European UnionPlatform Work Directive, Limits on Processing Personal Data by Automated Monitoring and Decision-Making Systems (Article 7(1)(a) to (e), (2) and (3))
Directive (EU) 2024/2831, Art. 7(1)(a)-(e), (2) and (3)
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition
As of .
What it requires
- This duty takes effect on , the date by which Member States must bring into force the laws, regulations and administrative provisions necessary to comply with the Directive (Article 29(1)).
- This Directive is addressed to the Member States (Article 32), which must bring into force the laws, regulations and administrative provisions necessary to comply with it by (Article 29(1)), so a digital labour platform meets these rules through each Member State's transposing law.
- If you are a digital labour platform, do not, by means of an automated monitoring system or an automated decision-making system, process any personal data on the emotional or psychological state of a person performing platform work (Article 7(1)(a)).
- Do not, by means of such a system, process any personal data in relation to private conversations, including exchanges with other persons performing platform work and the representatives of persons performing platform work (Article 7(1)(b)).
- Do not, by means of such a system, collect any personal data of a person performing platform work while that person is not offering or performing platform work (Article 7(1)(c)).
- Do not, by means of such a system, process personal data to predict the exercise of fundamental rights, including the freedom of association, the right of collective bargaining and action or the right to information and consultation as laid down in the Charter of Fundamental Rights of the European Union (Article 7(1)(d)).
- Do not, by means of such a system, process any personal data to infer the racial or ethnic origin, migration status, political opinions, religious or philosophical beliefs, disability, state of health, including chronic disease or HIV status, emotional or psychological state, trade union membership, sex life or sexual orientation (Article 7(1)(e)).
- Apply these limits to every person performing platform work from the start of the recruitment or selection procedure, and to automated systems that take or support decisions affecting persons performing platform work in any manner, not only to systems described as monitoring or decision-making systems (Article 7(2) and (3)).
If you get it wrong
Penalty structure
Article 24(1), second sentence, of Directive (EU) 2024/2831 makes the upper limit for administrative fines referred to in Article 83(5) of Regulation (EU) 2016/679 applicable to infringements of Articles 7 to 11 of the Directive, which is EUR 20,000,000 or, for an undertaking, 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, imposed by the supervisory authorities responsible for that Regulation (Article 24(1), first sentence). The Directive does not print the amount, so the pin sits on Article 83(5) of Regulation (EU) 2016/679. The fine is coded for Article 7(1), points (a) to (e), (2) and (3) only; Article 24(5) leaves the penalties for other national provisions to the Member States.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The supervisory authority or authorities responsible for monitoring the application of Regulation (EU) 2016/679, which are also responsible for monitoring and enforcing Articles 7 to 11 of the Directive as far as data-protection matters are concerned (Article 24(1)); those authorities and the other national competent authorities cooperate in the enforcement of the Directive (Article 24(2)).
What this law does
Article 7(1), points (a) to (c), provides that digital labour platforms shall not, by means of automated monitoring systems or automated decision-making systems, process any personal data on the emotional or psychological state of a person performing platform work, process any personal data in relation to private conversations, or collect any personal data of a person performing platform work while that person is not offering or performing platform work.
Article 7(1), points (d) and (e), adds that they shall not process personal data to predict the exercise of fundamental rights, including the freedom of association, the right of collective bargaining and action or the right to information and consultation as laid down in the Charter, or process any personal data to infer the racial or ethnic origin, migration status, political opinions, religious or philosophical beliefs, disability, state of health, including chronic disease or HIV status, emotional or psychological state, trade union membership, sex life or sexual orientation.
Article 7(2) applies Article 7 to all persons performing platform work from the start of the recruitment or selection procedure, and Article 7(3) applies it also where digital labour platforms use automated systems taking or supporting decisions that affect persons performing platform work in any manner.
Article 1(2) states that the Directive provides measures on algorithmic management applicable to persons performing platform work in the Union, including those who do not have an employment contract or employment relationship. Article 2(1), point (c), defines a person performing platform work as an individual performing platform work, irrespective of the nature of the contractual relationship or the designation of that relationship by the parties involved.
Article 2(1), point (a), defines a digital labour platform as a natural or legal person providing a service that is provided, at least in part, at a distance by electronic means, at the request of a recipient of the service, that involves the organisation of work performed by individuals in return for payment as a necessary and essential component, and that involves the use of automated monitoring systems or automated decision-making systems.
Article 2(2) provides that the definition of a digital labour platform does not include providers of a service whose primary purpose is to exploit or share assets or by means of which individuals who are not professionals can resell goods. Article 1(3) applies the Directive to digital labour platforms organising platform work performed in the Union, irrespective of their place of establishment or of the law otherwise applicable.
Article 8(1) provides that the processing of personal data by a digital labour platform by means of automated monitoring systems or automated decision-making systems is a type of processing which is likely to result in a high risk to the rights and freedoms of natural persons within the meaning of Article 35(1) of Regulation (EU) 2016/679.
Recital 39 states that digital labour platforms should not process the personal data of persons performing platform work on the basis that the person has given consent to the processing of his or her personal data.
Article 24(1) makes the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 also responsible for monitoring and enforcing Articles 7 to 11 as far as data-protection matters are concerned, and applies the upper limit for administrative fines referred to in Article 83(5) of that Regulation to infringements of Articles 7 to 11.
Article 24(5) requires Member States to lay down the rules on penalties applicable to infringements of the national provisions adopted pursuant to the Directive, and the penalties must be effective, dissuasive and proportionate to the nature, gravity and duration of the undertaking's infringement and to the number of workers affected.
Article 29(1) requires Member States to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.