OIT - Navigating workers' data rights in the digital age

X Navigating workers' data rights in the digital age A historical, current, and future perspective on workers' data protection Author / Halefom Abraha

September / 2025 ILO Working Paper 149© International Labour Organization 2025 Attribution 4.0 International (CC BY 4.0) This work is licensed under the Creative Commons Attribution 4.0 International. See: https:// creativecommons.org/licenses/by/4.0/. The user is allowed to reuse, share (copy and redistribute), adapt (remix, transform and build upon the original work) as detailed in the licence. The user must clearly credit the ILO as the source of the material and indicate if changes were made to the original content. Use of the emblem, name and logo of the ILO is not permitted in connection with translations, adaptations or other derivative works. Attribution – The user must indicate if changes were made and must cite the work as follows: Abraha, H. Navigating workers' data rights in the digital age: A historical, current, and future perspective on workers' data protection. ILO Working Paper 149. Geneva: International Labour Office, 2025.© ILO. Translations – In case of a translation of this work, the following disclaimer must be added along with the attribution: This is a translation of a copyrighted work of the International Labour Organization (ILO). This translation has not been prepared, reviewed or endorsed by the ILO and should not be considered an official ILO translation. The ILO disclaims all responsibility for its content and accuracy. Responsibility rests solely with the author(s) of the translation. Adaptations – In case of an adaptation of this work, the following disclaimer must be added along with the attribution: This is an adaptation of a copyrighted work of the International Labour Organization (ILO). This adaptation has not been prepared, reviewed or endorsed by the ILO and should

not be considered an official ILO adaptation. The ILO disclaims all responsibility for its content and accuracy. Responsibility rests solely with the author(s) of the adaptation. Third-party materials – This Creative Commons licence does not apply to non-ILO copyright materials included in this publication. If the material is attributed to a third party, the user of such material is solely responsible for clearing the rights with the rights holder and for any claims of infringement. Any dispute arising under this licence that cannot be settled amicably shall be referred to arbitration in accordance with the Arbitration Rules of the United Nations Commission on International Trade Law (UNCITRAL). The parties shall be bound by any arbitration award rendered as a result of such arbitration as the final adjudication of such a dispute. For details on rights and licensing, contact: rights@ilo.org. For details on ILO publications and digital products, visit: www.ilo.org/publns.

ISBN 9789220426319 (print), ISBN 9789220426326 (web PDF), ISBN 9789220426333 (epub), ISBN 9789220426340 (html). ISSN 2708-3438 (print), ISSN 2708-3446 (digital) https://doi.org/10.54394/MLUH5441

The designations employed in ILO publications, which are in conformity with United Nations practice, and the presentation of material therein do not imply the expression of any opinionwhatsoever on the part of the ILO concerning the legal status of any country, area or territory or of its authorities, or concerning the delimitation of its frontiers or boundaries. See: www.ilo. org/disclaimer. The opinions and views expressed in this publication are those of the author(s) and do not necessarily reflect the opinions, views or policies of the ILO.

Reference to names of firms and commercial products and processes does not imply their endorsement by the ILO, and any failure to mention a particular firm, commercial product or process is not a sign of disapproval. Information on ILO publications and digital products can be found at: www.ilo.org/researchand-publications ILO Working Papers summarize the results of ILO research in progress, and seek to stimulate discussion of a range of issues related to the world of work. Comments on this ILO Working Paper are welcome and can be sent to research@ilo.org.

Authorization for publication: Caroline Fredrickson, Director, RESEARCH ILO Working Papers can be found at: www.ilo.org/research-and-publications/working-papers Suggested citation: Abraha, H. 2025. Navigating workers' data rights in the digital age: A historical, current, and future perspective on workers' data protection, ILO Working Paper 149 (Geneva, ILO). https://doi.

