Today, it is well established that worker and consumer data are sold as goods[1] in digital value chains controlled by data monopolies and used for the purpose of predictive analytics and automated decisions. Critically, algorithms power the collection and processing of such data while needing to feed on large datasets to train themselves in a kind of (in)virtuous cycle. This means that privacy is exponentially at risk, sometimes becoming locked into the mechanisms of value capture.[2] While foregrounding that the right to privacy is not an economic good,[3] data regulation debates are increasingly concerned with the risks associated with the use of algorithms in automated decision-making (ADM), such as applied in the ranking and selection of job seekers through profiling.[4] The EU 2018 General Data Protection Regulation (GDPR) is ground-breaking[5] in addressing both the processing of personal data and automated decision-making (ADM) (including profiling).[6] As the UK exits the EU, there remains a question as to whether the rights and safeguards inscribed in the GDPR will be preserved. What forms of digital governance, individual and collective, should be retained and advocated for?

The recent A-level grading algorithm scandal is an alarming example of the discriminatory potential of ADM while at the same time exemplifying the potential safeguarding power of data regulation.[7] When the GDPR became law in all EU member states in May 2018, the UK Data Protection Act (DPA) was amended to reflect this.[8] The GDPR remains in force in the UK until at least 31 December 2020, the end of the UK transition period in exiting the EU. The UK government has published its ‘Keeling schedules’ indicating planned amendments to the Data Protection Act (DPA) and a ‘UK GDPR’ under new regulations (subject to parliamentary approval).[9] According to the Information Commissioner’s Office (ICO) “key principles, rights and obligations will remain unchanged,” while there will be implications for the transfer of personal data between the UK and the European Economic Area (EEA).[10] However, amendments to the DPA will require attentive scrutiny from policy makers and advocacy and research organisations in order to ensure that the current data rights of UK citizens and residents, as enshrined in the GDPR, be preserved.

In a data-driven economy,[11] almost every aspect of employment is affected by the collection and processing of data. From recruitment, to workplace monitoring, to work exiting.[12] Techniques used to profile consumers have infiltrated the world of work to track, profile, and score employees.[13] Beyond digital surveillance,[14] the datafication of employment has fuelled excessive capital gains made from the rent of worker data, [15] especially behavioural insights used for statistical predictions.[16]  In a ‘scored society’,[17] algorithms have become powerful tools. The convergence of Big data analytics with machine learning (ML) has ushered an age of ‘algorithmic governance.’[18] Besides tracking productivity, algorithms now can interview, filter and ‘select’ job seekers, predict attrition rates and even ‘signal’ possible dismissal.[19]

While individuals are now given the opportunity to choose how their data is handled, for instance online via cookies preferences, they may not be informed about how private companies will create digital profiles[20] from their data footprints. Profiles can then be used for future inferences about them (such as political affiliation, gender, race) or to make ‘decisions’ about access to services both in the private and public sectors (such as bank loans, insurance policies, or state services).[21]

Algorithm-led processes and decisions potentially expose job seekers, workers and consumers to discriminatory effects. These are often caused by historical data (i.e. the data on which algorithms are trained) reflecting existing societal bias[22] or algorithms inferring data through correlations (such as deducting race from postal codes).[23] Hence, even if it is prohibited to collect information about trade union membership, religion, gender, sexual orientation or disability, these can be inferred through pattern recognition.[24]

In this environment of extreme data-extraction and – arguably – overdependency, how can existent GDPR legislation help? There is a common assumption that GDPR is relevant predominantly when interacting with websites’ privacy notices or mailing list subscriptions; but its real value lies in the protections it can offer individuals from the influence of data-driven decision-making. The latter has been identified as the most pressing issue at the heart of AI-based automation’s reach in society.[25] In the EU, the range and scope of applications of automated decisions are such that they affect almost all fields of life, from healthcare services allocation, to welfare fraud detection, recruitment, predictive policing, to border control.[26]

