AI in the Workplace: Privacy and Data Protection Challenges
30/06/2025
This blog is part of our ongoing series focusing on the EU Artificial Intelligence Act (AI Act).
AI Technologies in the Workplace
AI technologies are becoming central to the workplace. Official statistics show a high adoption rate, especially in large companies and even more in the information and communications and in the finance sector. The incentives are clear: AI systems can increase productivity, reduce repetitive tasks, improve worker engagement, and drive innovation.
Yet these benefits come with a number of concerns about excessive surveillance, increased work intensity, algorithmic bias, fairness, and explainability. There are also real data protection risks, particularly due to insufficient transparency about how employee data is collected, analysed, and stored.
In short, while AI adoption continues to accelerate, the legal frameworks designed to ensure accountability and protect worker rights become more significant. This is especially the case in workplace contexts, where power imbalances and the difficulties with relying on free and informed consent make traditional data protection safeguards more complex to apply in practice.
The AI Act: What Employers Need to Know
It is important to know that the AI Act does not only apply to providers of AI tools, but also to employers who deploy AI tools. This means that any company that provides or deploys an AI tool falls under the scope of the AI Act. The degree of applicability depends on which risk class the AI tool is in.
For more information on the AI Act, see: The EU’s newly published Artificial Intelligence Act – an Overview in 6 Questions.
The AI Act introduces the following risk-based framework:
-
Prohibited AI Practices: Systems with unacceptable risk, such as manipulative or exploitative AI or tools inferring sensitive attributes, are banned.
-
High-Risk AI Systems: Allowed only with strict safeguards, these systems impact health, safety, or fundamental rights. Examples include AI used in recruitment, workforce monitoring, task allocation, promotion, or termination.
-
Transparency Risk: Systems interacting with people (e.g., chatbots) or generating content (including deepfakes) must comply with transparency obligations.
-
Minimal Risk: No additional AI Act steps, but privacy and data protection laws, consumer laws, and product safety rules still apply.
-
General-Purpose AI: There are also specific requirements for general-purpose models, with more stringent obligations for those with systemic risks.
The EU AI Act has a major impact on employers and HR professionals who use AI in a wide range of areas like recruitment, performance evaluation, talent management, and workforce monitoring. Furthermore, the obligations are not limited to organisations established in the EU or EEA but have an extraterritorial effect on systems affecting EU workers.
For more information on high risk AI systems, see: 7 Steps to Identify if your AI System is High-Risk under the AI Act.
In practice, employers developing or deploying AI should:
-
Map current and planned AI systems, assess their risks, and identify any prohibited uses
-
Establish or update internal AI policies and employee consultation processes
-
Form a compliance group to oversee AI Act requirements
-
Build AI literacy programs across the workforce
-
Stay up to date with new guidelines, codes of practice, and national implementation
For tailored advice and compliance support on the points above, feel free to get in touch with the authors via ezgi.ercan@timelex.eu and geert.somers@timelex.eu.
Privacy and Data Protection Challenges: Two Case Studies
The EU’s General Data Protection Regulation (GDPR), the e-Privacy Directive and the AI Act are complementary but distinct frameworks that address AI, privacy, and data protection. As AI adoption in the workplace grows, questions around data processing, transparency, and accountability remain.
For more information about the AI Act and the GDPR, check Harmonising AI and Data Protection: Navigating the AI Act and the GDPR.
In this post, we briefly highlight two use cases illustrating how applicable privacy and data protection laws may interact with the AI Act while deploying complex AI systems in the workplace, particularly involving third-party vendors.
AI-Driven Summarisation Solutions in Call Centres
These AI-driven tools are increasingly adopted to automate transcription, summarisation, and analysis of call centre conversations. They typically combine speech recognition software with cloud-based summarisation tools, operating in real time or after the call.
While these solutions greatly improve efficiency, they also raise compliance concerns under the e-Privacy Directive and the GDPR, especially when third-party vendors process communication data. Organisations must carefully evaluate the adequacy of safeguards in place to ensure compliance with applicable privacy and data protection laws.
Furthermore, given the lack of clear guidance on applying the e-Privacy Directive to such tools, its adequacy should be reassessed by the legislator considering modern AI developments.
AI-Driven Occupational Safety and Health (OSH) Monitoring Systems
These systems are being adopted to predict hazards by proactively using data from CCTV, sensors, or wearables. They rely on algorithms trained on large datasets to identify safety risks in real time and send alerts to employees or supervisors, enabling rapid corrective action.
While these tools offer clear benefits, they also raise concerns about surveillance, third-party vendor involvement, and data misuse. To comply with the GDPR, organisations should conduct Data Protection Impact Assessments (DPIAs), apply privacy-by-design principles, maintain transparency, and ensure human oversight. They must also comply with local employment laws and consult with works councils where required.
Both developers and deployers of AI should clearly assess their roles under the AI Act and GDPR to meet evolving legal obligations.
Further Insights Into the Use-Cases
The evolution of AI technologies offers significant benefits for workplace efficiency and safety, Yet they also bring new privacy and data protection challenges that existing laws cannot fully address. This has been shown in the case studies of call centre summarisation tools and occupational safety monitoring systems.
For a deeper dive into these questions, we refer to the recently published article Legislative Lag vs Technological Leap: Privacy and Data Protection Challenges when using AI-Driven Workplace Solutions, published in Data Protection, Privacy and Artificial Intelligence – Volume 17: To Govern or To Be Governed, That Is the Question.
Co-authored by Ezgi Ercan and Geert Somers, the chapter examines the increasing integration of AI systems into the workplace, and the resulting interplay with existing data protection frameworks, particularly the GDPR and the e-Privacy Directive.
The volume, edited by Eleni Kosta, Dara Hallinan, Paul De Hert and Suzanne Nusselder, brings together a diverse group of contributors reflecting on the dilemmas posed by emerging AI technologies. More information is available on Bloomsbury’s website.
A key issue across both case studies is the role of third-party vendors. Using sub-processors introduces risks like unauthorised access, data breaches, and cross-border data transfers. While anonymisation or pseudonymisation help reduce risks, they are not sufficient without a valid legal basis and robust data processing agreements. Vendor risk assessments, access controls, audits, and GDPR certification mechanisms can further support compliance and build trust.
For more information on fundamental rights impact assessments, see: Unlocking Ethical AI: A Closer Look into the Fundamental Rights Impact Assessment under the AI Act
For more information on GDPR certification, see: The first EU-wide GDPR certification scheme – Europrivacy (TM/®) explained in 5 questions
Further Reading on the AI Act
For more insights, explore our other posts in Timelex AI Act series:
Related posts