org/10.54394/MLUH544101 ILO Working Paper 149 Abstract Over recent decades, comprehensive data protection legislation has proliferated worldwide, with a majority of jurisdictions enacting robust statutory regimes. Despite this abundance of legal standards, persistent challenges remain regarding the efficacy of these laws in protecting individuals‒particularly workers‒within the increasingly digitalised workplace. Workers are especially susceptible to harm due to entrenched power asymmetries and heightened risks of data exploitation, yet many existing legal frameworks provide insufficient or inconsistent protection, and some jurisdictions explicitly exclude workers from coverage. This research critically examines the multidimensional risks associated with workplace digitalisation and systematically analyses regulatory challenges and protection gaps across diverse jurisdictions. By integrating historical analysis, current policy initiatives, and comparative cross-jurisdictional perspectives, the study identifies structural deficiencies in prevailing approaches. It concludes by proposing policy solutions to advance worker-centric data governance frameworks, tailored to address the distinctive challenges of contemporary labour relations and to ensure more equitable and effective protection for workers in the digital age. About the authors

risdictional perspectives, the study identifies structural deficiencies in prevailing approaches. It concludes by proposing policy solutions to advance worker-centric data governance frameworks, tailored to address the distinctive challenges of contemporary labour relations and to ensure more equitable and effective protection for workers in the digital age. About the authors Dr. Halefom Abraha is an Assistant Professor of law and technology at Utrecht University School of Law and a member of the Netherlands Institute of Human Rights (SIM). His research and teaching interests focus on workers’ data rights and the regulation of AI and algorithmic management in the labour market. He also researches cross-border data access in the context of law enforcement and digital sovereignty.02 ILO Working Paper 149 Abstract 01 About the authors 01 X Introduction 04 Aim and Scope 04 Use of Terms 05 Structure 05 X 1 Workplace monitoring and decision-making technologies 06 Digital monitoring and surveillance at work 07 Algorithmic management 10 Driving forces for the boom in workplace technologies 11 X 2 The risks for workers’ fundamental rights and interests 14 Privacy and data protection risks 15 Beyond privacy and data protection 18 X 3 Existing protections 21 Global standards 21 A case study of selected jurisdictions 23 The European approach 23 The United States’ approach 30 The Australian Approach 34 Lessons from other jurisdictions 38 X 4 Regulatory gaps, challenges, and uncertainties 42 Inadequacy of general data protection frameworks 42 Treating workers as consumers 43 Complex overlap with other legal fields 44 Structural legal deficits 45 Workplace exemptions 46 Fragmented regulatory frameworks and enforcement challenges 46 Table of contents03 ILO Working Paper 149 X 5 The future of workers’ data rights: towards a balanced regulatory approach 48 The necessity for specialised data protection legislation 48 Clarifying the personal scope of workplace data protection rules 49 Establishing fair balance between workers’ and employers’ interests 50 Collective governance of workplace data practices 50

