[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F88":3},{"item":4,"lessons":16,"controls":66,"related":81},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","88","Article 88","Processing in the context of employment",15,"General Data Protection Regulation","**What it asks for.** Article 88 allows member states, by law or collective agreements, to provide more specific rules to protect employees' rights and freedoms in the processing of their personal data in the employment context, for example for recruitment, performance of the employment contract, health and safety, and termination. Such rules must include suitable and specific measures, particularly regarding transparency, transfers within a group and monitoring systems at work.\n\n**In practice.** Organisations identify which national employment data rules and collective agreements apply in each country they operate in, and reflect them in HR processing, employee notices and workplace monitoring. Evidence includes country level legal analyses, employee privacy notices, works council consultations where required and DPIAs for monitoring tools.\n\n**Common gaps.** Global HR and security monitoring tools are often rolled out uniformly without checking national rules. Consultation obligations with employee representatives are frequently missed.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_88","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"italian-meteorological-institute-fined-for-unlawful-cctv-surveillance-without-dpia-or-employee-notic","Italian Meteorological Institute Fined for Unlawful CCTV Surveillance Without DPIA or Employee Notice","2026-10-07T08:21:59.854+00:00",{"slug":23,"title":24,"published_at":25},"italian-research-institute-fined-for-unlawful-video-surveillance-of-employees","Italian Research Institute Fined for Unlawful Video Surveillance of Employees","2026-10-01T14:21:23.63+00:00",{"slug":27,"title":28,"published_at":29},"romanian-firm-fined-5000-for-unlawful-biometric-employee-tracking","Romanian Firm Fined €5,000 for Unlawful Biometric Employee Tracking","2026-09-29T17:20:26.435+00:00",{"slug":31,"title":32,"published_at":33},"italian-municipality-fined-8000-for-gdpr-violating-surveillance-cameras-in-pool-changing-rooms","Italian Municipality Fined €8,000 for GDPR-Violating Surveillance Cameras in Pool Changing Rooms","2026-09-16T09:20:52.348+00:00",{"slug":35,"title":36,"published_at":37},"eu-coalition-pushes-to-replace-cookie-banners-with-automated-privacy-signals","EU Coalition Pushes to Replace Cookie Banners with Automated Privacy Signals","2026-09-10T06:20:19.193+00:00",{"slug":39,"title":40,"published_at":41},"german-court-fines-kebab-firm-8000-for-unlawful-employee-video-surveillance","German Court Fines Kebab Firm €8,000 for Unlawful Employee Video Surveillance","2026-09-09T14:21:23.709+00:00",{"slug":43,"title":44,"published_at":45},"spanish-firm-fined-4000-for-disproportionate-workplace-audio-recording-via-cctv","Spanish Firm Fined €4,000 for Disproportionate Workplace Audio Recording via CCTV","2026-09-08T08:20:18.103+00:00",{"slug":47,"title":48,"published_at":49},"460k-gdpr-fine-for-unlawful-retrospective-employee-email-monitoring","€460K GDPR Fine for Unlawful Retrospective Employee Email Monitoring","2026-08-11T14:21:30.792+00:00",{"slug":51,"title":52,"published_at":53},"unlawful-employee-feedback-processing-missing-legal-basis-triggers-austrian-dpa-ruling","Unlawful Employee Feedback Processing: Missing Legal Basis Triggers Austrian DPA Ruling","2026-08-11T14:20:23.064+00:00",{"slug":55,"title":56,"published_at":57},"italian-dpa-fines-company-460k-for-unlawful-employee-email-monitoring","Italian DPA Fines Company €460K for Unlawful Employee Email Monitoring","2026-08-10T08:20:19.441+00:00",{"slug":59,"title":60,"published_at":61},"piaggio-fined-460k-for-unlawful-employee-email-monitoring-and-delayed-account-deactivation","Piaggio Fined €460K for Unlawful Employee Email Monitoring and Delayed Account Deactivation","2026-08-06T10:20:40.321+00:00",{"slug":63,"title":64,"published_at":65},"marketing-agency-fined-25500-for-unlawful-recording-of-job-applicant-calls","Marketing Agency Fined €25,500 for Unlawful Recording of Job Applicant Calls","2026-07-31T16:20:57.434+00:00",[67,72,76],{"slug":68,"name":69,"problem":70,"stories":71},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",2,{"slug":73,"name":74,"problem":75,"stories":71},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":77,"name":78,"problem":79,"stories":80},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",1,[82,87,92,97,103,108,113,118],{"family":83,"item":84,"code":85,"title":86,"together":9},"cis","3","Control 3","Data Protection",{"family":5,"item":88,"code":89,"title":90,"together":91},"5","Article 5(1)(f)","Principles relating to processing of personal data",12,{"family":5,"item":93,"code":94,"title":95,"together":96},"35","Article 35","Data protection impact assessment",11,{"family":98,"item":99,"code":100,"title":101,"together":102},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",10,{"family":5,"item":104,"code":105,"title":106,"together":107},"6","Article 6","Lawfulness of processing",9,{"family":109,"item":110,"code":111,"title":112,"together":107},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",{"family":5,"item":114,"code":115,"title":116,"together":117},"13","Article 13","Information to be provided where personal data are collected from the data subject",8,{"family":119,"item":110,"code":120,"title":120,"together":121},"itil","ITIL",7]