Do I need employee consent to license company data?
The short answer
It depends on where staff sit and what they were told. California's CCPA requires notice and opt-out, and bars uses that clash with the notice given at collection. EU and UK regulators doubt employee consent is freely given. Ask counsel which rule covers each group of staff.
Consent is one tool among several, and often not the biggest one. Notice, opt-out and old promises usually matter more. So the useful work is finding out which rule covers each group of your employees.
What does California require for employee data?
California's CCPA has covered employee data since 1 Jan 2023, per the state attorney general. Section 1798.120 lets a person tell a business not to sell their personal information. It also requires notice of that right.
The statute demands affirmative authorization only for a person the business knows to be under 16. Section 1798.100(a) also bars using data for a purpose that clashes with the one disclosed at collection, unless there is fresh notice.
That points you back to your employee notices. Pull the versions staff received when they joined. Then compare them with a license to an AI buyer.
Is employee consent enough in the EU or UK?
Recital 43 of the GDPR says consent should not be a valid legal ground where there is a clear imbalance between the person and the controller. The UK ICO adds that freely given consent is harder to get when one side holds the power, "particularly for public authorities and employers."
Article 88 lets member states and collective agreements add employee-specific rules. Our EU employee data page covers the GDPR checks that come before consent.
What do buyers and counsel say about consent?
Daniel Goldberg, a partner at Frankfurt Kurnit, says in his article that for data collected going forward, a company can update notices. Where it fits, the company can also ask for opt-in consent.
SimpleClosure's terms have the owner state two things. It gave all required notices to the people whose data sits in the assets. It also got all required consents from them. The named groups are employees, contractors, customers, investors and vendors. The warranty puts the burden on the owner, as our reps and warranties page shows.
What about employee messages about pay or working conditions?
Federal labor law sits outside the consent question. Goldberg notes that employee messages about pay, scheduling and working conditions may be protected concerted activity under Section 7 of the National Labor Relations Act.
That holds with or without a union. Our employee email page covers that layer.
What should you bring to counsel?
Bring a headcount by state and country, the dated privacy notices and handbooks, any union agreement and the buyer's terms for owners.
Our rights check asks whether staff messages are included and whether a policy covers them. The risks page lists where deals have drawn objections.
Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
