In brief
The latest edition of our HR Privacy and Workplace AI Newsletter explores interesting cases, enforcement action, legal developments and news in the EU, Germany, Italy, Spain and the UK.
In this edition
We have included a summary of the updates below but please click here for the full newsletter.
EU: No right of access for “GDPR Hopper”
The Court of Justice of the European Union has clarified important limits to a data subject’s right of access and related damages claims and even a first data subject access request can be refused as “excessive” in some circumstances.
EU: 2026 HR data privacy and workplace AI developments to watch – an update
We provide an update on revisions to AI Act compliance deadlines for high-risk AI systems and draft European Commission guidelines on determining whether an AI system should be classified as high risk.
Germany: No lawful processing of data based on legitimate interest without proper information
The German Federal Administrative Court has confirmed that a controller can only invoke “legitimate interests” as a lawful basis for processing personal data if it has properly informed the data subject of those interests.
Germany: No compensation following cyberattack without proven damage or violation
The Regional Labor Court of Hesse dismissed a claim for non-material damages notwithstanding a large-scale cyberattack involving employee data.
Germany: Successful defence against compensation claims despite substantial data breach
The Brandenburg Higher Regional Court sets important limits on compensation claims despite a substantial data breach.
Italy: Data Protection Authority issues warning on AI-based sentiment analysis in the workplace
The Italian Data Protection Authority (Garante) recently issued a warning decision concerning the use of an AI-powered plugin designed to perform sentiment analysis on employees’ communications in workplace messaging platforms.
Spain: Spanish Data Protection Authority fines company EUR 200,000 for forcing work apps on employees’ personal phones
The Spanish Data Protection Authority (AEPD) has fined a company for requiring its drivers to install on their personal mobile phones work-related applications which collected data beyond what was needed for their driving duties.
Spain: Video surveillance evidence could be relied on in disciplinary dismissal for theft
The Supreme Court confirmed that CCTV footage can potentially be used as evidence in disciplinary proceedings where it captures the flagrant commission of a serious unlawful act, provided the cameras are visible, appropriate signage is in place, and the measure meets the usual standards of justification, necessity and proportionality.
UK: The Data (Use and Access) Act 2025: dealing with data protection complaints
Data subjects have a new statutory right to complain directly to data controllers if they consider that there has been a breach of the UK GDPR in relation to their personal data. We look at the key compliance obligations on data controllers and the provisions of the related Information Commissioner's Office (ICO) guidance.
UK: AI in recruitment - The ICO’s new “Recruitment rewired” guidance
Changes brought into force by The Data (Use and Access) Act 2025 in February 2026 were aimed at broadening the ability to use automated decision making and reducing the compliance burden on organisations. However, the ICO’s recent guidance on the use of AI in recruitment appears to take a much narrower approach to AI tools.
UK: Government consults on future regulation of workplace monitoring technologies
The UK government recently launched a consultation on workplace monitoring technologies (WMT) seeking views on whether further intervention is needed to promote the fair, transparent and responsible use of technologies that monitor, manage or make decisions relating to workers. A key theme is the advantages of engaging with workers in this space, and whether employers should be required to do so before deploying WMT.
For specific advice on any developments covered in this update, please get in touch with your usual Baker McKenzie contact.