Employee data and AI: the questions to settle before the roll-out

Employee data is personal data – the GDPR applies to it in full, and the employment relationship adds some particular complications: the imbalance of power that devalues consent, the co-determination rights of the works council and the line beyond which monitoring behaviour becomes unlawful. As a managing director introducing AI in your company, you will almost inevitably also be processing data about your own workforce: names in minutes, authors of instructions, duty rosters, emails. That is perfectly possible – but only with clear rules. This article sets out the basic principles and does not replace legal advice in an individual case.

In brief

• Employee data is subject to the GDPR just like customer data – in addition, labour law restrictions apply, especially for control measures.
• In an employment relationship, consent is rarely a solid legal basis, because its voluntary nature can be called into question.
• Control measures that affect human dignity require the consent of the works council; in companies without a works council, the consent of the employees concerned.
• The EU AI Regulation classifies AI in the employment sector – for example in applications, promotions, dismissals – as a high-risk area.
• The everyday case in knowledge work is uncritical: instructions and minutes with author names. Off-limits in general file storage: contents of personnel files.

Why is employee data a special case?

With customer data, it is about data protection. With employee data, it is about data protection plus labour law plus the working atmosphere. Three reasons make the difference:

The imbalance of power. An employee finds it hard to say no to their employer. That is why data protection law views consent in employment relationships with scepticism: consent is only valid if it is given voluntarily – and at work, that is often precisely what is in doubt.

Special categories of data are everywhere. Health data (sick leave, doctor’s certificates), religious affiliation (from payroll) or trade union membership belong to the specially protected categories under Art. 9 GDPR – and are found in perfectly normal HR records.

The question of control. Any system that records employees’ activities or makes them analysable can become a control measure – and Austrian labour law has its own strict rules for that.

Then there is a simple truth about leadership: mistakes with customer data cost trust in the market – mistakes with employee data cost trust within your own company, every single day.

On what legal basis may you process employee data?

For everyday business, three GDPR legal bases essentially hold up:

1. Performance of a contract: Everything necessary to perform the employment contract – master data, payroll, duty scheduling.
2. Legal obligation: Reporting, record-keeping and retention obligations, for example towards social insurance and the tax authorities.
3. Legitimate interest: The catch-all for much of the rest – for example internal knowledge organisation. It requires a documented balancing test: your interest against the interests of the employees. The more harmless the data and the clearer the benefit, the more likely the balancing test is to hold up.

Consent remains the exception for genuinely optional cases – the photo on the website, for example – and must be revocable at any time. Anyone who bases the use of AI in their company on consent alone is building on sand. The Austrian Data Protection Authority (dsb.gv.at) provides guidance on the legal bases.

Regardless of the legal basis, the duty to inform applies: employees must know which of their data is processed for what purpose. When you introduce a new system, that means informing people actively, not only on request. And the processing belongs in the record of processing activities – the internal register of all data processing operations that the GDPR requires.

What does the works council have to do with it?

The Austrian Labour Constitution Act (Arbeitsverfassungsgesetz, ArbVG) provides that control measures and technical systems for monitoring employees that affect human dignity require the consent of the works council (§ 96 ArbVG). In companies without a works council, the consent of the employees concerned is required. The legal text is available in the Federal Legal Information System (RIS, ris.bka.gv.at).

For AI projects this means: what matters is not what the system is called but what it can do. A knowledge base that makes instructions searchable is not a control measure. A system that analyses who works how fast, who answers how many enquiries or who searched for what and when may very well be one. Two practical rules work well: first, involve the works council – where there is one – early, not only after the purchase; this avoids conflicts and builds acceptance. Second, configure analysis functions deliberately: anything that should not be analysed should not be technically analysable at all.

The EU AI Regulation is also worth mentioning: it classifies AI systems in the employment sector – for example for selecting applicants, allocating tasks or assessing performance – as high-risk systems with strict obligations. Anyone considering such applications needs professional support.

Which AI applications involving employee data are sensitive, and which are not?

Use case	Assessment
Instructions and service records with author names in the knowledge base	The normal case of knowledge organisation – uncritical with access controls in place
AI search across internal documents (“How is system X maintained?”)	Uncritical if access rights apply and individuals are not analysed
Wage, salary and sick leave data in general file storage	Off-limits – belongs in the HR area with tight access rights
Analysis of individual performance or individual behaviour by AI	Sensitive: control measure, co-determination, high-risk area – only with professional support
AI-assisted selection of applicants	High-risk area under the AI Regulation – strict obligations

The table shows the pattern: AI is uncritical where employee data only appears incidentally – as the author of an instruction, as the contact person in a set of minutes. It becomes sensitive as soon as the person themselves becomes the subject of the analysis.

Five rules for using AI with employee data

1. Define the purpose and stick to it: The knowledge base serves to find knowledge – not to analyse people. Record this purpose in writing.
2. Data minimisation: Contents of personnel files stay out, or in a sealed-off area. The author’s name under an instruction is fine; the author’s sick leave is nobody’s business.
3. Access rights on a need-to-know basis: Anyone who needs a maintenance instruction does not need to see salary data – the system must reflect this separation technically.
4. Inform the workforce: Transparency is both a GDPR obligation and a leadership task. Explain what the system can do, what it cannot do and what is deliberately not analysed.
5. Check the provider: Data processing agreement (DPA), contractual training exclusion, EU data storage – employee data has no place in systems that use it to train third-party models.

An AI knowledge base that focuses on documented company knowledge, backs up every answer with the source document and enforces access rights fits well with these five rules – precisely because its purpose is knowledge, not the person. The overview AI and the GDPR in Austria shows how the data processing agreement, server location and training exclusion work together.

As a next step, before the roll-out, set down in writing which document types go into the system, who may access what and what is expressly not analysed – this defuses the most common conflicts before they arise. The page on how the roll-out works explains the process in detail.