> GDPR does have some carveouts for workplaces Can you point me to any? IMHO it does not have any explicit clauses mentioning more lax conditions for consent

> GDPR does have some carveouts for workplaces Can you point me to any? IMHO it does not have any explicit clauses mentioning more lax conditions for consent in case of employment relationships, and there have been multiple cases of GDPR enforcement re-asserting that anything that you require from all employees doesn't count as consent. An employer might assert a "legitimate need" basis for processing (in which case you need to only inform the employee, not their consent), but that is inherently limited and there have been large fines assessed for employees trying to push constant monitoring with this justification; the employer has a duty to minimize the invasiveness of achieving that legitimate need (e.g. surveillance for theft prevention can monitor only places relevant for that, and doesn't permit using the same videos for any other purpose e.g. measuring employee activity).