(43) To ensure voluntariness, consent should not be a valid legal basis for the processing of personal data in a particular situation where there is a clear imbalance between the data subject and the controller, particularly where the controller is a public authority and therefore consent is unlikely to be given voluntarily in all cases in that particular situation. Consent is not considered voluntary if it cannot be given separately for various personal data processing operations, even though it would be appropriate to do so in a particular case, or if the performance of a contract - including the provision of a service - depends on consent, even though consent is not necessary for its performance.
„GDPR covers one of our employees, it's just a few documents"
Are you sure about that?

