All processing of personal data must be justified by one of the legal bases set out in the law. This is true under the current data protection regime and under the GDPR. The GDPR is more prescriptive than the current regime when it comes to obtaining valid consent. There are already significant question marks over whether you can validly obtain consent from employees. That is even more so under the GDPR.
In our view, consents to data processing in employment contracts will not be effective. Please see our infographic for more on this.