The regulation treats a clear imbalance between the person and the controller as making free consent unlikely, and an employer is the standard example.
Why it matters when the plan changes
Employers reach for consent because it feels respectful and is easy to administer. The regulation treats it with suspicion in exactly this setting, because Recital 43 of the General Data Protection Regulation identifies a clear imbalance between the data subject and the controller as the reason free consent is unlikely, and an employment relationship is the standard example of that imbalance. Processing that rests on it is exposed the moment a participant withdraws or complains.
The tension is that legitimate interest is more durable and less comfortable. Article 6 of the same Regulation allows processing on this ground except where it is overridden by the interests or fundamental rights of the person, which obliges the employer to write down that its interest in assessing people outweighs those people's interest in not being assessed, and to make that reasoning available for challenge. Many organisations prefer the weaker basis because the stronger one requires saying the uncomfortable thing aloud.
In practice
A leadership team is assessed under a consent form. One member later declines to be included in a reforecast and asks for the earlier data to be removed. Because the basis was consent, the request is hard to refuse, and the reforecast now compares a team of eight with a team of seven. A documented legitimate interest, with the employee's rights to object recorded, would have carried the same processing on defensible ground.
Evidence
Consent is unlikely to be freely given where there is a clear imbalance between the person and the controller.
Recital 43, General Data Protection Regulation (2016)Legitimate interest applies except where it is overridden by the interests or fundamental rights of the person.
Article 6, General Data Protection Regulation (2016)
What it cannot tell you
This distinction identifies which legal ground applies; it does not tell an employer whether the processing itself is proportionate, necessary or fair. Choosing legitimate interest over consent removes one obstacle but leaves the balancing test, data minimisation and the employee's right to object all still to be satisfied.
Questions
Occasionally, where refusing carries no plausible cost to the person and the employer can show that. An optional programme with no bearing on standing may qualify. Assessment that feeds decisions about roles, promotion or succession rarely does, because the employee cannot decline without consequence.
A written record showing the employer's interest, why the processing is necessary, and why that interest is not overridden by the rights of the people affected, as Article 6 of the General Data Protection Regulation (2016) requires. It accounts for reasonable expectations and safeguards, and is kept before processing for inspection.
Yes. The right to object applies, and the employer must then show compelling grounds that override the objection or stop the processing for that person. Recording how objections are handled is part of what makes the basis defensible rather than a label.
Because it feels respectful, is easy to administer, and avoids writing down the sentence that the employer's interest outweighs the employee's. Recital 43 of the General Data Protection Regulation (2016) already treats consent in this setting as suspect, and the comfort is short-lived once a participant withdraws during a live decision.
Yes. The regulation sets the frame, and member states add national employment rules, consultation rights and in some cases specific provisions on testing. The balancing test has to be done against the national picture, which is why the same processing can need different groundwork in two neighbouring countries.