Employee data protection

Employee data protection comprises the rules governing the processing of personal data of job applicants, employees and former employees.

Which rules apply?

Art. 88 GDPR allows Member States to adopt more specific rules for the employment context. Germany has done so in Section 26 BDSG. Collective agreements such as works agreements can also form a legal basis in their own right.

In its judgment of 30 March 2023 (C-34/21), the CJEU raised doubts as to whether a general clause such as Section 26(1) sentence 1 BDSG meets the requirements of Art. 88 GDPR. In practice, processing is therefore also based on Art. 6(1) GDPR, in particular on necessity for the employment relationship.

Typical use cases

Relevant areas include recruitment procedures, personnel files, payroll, time recording, email and internet use at work and checks to uncover criminal offences.

Because of the relationship of dependency, employee consent can only be relied on to a limited extent. It must be freely given and, under Section 26(2) BDSG, should be given in writing or electronically.

Role of the works council

Technical systems capable of monitoring employees' conduct or performance are subject to co-determination under Section 87(1) no. 6 BetrVG. A works agreement provides legal certainty here, provided it complies with the requirements of the GDPR.

Legal provisions

Art. 88 GDPR

Opening clause for more specific rules in the employment context.

Section 26 BDSG

National rule on data processing for the purposes of the employment relationship.

Art. 6(1)(b) and (c) GDPR

Processing for the performance of a contract and for compliance with the employer's legal obligations.

Section 87(1) no. 6 BetrVG

Co-determination of the works council for technical monitoring systems.