Employers are likely to rely on more than one of the six prescribed lawful grounds for processing, which include: consent; contract; compliance with a legal obligation; vital interests; public interest; and legitimate interests. It is important for employers to process activity separately and identify the most suitable lawful basis for that activity. Relying too much on one, such as consent, for example, could be found to be unlawful ground for processing an employee’s data when there may have been a more suitable alternative, as demonstrated by the Greek supervisory authority when it recently ruled as such against the PwC.
