employee comes to an end, then also processing their data will not be justified under the employment purpose.	Employers should erase the data of the employee upon the exit of the active employment status and only that data that is required by the labour or tax laws, which should be stored separately.

GLOBAL JURISPRUDENCE ON WORKPLACE PRACTICES

However, integrating global jurisprudence is essential because India's DPDP Act, 2023, borrows structurally from international frameworks, especially the European Union's General Data Protection Regulation (GDPR).

To process the employee data without consent under the GDPR, the employers rely upon Article 6(1)(b) performance of contract and Article 6(1)(f) legitimate interests. Under the GDPR, employers rely on Article 6(1)(f) "Legitimate Interests" or Article 6(1)(b) "Performance of a Contract" to process employee data without explicit consent. It is similar to India's Section 7(i) "Legitimate Use" exemption. The courts in the UK and Europe have heavily restricted these provisions to protect employees from unlawful surveillance in the workplace.

Surveillance and Intrusive Tracking

Bărbulescu v. Romania⁴

In this case, European Court of Human Rights ruled that there the employer should handover an explicit Notice having a legitimate purpose by using the least intrusive means conduct the corporate surveillance because an employer evaluated employee his email and personal communication subsequently terminated him for private messages. Therefore, the court held that the employee’s privacy at the workplace cannot be reduced down to absolute zero. This rational was subsequently reinforced in Antović and Mirković v Montenegro⁵

The Key-Logging & Secret Surveillance Case⁶

Deployment of a keylogger, which tracks each and every single keystroke typed on the device of the employee, is against the fundamental right to privacy. If this surveillance is continuous and not notified by the employer, it will be fundamentally unlawful. The German Federal Court ruled that the keylogger software can only be used in case of serious criminal misappropriation; otherwise, it is completely forbidden and falls outside the workplace exemptions.

Biometric Enforcement Limits

The Enschede Biometric Fingerprint Case⁷

The Dutch DPA heavily fined a Dutch retailer for requiring employees to provide fingerprints to record attendance, operate the cash register, and prevent fraud, stating this fell under legitimate business operations. It said that the biometric tracking fails the test of proportionality and the retailer did not have the right to require biometrics because a less invasive option exists, such as an employee access badge, which could provide almost the same business outcome.

The PwC Biometric Attendance Case⁸

PwC was fined for using a biometrics system to monitor employee time. The Greek DPA found that the employer's use of "consent" as a legal basis was improper and that in an employment context, due to power imbalances, it's impossible for truly freely given consent to exist.

Data Over-Retention and Scope Boundaries

The Hotel Booking & Global Processing Case⁹

The Supreme People's Court of China strictly applied the PIPL provisions where a company transferred the data of the employees regarding their lifestyle and hotel booking and leisure travel details to its global parent company, ruling that transferring the personal details of the employee into the central databases of the parent company would not be covered by the matter of HR operations or management practices and would be immediately deleted or erased from the central database.

The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) v. H&M Hennes & Mauritz Online Shop A.B. & Co. KG¹⁰

The fine was imposed as the H&M service center was involved in the continuous surveillance of its employees. They require the welcome back talks after the employees return to the company from leave and record their personal details. Which was stored on the central drive, which was accessible to a large number of managers in the company. Here it was established that an employee's highly personal data cannot be collected and used for performance appraisals and the company needs to comply with purpose limitation & data minimization.

The Supreme Supremacy of Data Regimes

RL v Landeshauptstadt Wiesbaden¹¹

The Court of Justice of the European Union ruled that internal rules (collective agreements and Works Council Agreements) and regulation must be in accordance with or pass the strict proportionality test and necessity requirements; even national law cannot lower the existing data protection requirements.

BEST PRACTICES FOR CORPORATE COMPLIANCE

For an organization to be under the compliant territory and navigate the employment exemption exceptions to the DPDP Act with an actionable, structured deployment. Since the sequence of action matters, you can’t formulate a notice if you don’t know what data you really have therefore, you should employ the following workflow.