X 5 The future of workers’ data rights: towards a balanced regulatory approach 48 The necessity for specialised data protection legislation 48 Clarifying the personal scope of workplace data protection rules 49 Establishing fair balance between workers’ and employers’ interests 50 Collective governance of workplace data practices 50 Emergence of specialized regulation for algorithmic management 51 The need for cross-regulatory cooperation 51 References 53 Acknowledgements 6304 ILO Working Paper 149 X Introduction Aim and Scope The emergence of data protection laws in the late 1970s marked the initial regulatory response to societal risks posed by the information revolution, particularly those associated with automated data processing. While more than 162 countries now have comprehensive data protection laws, a recurring challenge lies in their applicability to the world of work and their adequacy in protecting individuals in an increasingly digitalised workplace. Thirty-five years ago, Spiros Simitis questioned whether omnibus data protection frameworks could address the unique complexities of workplace dynamics, advocating instead for employment-specific rules. His critique resonates urgently today, as pervasive digital surveillance and algorithmic management systems amplify workplace power dynamics, posing novel risks to workers’ fundamental rights that existing regulations have failed to adequately address. Workers — particularly vulnerable due to systemic power asymmetries and data exploitation risks — often receive inadequate protection under existing laws, with some jurisdictions excluding them entirely. Historically, policymakers have acknowledged this inadequacy, as evidenced by the Council of Europe’s 1989 Recommendation on the protection of workers’ personal data, the ILO’s 1997 Code of Practice on Protection of Workers’ Personal Data, and the European Union’s 2001 Opinion on employment data processing, each adopting workplace-specific rules to complement general regulations. Yet translating this recognition into robust legislative frameworks at national levels has proven largely unsuccessful, reflecting entrenched regulatory gaps. Furthermore, the technological landscape has undergone significant transformation since the publication of these international instruments. All frameworks are non-binding, and they were adopted before the widespread implementation of electronic monitoring systems in workplaces and the dawn of the AI era. The emergence of data-driven people management and autoFurthermore, the technological landscape has undergone significant transformation since the publication of these international instruments. All frameworks are non-binding, and they were adopted before the widespread implementation of electronic monitoring systems in workplaces and the dawn of the AI era. The emergence of data-driven people management and automated decision-making has introduced new challenges that these earlier frameworks were not designed to fully address. It is therefore unsurprising that the ILO has refocused its attention on this issue. In March 2024, the ILO Governing Body decided to convene at a future date a tripartite meeting of experts on the protection of workers’ personal data in the digital era. This development underscores the recognized need for updated and comprehensive standards for workers’ data protection that establish a fair balance between workers’ fundamental rights and employers’ interests. Against this background, this research examines the multidimensional risks of workplace digitalisation and analyses regulatory challenges and gaps across jurisdictions. By synthesising historical precedents, current initiatives, and cross-jurisdictional comparisons, it proposes policy solutions to advance worker-centric data governance frameworks capable of addressing modern labour relations’ unique challenges. Ultimately, the research aims to contribute to the development of more robust, human-centred data protection frameworks and standards that are adaptable to the evolving landscape of work in the digital age, while also promoting innovation and protecting business interests. The research is subject to limitations regarding geographic and material scope. In addition to international standards, the study systematically analyses regulatory frameworks of selected05 ILO Working Paper 149 jurisdictions, with particular focus on the European Union, the United States, and Australia ‒ regions characterised by multiple regulatory initiatives and distinctive approaches. The research also examines frameworks and recent developments in India, China, Brazil, and several African countries. While the selection aims to be representative of major jurisdictions, it does not mean to suggest that the research provides comprehensive coverage of all global regions. Substantively, the research addresses existing regulatory frameworks, including data protection and privacy laws, labour laws, algorithmic management and AI regulations, non-legislative guidelines, and

countries. While the selection aims to be representative of major jurisdictions, it does not mean to suggest that the research provides comprehensive coverage of all global regions. Substantively, the research addresses existing regulatory frameworks, including data protection and privacy laws, labour laws, algorithmic management and AI regulations, non-legislative guidelines, and recent policy initiatives. Although the research seeks to highlight key regulatory frameworks within each jurisdiction, it does not claim to be exhaustive. Nuanced local interpretations and sector-specific regulations may fall outside the scope of this analysis. Use of Terms Unless otherwise explicitly indicated, this research uses the term ‘worker’ to include any current or former worker or applicant for employment and independent contractors. The objective is to ensure that that workplace data protection rules provide consistent protections at all stages of the employment relationship, regardless of its legal nature or status. This approach is further explained in Section 6.2. in some instances, the term ‘employee’ may be used when it appears in specific regulations or is directly quoted from other sources. Structure The research is organized in six parts. The next section examines the prevalence of advanced workplace technologies, focusing on digital monitoring and automated decision-making systems. Section 3 analyses the risks these technologies and practices pose to workers’ data rights, including privacy as well as broader social and labour rights. Section 4 maps existing legal protections at the international level and across selected jurisdictions. Section 5 identifies the gaps, challenges, and uncertainties within these regulatory frameworks. Finally, Section 6 proposes potential pathways for future regulations to effectively address these issues effectively.06 ILO Working Paper 149 X 1 Workplace monitoring and decision-making technologies

