Workplace surveys aren't ATM, which is good because ATM wouldn't be permissible in a workplace context.
The GDPR's concept of automated decision making (ADM) refers to decisions that are based solely on automated processing or profiling (without human review) and produce legal or otherwise significant effects with respect to the data subject. Such ADM is only legal if one of the following applies:
- The ADM is necessary for entering into or for performing a contract with the data subject.¹ For example, credit scoring might be covered by this.
- The ADM is authorized by specific UK/EU/member state laws that include suitable safeguards for the data subject.
- The ADM is based on the data subject's explicit consent.¹
¹ In the “contractual necessity” or “explicit consent” cases, the controller is required to implement suitable safeguards, and at the minimum a right to obtain human intervention so that the decision can be contested.
From this list of permitted cases, it can be seen that an employment context does not generally allow ADM. Consent is typically impossible in an employment relationship. ADM is not necessary for performing the employment contract. In particular, there is no need for Taylorist/Amazonesque performance review systems that automatically terminate employment without human review if metrics aren't met. However, it might be necessary to use automated skill tests as part of a hiring pipeline. Of course, the employer might always find some law that specifically authorizes ADM in the employment context.
But workplace surveys aren't ADM – they might be partially automated, but the survey doesn't produce automated decisions. While such surveys might be one input into a decision that produces significant effects for the employees, such decisions would typically still be made by humans.
The lawfulness of surveys instead depends on an ordinary Art 6(1) legal basis such as a legitimate interest.