Data Protection Rights in Employment Relations

GDPR does not prohibit oral consent but requires sufficient documentation (Article 7(1) of GDPR) to demonstrate that Ieva gave the consent. However, it will fall upon the data controller to document and, in case of dispute, to prove that the consent was given (Recital 42 Burden of proof and requirements for consent).
When it comes to labour disputes, the legislator is guided by the principle that the employee is the weakest party in the employment relationship; the employer is “stronger” because he has more resources, can hire different experts, and pays the employee a salary. So because of this
imbalance of power, I would view the case favouring Ieva.
Contacting Ieva’s previous employer
In my opinion, the employer had a legitimate reason to get the previous employer to verify Ieva’s abilities, knowledge and experience. Ieva had given consent to contact the previous employer. As the employer obtained oral consent but did not document it, and he cannot prove that such consent existed in the first place, my opinion is that the processing of personal data was unlawful.
Contacted Ieva’s high school principal
The task does not specify how long it has been since graduating from high school. However, my subjective opinion - a person's characteristics from high school is unlikely to describe a person today accurately. Not only did the employer go beyond the scope of consent, but in my view, he had no legal basis for gathering information about Ieva's characteristics in high school. Therefore, data processing in this instance was also unlawful.…