In the past few decades, data-driven technologies have transformed the world around us, particularly the workplace. While the precise scope and nature of how recent technological advancements, such as AI, will change the world of work remain uncertain, employers are increasingly using data and algorithms in ways that may potentially have consequences for workers’ fundamental rights and interests. The digitalisation of the workplace has recently garnered considerable media attention and public debate around the world. Specifically, the rapid advancement and widespread adoption of

using data and algorithms in ways that may potentially have consequences for workers’ fundamental rights and interests. The digitalisation of the workplace has recently garnered considerable media attention and public debate around the world. Specifically, the rapid advancement and widespread adoption of powerful algorithmic systems and surveillance tools in the world of work have prompted many commentators to re-examine and question whether existing regulatory systems are adequately equipped for the digital era.1 This technological transformation presents both opportunities and risks that need careful consideration and balanced regulation. Collecting and processing workers’ data is an inherent prerogative of the employer, an essential consequence of the employment relationship. Employers collect a range of workers’ personal data for many justified and often necessary reasons, or as required by law. While employers use a wide range of tools to gather and process workers’ data, and these practices take many forms, this research focuses on two broad categories of workplace technologies and practices: digital monitoring/surveillance 2 and algorithmic management. This focus does not suggest that more traditional methods of data processing do not pose privacy and data protection risks. Rather, it is to encourage policymakers to pay more attention to employers’ new acts or practices and methods of processing instead of fixating on the data itself. Automated monitoring and surveillance systems can be defined as technologies used for, or in support of, monitoring, supervising or evaluating work performance, worker behaviour, or the activities carried out within the work environment and beyond. These systems can range from simple time-tracking software to sophisticated biometric surveillance tools. On the other hand, algorithmic management or automated decision-making systems encompass algorithmic tools used to support, augment, or fully replace managerial decisions that affect working conditions.3 These systems can influence various aspects of employment, including access to work, earnings, occupational safety and health, working time, promotion and contractual status, and disciplinary as well as termination procedures. It is important to note that this classification is not meant to suggest that these technologies and practices are mutually exclusive. In fact, they often reinforce and complement each other, creating complex ecosystems of digital workplace management. For instance, data collected through auas well as termination procedures. It is important to note that this classification is not meant to suggest that these technologies and practices are mutually exclusive. In fact, they often reinforce and complement each other, creating complex ecosystems of digital workplace management. For instance, data collected through automated monitoring systems are often feed into algorithmic management systems, influencing decisions about worker performance, scheduling, or promotions. As Fernandez Macias and others 1 Jeremias Adams-Prassl and others, ‘Regulating Algorithmic Management: A Blueprint’ (2023) 14 European Labour Law Journal 124. 2 The terms ‘monitoring’ and ‘surveillance’ are used interchangeably for the purpose of this research. However, it’s important to note that employee surveillance is generally perceived as more intrusive and ethically problematic than employee monitoring, as it extends beyond work-related activities. see Eurofound, Employee Monitoring and Surveillance: The Challenges of Digitalisation (Publications Office of the European Union, Luxembourg 2020). 3 Adams-Prassl and others (n 4).07 ILO Working Paper 149 pointed out, algorithmic management of work generally presupposes some degree of digital monitoring, which provides the data on which the algorithms operate.4 For this research, these systems are treated separately only to the extent that they raise unique legal and policy issues. Digital monitoring and surveillance at work Workplace monitoring and surveillance is not a new phenomenon,5 nor is the utilization of modern technologies to do so. The capabilities and implications of workplace technologies and the need for workers’ data protection legislation have been debated since the 1970s.6 However, recent advances in workplace monitoring and surveillance technologies, coupled with the increasing digitalization of the workplace have, according to the Eurofound, ‘made them more pervasive and ubiquitous and potentially more intrusive, pushing the boundaries of acceptability and posing new challenges for legislators and policymakers’.7 Employers are increasingly utilizing sophisticated electronic monitoring and surveillance tools to track their workers’ every move and predict a wide range of worker behaviours in the workplace. These systems ‘enable employees to be tracked over time, across workplaces and their

