System in use

Introducing Microsoft 365 Copilot

Under the Court of Justice, a provision adopted on the basis of Art. 88(1) GDPR may not merely repeat the conditions in Art. 6 GDPR. Whether section 26(1), first sentence, BDSG meets that standard is contested, which makes a works agreement under Art. 88(2) GDPR the more durable basis. What Microsoft processes is decided not by the product description but by how the contract forms its categories.

The licences are ordered, the review is to approve

The introduction has been decided, the licences are ordered, and the data protection review is expected to deliver the approval. What is planned is a review under employee data protection law, a presentation to the works council and a reference to the provider’s assurances. All three are open to challenge.

The legal basis rests on a contested provision

What the deployment can be based on has been answered differently since 30 March 2023. In Case C-34/21 the Court of Justice set the standard for provisions adopted on the basis of Art. 88(1) GDPR.

For practice that does not mean impossibility but a sequence. Anyone concluding a works agreement that fills out the three points named in Art. 88(2) GDPR has a basis meeting the standard set by the judgment. Anyone relying on section 26(1) BDSG alone has a basis whose survival depends on a question they do not decide.

Co-determination hangs on whether the data can be analysed

When the works council has to be involved is decided not by the product but by two features, and both are met in a typical introduction.

Two features, assessed against the configuration

Objective capacity
Usage logs, prompts and outputs can be analysed. Under the Federal Labour Court an intention to monitor is beside the point.
Attributability
With a personal account it is present. It is absent where prompts are processed without an identifier and only aggregate analysis takes place.
Consequence
Where both are met, introduction and use are co-determined under section 87(1) no. 6 BetrVG, and a measure introduced without participation is ineffective as against employees.

3 von 3

The legal basis and co-determination therefore coincide. The works agreement filling out co-determination is at the same time the basis that can meet the standard of the judgment under Art. 88(2) GDPR. A project solving both in one document saves a round.

What Microsoft processes is in the contract, not in the data sheet

What the provider processes is regularly answered in projects by pointing at the product page. In legal terms a different place counts, namely the one where the contract forms categories of data and assigns roles to them.

Three questions whose answer sits in the contract

Which categories does the contract form?

Prompts, outputs, usage and diagnostic data are usually distinct categories with distinct rules under the contract. How the categories are formed determines what has to be assessed at all.

For which of them is the provider itself the controller?

In so far as the provider determines purposes and means itself, it is a controller to that extent and not a processor, and under Art. 28(10) GDPR that holds even where it does so in breach of the Regulation. For those categories there is no instruction, only a disclosure.

Which sub-processors and which locations?

The list of sub-processors and the processing locations determine whether Chapter V of the Regulation applies. Both change more often than the contract, and so their state and date belong in the documentation.

Why the version has to be recorded with a date

At the review
Name the version reviewed
Without naming the version the review cannot later be retraced, and the demonstration under Art. 5(2) GDPR cannot be made.
In the record
The categories of recipients
Art. 30(1) GDPR requires them. They follow from the list of sub-processors and change with it.
On every change
Read it again
The terms of large providers are changed several times a year. A date for that belongs in the agreement.

How we support you in introducing Copilot

The three points can be answered in one document, and that document is the works agreement with an annex. The agreement satisfies co-determination and, where it fills out the three points of Art. 88(2) GDPR, the legal basis as well. The annex records which version of the provider’s terms was reviewed, which categories it forms and for which of them the provider is itself the controller. Together they are the demonstration, and both come into being before the roll-out.

Frequently asked questions

Is section 26(1) BDSG sufficient as a legal basis?

That is open. The Court of Justice held that a provision adopted on the basis of Art. 88(1) GDPR may not merely repeat the conditions in Art. 6 GDPR. Whether section 26(1), first sentence, BDSG meets that standard is judged differently by different authors. In practice that means an assessment resting on it alone remains open to challenge.

Is a works agreement the better basis?

As a rule yes, where it meets the requirements of Art. 88(2) GDPR. What is called for are suitable and specific measures to safeguard human dignity, legitimate interests and fundamental rights, in particular as to transparency, transfers within a group and monitoring systems at the workplace. An agreement that merely permits the deployment does not meet that.

Does the works council have to be involved even without any intention to analyse?

Yes, where the system is objectively capable of collecting information on conduct or performance and the data can be attributed to individual employees. With a personal account and usage logs that is regularly the case. Under the case law an intention is not required.

Where is it stated what the provider processes for its own purposes?

In the contract terms and not in the product description. What has to be found is the place where the contract forms categories of data and provides, for some of them, a controllership of the provider's own. That place changes with the terms, and so its version and date belong in the documentation.

Get in touch!

Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!

Alternatively you can request a call back.