Technologies that collect and exploit personal data in the workplace as a tool for managing employment relationships, in all their phases, are becoming increasingly pervasive; consequently, the protection of workers necessarily hinges on adequate safeguards for personal data. However, the EU regulatory framework is fragmented, as the flagship regulation, the GDPR, leaves it to member state laws (or collective bargaining) to specify and enhance protections in the employment context. This contribution reflects on the effects of such fragmentation and provides a framework within the EU economic system, where competition among member states occurs in the realm of wage containment.