posing new challenges for legislators and policymakers’.7 Employers are increasingly utilizing sophisticated electronic monitoring and surveillance tools to track their workers’ every move and predict a wide range of worker behaviours in the workplace. These systems ‘enable employees to be tracked over time, across workplaces and their homes, through many different devices such as smartphones, desktops, tablets, vehicles and wearables’.8 While some uses may be positive ‒ such as signalling to management if a worker enters a hazardous zone in a construction site ‒ other uses may be less so, such as when data collected on ‘whom [workers] talk to, what they type, how quickly they complete tasks and even their mood’.9 Indeed, the extent of worker monitoring is no longer limited to performance management; workers’ thoughts, feelings and physiology can equally be tracked and analysed, and their behaviour predicted.10 Big data and people analytics11 tools allow for new types of systematic and data processing at work, enabling employers to obtain an increasingly detailed and sophisticated picture of what workers are doing and how they feel about their work.12 Comparing to traditional forms of monitoring, Ravid et al (2020) succinctly summarised the impact of new workplace monitoring and surveillance technologies and practices as follows:  Employers (…) can track individual employees continuously, randomly, or intermittently; discreetly or intrusively; and with or without warning or consent (…). As a result, (new monitoring and surveillance technologies) capture behaviour in great detail, generating rich, permanent records that managers can quickly access and that may or may not relate directly to performance (…). (They) can also target internal states and private behaviors. For example, e-mail monitoring allows organizations to track employee thoughts, 4 European Commission Joint Research Centre, The Platformisation of Work: Evidence from the JRC Algorithmic Management and Platform Work Survey (AMPWork). (Publications Office of the European Union 2023) <https://data.europa.eu/doi/10.2760/801282> accessed 16 November 2024.

4 European Commission Joint Research Centre, The Platformisation of Work: Evidence from the JRC Algorithmic Management and Platform Work Survey (AMPWork). (Publications Office of the European Union 2023) <https://data.europa.eu/doi/10.2760/801282> accessed 16 November 2024. 5 Frederick Winslow Taylor, The Principles of Scientific Management (Dover Publications 1997); Marx Gary T. and Sanford Sherizen, ‘Monitoring on the Job: How to Protect Privacy as Well as Property’ (Technology Review, 1986) <https://web.mit.edu/gtmarx/www/privacy.html> accessed 16 November 2024 (noting that contemporary monitoring is a continuation of Taylorism, though new developments in electronic technology are taking that ethos to new heights). 6 For detailed analysis on long history of work monitoring and its implications, see ‘Personal Privacy in an Information Society’ (US Privacy Protection Study Commission 1977); ‘The Electronic Supervisor: New Technology, New Tensions’ (US Congress, Office of Technology Assessment, September 1987). 7 Sara Riso, ‘Monitoring and Surveillance of Workers in the Digital Age’ (Eurofound) <https://www.eurofound.europa.eu/en/monitoring-and-surveillance-workers-digital-age> accessed 16 November 2024. 8 Article 29 Data Protection Working Party, Opinion 2/2017 on data processing at work, Adopted on 8 June 2017. 9 Charlotte Garden, ‘Labor Organizing in the Age of Surveillance’ (2018) 63 St. Louis U. L.J. 10 Kirstie Ball, ‘Electronic Monitoring and Surveillance in the Workplace: Literature Review and Policy Recommendations’ (Publications Office of the European Union, JRC125716 2021). 11 Matthew T Bodie and others, ‘He Law and Policy of People Analytics’ 88 U. COLO. L. REV. 12 Garden (n 12).08 ILO Working Paper 149 feelings, and attitudes that are expressed in electronic exchanges but not outwardly. Social media monitoring allows organizations to track the social networks and relationships that employees build inside and outside of the workplace. Recent (monitoring

