COGNITIVE DATA OWNERSHIP IN EMPLOYMENT LAW

Introduction

Cognitive data ownership in employment law refers to the legal rights and control associated with information generated from or about an employee’s mental or cognitive activity. It may include brain-activity information, attention levels, emotional responses, fatigue indicators, memory-related information, behavioural patterns, keystroke patterns, eye movements, voice characteristics, productivity analytics, and information inferred through artificial intelligence from an employee’s behaviour.

Modern workplaces increasingly use wearable devices, AI-based monitoring systems, neurotechnology, productivity software, biometric systems and employee analytics. These technologies create difficult legal questions regarding whether cognitive information belongs to the employee, employer, technology provider, or nobody exclusively.

Traditional employment law generally does not treat personal data simply as an employer-owned asset. Instead, modern data-protection principles focus on lawful processing, purpose limitation, necessity, proportionality, transparency, security, retention and the rights of the data subject. The CJEU has emphasized that employee-data processing must satisfy applicable data-protection requirements even where processing is authorised by employment-related rules or collective agreements. MK v K GmbH, Case C-65/23, is particularly relevant to this principle.

Meaning of Cognitive Data

Cognitive data can broadly be divided into the following categories:

Direct cognitive data – information directly measuring brain or neurological activity.

Biometric information – facial, voice, fingerprint, eye or other biological characteristics capable of identifying an employee.

Behavioural data – typing patterns, mouse movements, speech patterns and interaction patterns.

Emotional data – inferred stress, attention, fatigue, mood or emotional responses.

AI-inferred cognitive information – predictions concerning concentration, personality, productivity, honesty or mental state.

Work-performance analytics – information generated by workplace systems concerning attention, response time, decision-making or work patterns.

The legal problem becomes particularly serious when an employer uses such information not merely to manage work but to make decisions concerning recruitment, promotion, discipline, dismissal, compensation or workplace surveillance.

Concept of Ownership

The term “ownership” must be distinguished from control or lawful processing rights.

An employer may own the physical equipment through which cognitive information is collected, but ownership of the equipment does not automatically give the employer unrestricted rights over the employee's personal information.

For example, an employer may own a workplace computer or wearable device, but this does not necessarily mean that every piece of personal or behavioural information generated through that device becomes the employer's unrestricted property.

The more appropriate legal approach is therefore to ask:

Who collected the data?

What is the purpose of collection?

Was the employee informed?

What legal basis permits processing?

Is the collection necessary?

Is the information sensitive?

How long may it be retained?

Who can access it?

Can it be transferred to third parties?

Can it be used for disciplinary or employment decisions?

Can the employee obtain, correct or challenge the information?

Employee Privacy and Cognitive Data

Cognitive information can be considerably more intrusive than ordinary employment records because it may reveal aspects of a person's personality, emotional condition, habits, preferences or mental activity.

The European Court of Human Rights has recognized that employees retain privacy interests in the workplace. In Bărbulescu v. Romania, Application No. 61496/08 (2017), the Grand Chamber considered workplace monitoring of an employee's electronic communications and held that domestic courts had to properly balance the employee's privacy interests against the employer's interests.

The case demonstrates that ownership of workplace equipment or communication systems does not automatically eliminate an employee's expectation of privacy.

This principle is highly relevant to cognitive monitoring. An employer cannot necessarily argue that because a device belongs to the employer, all cognitive information produced through that device is automatically employer-owned.

Sensitive Nature of Cognitive Information

Some forms of cognitive data may fall within categories of particularly protected information under data-protection legislation.

Under Article 9 of the GDPR, biometric data used for unique identification and health-related information are subject to special protection, with processing generally prohibited unless a specified exception applies. Employment-related processing of sensitive data may require a specific legal basis and appropriate safeguards.

Consequently, an employer collecting neurological or biometric information cannot necessarily rely upon a general employment-policy clause.

The employer must consider whether the information falls within a protected category and whether the particular processing is necessary and legally justified.

Case Law

1. Bărbulescu v. Romania, Application No. 61496/08 (ECtHR, 2017)

The employee's workplace communications were monitored by his employer. The Grand Chamber emphasized the need for safeguards and a proper balancing of workplace interests and employee privacy.

Principle: Workplace monitoring must respect employee privacy and cannot automatically be justified merely because the employer owns the workplace system.

Relevance: Cognitive monitoring systems should be transparent, proportionate and limited to legitimate employment purposes.

2. López Ribalda and Others v. Spain, Applications Nos. 1874/13 and 8567/13 (ECtHR, 2019)

The case concerned covert video surveillance of employees in a workplace. The Court considered the circumstances in which employers could undertake surveillance while balancing employees' privacy rights against legitimate employer interests.

