Can I license EU employee data to AI?
The short answer
The GDPR sets four checks: lawful basis, compatible purpose, notice of the new purpose, and national employee rules under Article 88. The EDPB says trained models cannot be considered anonymous in all cases. Fines reach EUR 20 million or 4% of turnover.
Employee data in the EU falls under the same regulation as customer data. National employment law adds a second layer on top. That layer differs by country, and it is the one that catches people.
Does the GDPR apply to my company?
That is an Article 3 question. The GDPR applies to processing done in the context of an EU establishment. It also reaches a company outside the EU that offers goods or services to people in the Union, or monitors their behaviour there. If you have staff in the EU, a lawyer should settle this.
What does purpose compatibility ask?
Article 6(4) lists five factors. They test whether a new purpose fits the one the data was collected for.
- The link between the two purposes.
- The context, and the relationship between the people and the controller. The controller is the company that decides how the data is used.
- The nature of the data.
- The possible consequences for the people.
- The safeguards in place.
Licensing workplace messages to an AI lab is far from running a payroll or a project. A lawyer has to judge whether it is compatible on your facts.
What notice does the GDPR require before employee data is reused?
GDPR Article 14(4) covers a controller that plans to use data for another purpose. It must tell the person about that purpose before it begins. Article 13(3) says the same for data collected from the person.
What does Article 88 add?
Article 88(1) lets member states set more specific rules for employee data, by law or by collective agreement. Article 88(2) says those rules must include suitable measures to protect dignity and fundamental rights. So a national law or collective agreement can add duties beyond the general text.
What has the EDPB said about training AI on employee and other personal data?
The European Data Protection Board adopted Opinion 28/2024. It says models trained on personal data cannot, in all cases, be considered anonymous. It also says that meeting transparency duties does not, by itself, show that people reasonably expect the processing.
The opinion addresses AI models. Raw dataset licensing falls outside it, so it applies to an owner only by analogy.
The privacy policy page covers notice in the US. The rights check asks whether GDPR or UK GDPR data subjects are in the records.
Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
