Does the Act apply to employee data?

Yes. Employees are Data Principals with the same rights as anyone else, and the employment relationship does not by itself supply consent. The Act does recognise certain employment purposes as legitimate uses, covering matters such as safeguarding the employer from loss or liability, prevention of corporate espionage, protection of intellectual property and trade secrets, and provision of services or benefits to employees. That is a defined category, not a blanket permission. Excessive monitoring, profiling of employees' private lives and collection beyond what the stated purpose requires remain exposed.