Principle: Employee surveillance must be assessed against privacy rights, legitimate purposes and proportionality.

Relevance: Secret monitoring of cognitive behaviour, emotional responses or productivity would raise similar concerns.

3. Antović and Mirković v. Montenegro, Application No. 70838/13 (ECtHR, 2017)

The case concerned video surveillance in university premises. The Court recognized that privacy interests can arise even in professional environments.

Principle: The workplace or professional environment does not automatically remove the individual's right to private life.

Relevance: An employee may retain privacy interests in cognitive or behavioural information even when monitoring occurs at work.

4. MK v K GmbH, Case C-65/23 (CJEU, 19 December 2024)

The CJEU considered employee personal-data processing in the context of workplace software and German employment rules. It emphasized that employment-related processing must comply with the requirements of the GDPR, including the principles governing lawful processing and sensitive data.

Principle: Employment arrangements and collective agreements do not create an unrestricted power to process employee data.

Relevance: An employer using AI or neurotechnology to collect cognitive information must still satisfy data-protection requirements.

5. V.S., Case C-205/21 (CJEU, 26 January 2023)

The CJEU considered the collection of biometric and genetic information and stressed requirements including purpose limitation, data minimisation and strict necessity for intrusive processing.

Principle: Particularly intrusive personal-data processing must satisfy strict necessity and cannot be justified merely through generalised collection.

Relevance: Employers should not collect extensive cognitive or neurological information simply because technology makes collection possible.

6. JH v Policejní prezidium, Case C-57/23 (CJEU, 20 November 2025)

The CJEU addressed collection, storage and erasure of biometric and genetic information and emphasized requirements concerning minimisation, storage limitation and legal clarity.

Principle: Highly sensitive biometric information requires clear legal rules concerning collection, storage and deletion.

Relevance: Cognitive-data systems should have clearly defined retention periods and deletion procedures.

7. K.S. Puttaswamy (Retd.) v Union of India, (2017) 10 SCC 1

The Supreme Court of India recognized privacy as a fundamental right under the Constitution. The judgment established privacy as encompassing important aspects of personal autonomy, dignity and informational privacy.

Principle: Individuals have constitutional interests in controlling information concerning themselves.

Relevance: In jurisdictions recognizing informational privacy, employee cognitive information cannot automatically be treated as an unrestricted corporate asset.

8. R. Rajagopal v State of Tamil Nadu, (1994) 6 SCC 632

The Supreme Court of India recognized important principles concerning the individual's right to privacy.

Principle: Privacy protects important aspects of personal life and information from unjustified interference.

Relevance: Cognitive information revealing intimate behavioural or personal characteristics may attract strong privacy protection.

Ownership Versus Employer's Legitimate Interest

An employer may have legitimate reasons for collecting limited cognitive or behavioural information.

Examples include:

workplace safety;

fatigue prevention;

occupational health;

cybersecurity;

fraud prevention;

authentication;

productivity management;

safety-critical work;

compliance with legal obligations.

However, the existence of a legitimate business interest does not automatically establish ownership of all collected information.

The employer should demonstrate that the processing is:

legally authorised;

necessary;

proportionate;

transparent;

limited to a defined purpose;

securely stored; and

appropriately deleted when no longer required.

Cognitive Data and Employment Decisions

A particularly important issue arises when cognitive data is used for:

recruitment;

promotion;

performance evaluation;

disciplinary action;

dismissal;

compensation;

employee ranking;

productivity scoring.

For example, an AI system might classify an employee as “low attention,” “high stress,” or “poor decision-maker.” Such classifications may be inaccurate or based upon opaque algorithms.

An employer should not automatically treat an AI-generated cognitive assessment as objective fact.

The employee should have an opportunity to:

know that the assessment was made;

understand its relevant basis;

challenge inaccurate information;

request correction where applicable;

contest adverse employment decisions based upon unreliable data.

Employer Liability for Misuse

An employer may face legal consequences where cognitive information is:

collected without a lawful basis;

secretly monitored;

used for an unrelated purpose;

disclosed to unauthorised persons;

sold or transferred improperly;

retained indefinitely;

used to discriminate;

used to make automated employment decisions without appropriate safeguards;

inadequately protected against cybersecurity breaches.

The employer may also face contractual, statutory, constitutional, labour-law or data-protection liability depending upon the jurisdiction.

Third-Party Technology Providers

Modern employers frequently obtain cognitive analytics from third-party technology companies.

This creates an additional ownership problem.

