Article 88 lets each member state write its own rules for employee data, which is why the answer changes at the border.
Why it matters when the plan changes
Assessment, feedback and performance data are among the most sensitive things an employer holds, and the person they describe has the least freedom to refuse. Recital 43 treats a clear imbalance between the data subject and the controller as reason enough to doubt that consent is freely given, which is exactly the position of an employee asked to agree to being assessed. That is why works councils, unions and national regulators take a particular interest in anything that evaluates people systematically.
The tension is between one product and many jurisdictions. Article 88 allows member states to add more specific rules by law or collective agreement, so a supplier builds once while an employer operates under national employment law that may layer notification, consultation or outright prohibition on top of the regulation. The same processing can be routine in one country and require works council agreement in the next, and a rollout plan that ignores that difference will stall.
In practice
A group rolls out a behavioural assessment for leadership teams across five countries on a single consent form. In two of them the works council has co-determination rights over the questionnaire and the consent is treated as not freely given. The programme pauses in those two while the basis is reworked, having been designed for the country where it was easiest.
Evidence
Member states may lay down more specific rules for processing employees' personal data in the employment context.
Article 88, General Data Protection Regulation (2016)Consent is unlikely to be freely given where there is a clear imbalance between the person and the controller.
Recital 43, General Data Protection Regulation (2016)
What it cannot tell you
Article 88 does not create a single European standard for employee data; it authorises member states to diverge. The regulation itself is silent on what those national rules will say, so knowing that Article 88 applies tells you nothing about whether consultation, notification or prohibition awaits in a given country.
Questions
Not as such. Special categories are things like health, trade union membership and biometric data, which can appear inside employee records and carry their own rules. Ordinary assessment data is ordinary personal data, processed in a context where the person has limited freedom to refuse, which is what shapes the rules around it.
Consent must be freely given, and Recital 43 of the General Data Protection Regulation (2016) treats a clear imbalance between the data subject and the controller as grounds to doubt that. An employee asked to consent to an employer's assessment sits inside exactly that imbalance, so other lawful bases, with safeguards, are usually the defensible route.
National rules typically add consultation or agreement rights for employee representatives, limits on recruitment data collection, and monitoring provisions. Article 88 of the General Data Protection Regulation (2016) permits member states to legislate exactly these additions by law or collective agreement, which is why a rollout has to be checked country by country before it launches.
The employer, as controller. A supplier processing on the employer's behalf is responsible for its own security, sub-processing and instructions, but the purposes, the legal basis and the national employment rules are the employer's to establish. Procurement often assumes otherwise until the data protection officer asks.
Yes. The right of access applies to assessment results as it does to any other personal data about the person, subject to limited exceptions. Designing so the individual receives their own results by default removes most of the friction that access requests otherwise create.