Point of law
The works agreement as a legal basis
Co-determination under section 87(1) no. 6 BetrVG decides whether the works council has a say. Whether processing is permitted is decided by Art. 6 GDPR. A works agreement can do both, but only the second effect requires it to meet the demands of Art. 88(2) GDPR.
The agreement is signed, the system can do more
The HR department wants to introduce a new time recording system. The works council agrees, an agreement is signed, the system goes live. The agreement states who has access and how long the data stays. On what legal basis the processing rests appears nowhere.
Co-determination and legal basis are two questions
Whether the works council’s consent replaces the legal basis is tacitly answered yes in practice. The two questions come from different statutes and have different addressees.
Two questions, two provisions
| Co-determination | Merkmal | Legal basis |
|---|---|---|
| Section 87(1) no. 6 BetrVGAlongside sections 90 and 80 BetrVG on information and consultation. | Provision | Art. 6 GDPR, section 26 BDSGAlongside Art. 9 GDPR for special categories. |
| The workforce collectivelyRepresented by the works council. | What is protected | The individual data subjectIncluding against the works council. |
| Claim to desistThe works council can stop the roll-out. | Consequence if missing | Unlawful processingWith claims by the data subject and powers of the supervisory authority. |
| The works councilFailing agreement, the conciliation board under section 87(2) BetrVG. | Who can consent | Nobody by proxyA collective agreement is a legal basis by operation of law, not by consent. |
A works agreement can do both at once, and that is exactly what obscures the difference. It is the outcome of co-determination and at the same time a possible ground for processing, but only the second effect depends on Art. 88(2) GDPR.
Co-determination reaches far. Under the case law of the Federal Labour Court, technical devices are designed to monitor once they are objectively suitable for collecting information on conduct or performance. An intention to monitor is not required, and neither is recording.
An agreement from 2015 does not know the requirements of 2018
Whether older works agreements still cover today’s systems is the second recurring finding. As collective agreements they continue to apply. As a legal basis they operate only in so far as they meet the requirements of Art. 88(2) GDPR, which section 26(4) sentence 2 BDSG expressly refers to.
Two moments at which it surfaces
A new module in an old system
The agreement does not name it, because it did not exist when the agreement was concluded. The question of the legal basis for that part therefore arises afresh.
An access request under Art. 15 GDPR
Under paragraph 1(a) the reply states the purposes and thereby, indirectly, the legal basis. It then has to be decided whether the agreement really fills that role.
Appropriate and specific measures are the yardstick
What an agreement has to contain to serve as a legal basis is set out in Art. 88(2) GDPR. What is required are suitable and specific measures to safeguard human dignity, legitimate interests and fundamental rights. The provision names three subjects expressly.
The three subjects named expressly
Transparency of processing
More than a reference to the general privacy notice. The agreement should name which evaluations are possible, who may initiate them and how the workforce learns of them.
Transfers within a group of undertakings
The point at which group-wide systems regularly fail. What has to be settled is which data the parent or a sister company receives, for what purpose and at what level of aggregation.
Monitoring systems at the workplace
Here lies the overlap with section 87(1) no. 6 BetrVG. What is required are limits on evaluation, a prohibition of conduct and performance monitoring unless expressly permitted, and rules for access in individual cases.
What the agreement cannot contract out of
Liste zu vermeidender Punkte
- The principles in Art. 5 GDPR, in particular purpose limitation, data minimisation and storage limitation
- The information duties under Art. 13 and Art. 14 GDPR
- The rights of data subjects under Chapter III of the regulation
- The duty to carry out an impact assessment under Art. 35 GDPR where its conditions are met
How we support you with the works agreement
The stock of agreements can be held against the record of processing activities. For each system it has to be settled which agreement covers it, what year it dates from and whether it names the three subjects of Art. 88(2) GDPR. Where it does not, either a legal basis under Art. 6 GDPR has to be identified or the agreement has to be supplemented.
The employment law side lies outside data protection law. The negotiation itself, proceedings before the conciliation board under section 87(2) BetrVG, termination of an agreement and its continuing effect run through the affiliated law firm.
Frequently asked questions
Does the works council's consent replace the legal basis?
No. Section 87(1) no. 6 BetrVG governs whether the works council has to be involved. Whether processing is permitted follows from Art. 6 GDPR and section 26 BDSG. An agreement can do both, but then it also has to meet the requirements of Art. 88(2) GDPR.
When does co-determination under section 87(1) no. 6 BetrVG apply?
To technical devices designed to monitor conduct or performance. Under the case law of the Federal Labour Court objective suitability suffices, and an intention to monitor is not required. What is presupposed, however, is that the data can be attributed to individual employees or that pressure on the group reaches them.
Do older works agreements continue to apply?
As a collective agreement, yes. As a legal basis, only in so far as they meet the requirements of Art. 88(2) GDPR. An agreement concluded before 25 May 2018 typically does not contain those measures, because at the time it did not have to.
Can an agreement limit employees' rights?
It can permit the processing, but it cannot contract out of the principles in Art. 5 GDPR. Data minimisation, purpose limitation and storage limitation continue to apply. A clause providing for unlimited evaluation is invalid to that extent and not merely inappropriate.
Get in touch!
Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!
Contact usAlternatively you can request a call back.