Employers are increasingly using AI. For example, for scheduling, planning, resume selection, or performance reporting. This raises questions: what is an employer allowed to do? What isn't? And how does your privacy remain protected?
In this blog, we explain which rules apply when an employer uses AI, and what rights you have as an employee.
Why do employers use AI?
For example, employers use AI to:
- select resumes faster;
- to make the planning or schedules;
- to prepare reports on absenteeism or performance;
- answer customer questions via a chatbot.
This can save time, but almost always involves the use of personal data of employees or customers. In such cases, the GDPR rules apply.
The basics: a good reason and as little data as possible
An employer must have a valid reason for processing your data. This is called the "basis." For example:
- because it is necessary for your employment contract (for example, wage payments);
- because there is a “legitimate interest”, such as security of the building.
In AI the following applies:
- The employer must be able to clearly explain why AI is necessary.
- No more data may be used than necessary. This is called "processing as little data as possible" (data minimization).
Particularly for special personal data (such as health or trade union membership), extra strict rules apply.
AI should not judge you completely “automatically”
The GDPR gives you the right not to be judged by a computer alone if this would have significant consequences for you.
Examples of decisions with major consequences:
- whether or not to extend the contract;
- dismissal;
- big pay increase;
- rejection of your application.
Important points:
- A decision shouldn't be completely automated. There needs to be a human perspective: someone who can review and adjust the decision.
- You may ask for an explanation: how did this decision come about?
- You may object to the decision.
AI may help, but it should not replace humans in important decisions about your job.
What should your employer arrange when AI is used?
If your employer uses AI, the GDPR requires them to, among other things:
a. Be transparent
You must be able to know:
- which AI systems are used;
- what data is contained in it;
- what the data is used for;
- with which parties data is shared.
b. Make good agreements with the AI supplier
Does the organization work with an external party (e.g., a cloud or AI service)? Then a data processing agreement is required. This agreement stipulates what the supplier may and may not do with the data.
c. Have security in order
The employer must take technical and organizational measures to prevent data leaks.
The AP sees that more and more data leaks are occurring due to careless use of AI chatbots.
d. Performing a DPIA in case of high risk
If AI could have significant consequences for employees (for example in monitoring or assessment), the employer is often required to conduct a Data Protection Impact Assessment (DPIA): a preliminary privacy investigation.
e. Taking the works council into account
AI systems that monitor or evaluate employees are usually classified as "personnel monitoring systems." The works council usually has the right to approve these systems.
Your rights as an employee
Under the GDPR, you have several rights. Important examples:
- Right to information
You are entitled to know what data about you is being processed and what it is being used for. - Right of access
You may ask, “What data does this AI system have about me?” - Right to rectification
If your information is incorrect or incomplete, you may request correction. - Right to object
You may object to certain processing, for example if AI is used to assess you in a way that you consider unreasonable. - Right to a human perspective on decisions
For important decisions you can ask for a human assessment and explanation
Don't just use these rights in "bad" situations. You can also simply ask for clarification.
What can De Unie mean to you?
De Unie can you help if:
- you suspect that AI is being used at your work without proper explanation;
- you are afraid that an AI system is unfairly influencing your assessment, contract or schedule;
- You want to know how to use your GDPR rights.
We'll work with you to review your employer's documents (such as privacy policies, AI policies, and DPIAs) and discuss your options. If necessary, we can assist you with your employer or legal process.
Do you have any questions? Contact our Service Center at sc@unie.nl or 0345 851 963 (weekdays from 8:30 AM to 5:00 PM).
