Is consent the best approach to processing employee data?