Data Discovery & Purpose Mapping

Each and every point should be recognized where the data is being processed and the data should be divided into certain categories such as:-

Core Employment (Exempt): Payroll, tax filings, fundamental ID proofs etc.
Non-Employment (Non-Exempt): Family members' health insurance, company-wide games with rewards, optional mental health support groups.

Exclude Non-Exempt tracking

To enforce the stringent data minimization, excessive tracking should be restricted, which requires the companies to regularly audit their IT tracking tools and block the excessive monitoring, if any, for example, continuous keystroke logging. Therefore, any tracking that does not have any substantial harm to the company should be restricted.

Formulate and Distribute Internal Privacy Notice

Draft an Employee Privacy and Transparency Notice and deliver it to every employee having active employment status, as Section 7(i) only waives the consent obligation for the processing of data, but it does not exclude the obligation of notice provided under Section 5 of the Act, whereby specifying:

the type of data which is being collected
the clear purpose/ reason behind tracking or logging that data, and
for how much time that data will be retained before being erased.

Provide Opt-In and opt- Out Consent Mechanisms

The employees' core employment status should not be affected because of failure to consent; that’s why employers should provide an opt-in consent mechanism for all the data identified as non-exempt at an earlier stage, which can be done by either providing a separate form for consent in the induction process or, if there is an employee portal, then upon it, a separate checkbox to be provided when applying for any ancillary benefits, and also an opt-out option should also be provided as easily as an opt-in mechanism is provided so as to prevent fraud.

Execute Data Processor Agreements (DPAs)

A Data Processor Agreement needs to be executed explicitly to identify every data processor (e.g., background checking firms and payroll in the cloud) and to contractually bind them to protect the data from unauthorized processing and deletion of data upon the termination of the actual term of the employment.

Establishing Grievance Redressal Mechanism

A Data Protection Officer needs to be designated by the employer to resolve internal grievances and also needs to publish the details of the officer in the employee handbook and on the portal. They need to designate a data handler to handle internal grievances and publish their direct contact email on the internal portal and in the employees' handbook. As the employees have the way to either rectify or delete it before escalating it to the Data Protection Board (DPB) of India.

Footnotes

1. Re Kingsforce Management Services Pte Ltd [2023] SGPDPC 9 gd_kingsforcemanagementservicespteltd_100323.pdf

2. Re People Central Pte Ltd [2025] SGPDPCS 4 [2025] SGPDPCS 4.pdf

3. ArbG Neuruppin 2 Ca 554/21 (14 December 2021) Employer to pay compensation when information about former employee remains on company website | ADVANT Beiten

4. Bărbulescu v Romania App no 61496/08 (ECtHR [GC], 5 September 2017) ) BĂRBULESCU v. ROMANIA

5. Antović and Mirković v Montenegro App no 70838/13 (ECtHR, 28 November 2017) ) ANTOVIĆ AND MIRKOVIĆ v. MONTENEGRO

6. BAG 2 AZR 449/16 (28 March 2017) https://www.twobirds.com/en/insights/2017/germany/employee-monitoring-by-keylogger-software-unlawful-except-in-case-of-severe-suspicions

7. Autoriteit Persoonsgegevens (Dutch Data Protection Authority) Decision No z2019-03525 (2019) Processing employee fingerprint data

8. PwC Biometric Attendance Case (Hellenic Data Protection Authority, 30 July 2019) ). Greek DPA fines PwC for unlawfully processing the personal data of its employees

9. Supreme People's Court [SPC] (Civil Third Division, Precedent No SPCP-2023-08, 2023) Chinese Court Publishes Landmark Judgment for Cross-Border Data Transfer - Lexology

10. HmbBfDI v H&M Hennes & Mauritz Online Shop AB & Co KG (Hamburg Commissioner for Data Protection and Freedom of Information, 1 October 2020) H&M gets 35.3M euros fine for employees personal data| GDPR Register

11. Case C-61/22 RL v Landeshauptstadt Wiesbaden [2024] ECLI:EU:C:2024:251CJEU - C-61/22 Landeshauptstadt Wiesbaden 21 Mar 2024

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.