12 Garden (n 12).08 ILO Working Paper 149 feelings, and attitudes that are expressed in electronic exchanges but not outwardly. Social media monitoring allows organizations to track the social networks and relationships that employees build inside and outside of the workplace. Recent (monitoring and surveillance) technologies allow for the tracking of employees’ physiological states, providing organizations with biometric information, such as heart rates and body heat emissions (…).13 A number of technologies can be used for worker monitoring and surveillance for a host of different purposes, targeting different aspects of working life. In this regard, the most common monitoring and surveillance practices can be categorized as performance monitoring, behaviour monitoring, personal characteristics monitoring.14 Behaviour monitoring and performance tracking technologies have become ubiquitous in the workplace across sectors, particularly in low-paying jobs. These technologies range from the more conventional form of monitoring such as CCTV surveillance and monitoring of emails, telephone calls and internet usage to more sophisticated biometric technologies, predictive analytics and AI. For instance, GPS and radio-frequency identification (RFID) devices are often used to provide always-on and real-time location tracking of the whereabouts of workers. According to a 2022 New York Times article, eight out of 10 of the largest private employers in the US track the productivity metrics of individual workers, many in real time.15 Employment monitoring systems can track workers’ computer activities, including mouse movement and the number of keystrokes, take screenshots etc. Many workers are subject to trackers, scores, ‘idle’ buttons, or just quiet, constantly accumulating records. Pause can lead to penalties, from lost pay to lost job,16 ‘potentially requiring employees to justify every break or interruption’.17 For instance, if workers have to get up from their desk to take a break, go to the bathroom, or get lunch, their mouse is no longer active, and their status will turn from active to idle. In some instances, such as freelancing platforms18 and some logistics companies,19 the workers are only paid for those minutes when the system detected active work.

get lunch, their mouse is no longer active, and their status will turn from active to idle. In some instances, such as freelancing platforms18 and some logistics companies,19 the workers are only paid for those minutes when the system detected active work. Wearable technologies, such as smartwatches, smart bracelets and smart glasses with built-in GPS capabilities and sensors tracking movements and location and counting steps and pulses, are emerging trends in the workplace. Some employers use FitBit bracelets to track workers’ fitness, sleep quality, fatigue levels and location.20 Warehouses workers in various jurisdictions are required to use hand-held scanners (wearable devices) which monitor every movement of every worker, including toilet breaks.21 The German’s Lower Saxony State Data Protection Commissioner 13 Daniel M Ravid and others, ‘EPM 20/20: A Review, Framework, and Research Agenda for Electronic Performance Monitoring’ (2020) 46 Journal of Management 100. 14 ‘The Electronic Supervisor: New Technology, New Tensions’ (n 9); Eurofound (n 5); ‘Workers’ Privacy Part II: Monitoring and Surveillance in the Workplace’ (International Labour Office, Conditions of work digest, Vol 12 Number 1, 1993); Ball (n 13). 15 Jodi Kantor and others, ‘The Rise of the Worker Productivity Score’ The New York Times (15 August 2022) <https://www.nytimes.com/ interactive/2022/08/14/business/worker-productivity-tracking.html> accessed 11 November 2024. 16 Lauren Kaori Gurley, ‘Internal Documents Show Amazon’s Dystopian System for Tracking Workers Every Minute of Their Shifts’ (VICE, 2 June 2022) <https://www.vice.com/en/article/internal-documents-show-amazons-dystopian-system-for-tracking-workers-every-minute-of-their-shifts/> accessed 11 November 2024; Kantor and others (n 18).

17 ‘Employee Monitoring: CNIL Fined AMAZON FRANCE LOGISTIQUE €32 Million’ <https://www.cnil.fr/en/employee-monitoring-cnil-fined-amazon-france-logistique-eu32-million> accessed 18 November 2024. 18 Kantor and others (n 18). 19 ‘NLRB Memo Takes Aim at Intrusive Workplace Surveillance & Algorithmic Management Systems’ (Center for Democracy and Technology, 21 December 2022) <https://cdt.org/insights/nlrb-memo-takes-aim-at-intrusive-workplace-surveillance-algorithmic-management-systems/> accessed 1 May 2025. 20 David Cox, ‘The Rise of Employee Health Tracking’ (BBC, 11 November 2020) <https://www.bbc.com/worklife/article/20201110-therise-of-employee-health-tracking> accessed 26 November 2024. 21 Jay Stanley, ‘Amazon Drivers Placed Under Robot Surveillance Microscope’ (American Civil Liberties Union, 23 March 2021) <https:// www.aclu.org/news/privacy-technology/amazon-drivers-placed-under-robot-surveillance-microscope> accessed 12 November 2024.09 ILO Working Paper 149 characterised this practice as ‘total surveillance’ of the workers, which could constitute a serious interference with the right to privacy without justification.22 The extent and pervasiveness of performance and b