For example:

Employee → Employer → AI Provider → Cloud Provider

The employee's cognitive information may pass through several organisations.

The employment contract should therefore identify:

the categories of information collected;

the purpose of collection;

the technology provider;

data-access rights;

retention periods;

international transfers;

security obligations;

deletion requirements;

restrictions on secondary use;

responsibilities after termination.

A technology provider should not automatically receive unrestricted commercial rights over employee cognitive information merely because it supplies the monitoring technology.

Post-Employment Cognitive Data

The termination of employment does not necessarily eliminate all employee rights concerning previously collected personal information.

The employer should determine whether continued retention is legally necessary.

For example, retaining cognitive-monitoring records indefinitely merely because they were once collected may conflict with storage-limitation principles.

Therefore, employment termination policies should include a clear procedure for:

identifying retained cognitive information;

determining the legal reason for retention;

deleting information no longer required;

preserving information only where legally justified; and

preventing secondary commercial use.

Trade Secrets and Cognitive Data

Employers may argue that analytics generated from employee activity constitute confidential business information.

However, this should be distinguished from personal information about the employee.

For example, an employer may legitimately protect an algorithm used to analyse productivity, while the employee may retain privacy and data-protection rights regarding the personal information used by that algorithm.

Thus, trade-secret protection does not necessarily eliminate employee privacy rights.

Consent and Cognitive Data

Employee consent requires particular caution because employment relationships often involve unequal bargaining power.

A worker may technically agree to monitoring because refusal could affect employment opportunities.

Consequently, an employer should not assume that a generic clause such as “the employee consents to all monitoring” automatically legitimizes extensive cognitive-data processing.

The legal validity of consent depends upon the applicable jurisdiction and circumstances, and other lawful bases may be relevant.

Data Minimisation

The principle of data minimisation is especially important.

If an employer only needs information showing whether a worker is dangerously fatigued, it may not need continuous neurological recordings.

Similarly, if workplace safety can be achieved through less intrusive information, collecting detailed cognitive profiles may be disproportionate.

The principle can therefore be expressed as:

Collect the minimum information necessary for the legitimate employment purpose.

Right to Challenge Cognitive Profiling

Employees should be able to challenge inaccurate cognitive profiles.

For example, an algorithm may interpret:

slow typing as lack of productivity;

reduced facial expression as disengagement;

pauses as distraction;

speech characteristics as emotional instability;

eye movement as lack of attention.

Such conclusions may be scientifically uncertain or context-dependent.

Employment decisions based on these conclusions may therefore create disputes concerning procedural fairness, discrimination, privacy and evidentiary reliability.

Legal Position in Emerging Cognitive-Data Regulation

There is currently no universal legal rule declaring that all cognitive data is exclusively “owned” by the employee.

The stronger modern legal approach is to treat cognitive information as a form of personal information subject to privacy, data-protection, autonomy and employment-law safeguards.

Accordingly, the legal relationship is better described as:

Employee → personal and privacy interests

Employer → limited lawful processing rights

Technology provider → contractual/data-processing obligations

Regulator/Court → supervisory and remedial authority

This approach avoids treating human cognitive information as an ordinary corporate commodity.

Conclusion

Cognitive data ownership is an emerging employment-law issue created by artificial intelligence, workplace surveillance, biometric technology, wearable devices and neurotechnology.

The central legal question is not simply “Who owns the data?” but rather “Who may collect, control, use, transfer, retain and commercially exploit the data, and under what legal conditions?”

Modern case law concerning employee monitoring and sensitive personal information demonstrates that an employer's ownership of workplace equipment does not automatically eliminate employee privacy rights. Bărbulescu v. Romania illustrates the importance of balancing employee privacy with legitimate employer interests, while MK v K GmbH demonstrates that employment-related data processing remains subject to data-protection requirements.

Therefore, cognitive data should generally be governed through lawful purpose, necessity, proportionality, transparency, data minimisation, security, retention limits and employee rights, rather than being treated as an unrestricted property right of the employer.

Key Case Laws

Bărbulescu v. Romania, App. No. 61496/08, ECtHR (2017).

López Ribalda and Others v. Spain, Apps. Nos. 1874/13 & 8567/13, ECtHR (2019).

Antović and Mirković v. Montenegro, App. No. 70838/13, ECtHR (2017).

MK v K GmbH, Case C-65/23, CJEU (2024).

V.S., Case C-205/21, CJEU (2023).

JH v Policejní prezidium, Case C-57/23, CJEU (2025).

K.S. Puttaswamy (Retd.) v Union of India, (2017) 10 SCC 1.

R. Rajagopal v State of Tamil Nadu, (1994) 6 SCC 632.