The GDPR offers protections from automated decision-making in the form of what can be referred to as a ‘right to object’ or ‘right to contest’ (Article 22) and a ‘right to explanation’ (Articles 13-15).[27] Article 22(1) of the GDPR establishes the right for a person ‘not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.’[28] Importantly, the Article 29 Working Party (WP29)[29] insisted that trivial human intervention will not count as significant.[30] Critically, as Wachter et al. point out, data subjects are granted ‘rights to express their views, contest decisions, and obtain human intervention on the part of data collectors.’[31] GDPR allows us to assess and challenge ADM and profiling based on inferences.[32]

The datafication of employment is inscribed in a value chain where data accumulated about workers to produce behavioural, predictive insights are owned and sold by data collectors. This sets up an ever increasing ‘informational asymmetry’ in the employment relation[33] and establishes inequitable terms for data ownership, analysis, and use, that have become the ‘norm’: the concentration of data control and monetisation in the hands of data collectors and digital dispossession for others (workers and users).

Digital inequity is now coupled with automated processes that make workers more defenceless as accountability for such processes can be difficult to ascertain. This is due to the fact that algorithms are privately developed and ‘black-boxed,’ i.e. shrouded in secrecy,[34] while their operations may be too opaque to non-experts. Of concern, for instance, is the practice of profiling job seekers, which leads to automated scoring and filtering.[35] A candidate may be denied an interview based on bias inscribed in the data.[36] Scoring may also be used to exclude workers from access to work on digital platforms.[37] While Article 22(1) does not explicitly refer to the employment relation, it can be deemed applicable to it,[38] where personal data processing is concerned.

Interestingly, there are exceptions to the prohibitive power of ‘the right to object’ in the GDPR legislation: the need to fulfil a contract; if authorised by the EU member law; or in the case of consent given by the data subject (and only if the ADM will not be based on the process of protected data).[39] In such cases, certain safeguards for data subjects must apply, including ‘the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.’[40] While consent may seem empowering for consumers/users, the legal value of consent in the context of employment has been questioned. In its guidance on consent, the WP29 points out that given the power imbalance of the working relation, ‘the granting of consent’ by the employee should not be deemed valid.[41] As Ajunwa et al. observe, notice-and-consent mechanisms ‘merely serve as a sanitizing seal of approval for employer surveillance’ [42] and consequently for asymmetrical data collection. In this way, just as it tries to provide protections suitable to the datafication of work, GDPR legislation reveals something intractable about the employment relationship itself: consent in this context is tainted by the coercion that comes with the ‘private government’ and labour market imperative that is waged work.[43] There is, we might say, no true autonomy of will in the act of consent at work.[44]

Consent – and its troubled relationship with modern work – may therefore be one of the most critical and contentious areas to reform, through, for instance, an amendment to the (UK) GDPR that would relate specifically to the employment relation. What new capacities might this unlock for employees to push back against the increasingly granular surveillance that many workplaces are adopting? A 2018 TUC survey of over two thousand workers found that 70% believed that surveillance will become more common in the future and two-thirds of workers (66%) believed that unless it is properly regulated, such technology could be used to discriminate unfairly. Very few workers (38%) said that they would be able to challenge workplace monitoring. If these fears are born out by reality, then appropriate mechanisms of resistance must be formulated.

Better awareness of the safeguards and rights afforded by the GDPR must therefore be widely promoted among the working and wider population in order to counter the opaqueness of firm-level data gathering. Workers (and consumers) need to be empowered by the knowledge that such legislation grants them the right to know how their personal data is used and to challenge its processing for the purpose of profiling or that of automated decisions. GDPR – as limited as it may be – grants workers valuable rights and protections in the face of the datafication of employment while their bargaining power regarding the yielding of privacy by consent requires additional safeguards. In the context of a UK exit from the EU, policy makers, and advocacy and research organisations must ensure existent rights are protected and advanced.

Armelle Skatulski is a doctoral researcher at the Royal College of Art. Her research considers the (work) accident as an economic problem from a bio- political perspective and traces procedures that disqualify the abnormality of death in the context of work. As part of her partnership with Autonomy, Armelle will research processes leading to the expansion and normalisation of work casualisation and precarity in the contemporary workplace.