Every personnel decision today has a data protection law dimension: the Introduction of a new HR software, the monitoring of official e-mails, the application process, the regulation of working from home. Whoever only Labor law Who only knows data protection misses the GDPR. Whoever only knows data protection misses the works council.
We combine both disciplines under one roof. Our employee data protection consulting merges labor law experience, particularly in works constitution law, with certified data protection expertise. Companies, HR departments, and works councils receive one answer from us instead of two legal opinions.
Why both disciplines belong together
Employee data protection lies right at the intersection: Section 26 BDSG and Article 88 GDPR regulate when employee data may be processed. Section 87 (1) No. 6 BetrVG grants the works council the right to co-determination regarding technical equipment designed to monitor employees. In practice, this affects almost any modern software.
Added to this is rapidly evolving case law. The ECJ has significantly tightened the requirements for works agreements as a legal basis for data processing (judgment of 19.12.2024, C-65/23). Many existing works agreements no longer meet these standards. Furthermore, the Federal Labour Court has specified claims for damages by applicants and employees pursuant to Art. 82 GDPR. Errors here not only result in fines, but increasingly also in damages.
Works agreements and works constitution law
Our particular strength lies in German works constitution law. We draft and negotiate works agreements that achieve both: properly reflecting the codetermination rights of the works council while simultaneously functioning as a viable legal basis pursuant to Article 88 GDPR.
Typical constellations:
- IT framework company agreements for the entire system landscape
- Introduction of new software: HR systems, Microsoft 365, collaboration tools, AI applications
- Company agreements on time tracking, video surveillance, and tracking systems
- Review of existing company agreements in light of the stricter ECJ requirements
- Negotiation with the works council up to the conciliation committee
- Consultation of works councils on data protection-related projects of the employer
New Work: Where Employment Law and Data Protection Collide
Hybrid working, mobile teams, AI in everyday work: the new world of work raises questions that can only be answered using both areas of law at the same time. We advise on:
- Home office and mobile work: Agreements, data security, employer's rights of control
- Workation and working from abroad, including the data protection consequences of third-country transfers
- Bring Your Own Device and the separation of private and business data
- Time tracking in accordance with the guidelines of the ECJ and the Federal Labor Court
- Monitoring and performance control in distributed teams: What is permissible, what is not?
- Use of AI tools by employees: guidelines, co-determination, data protection impact assessment
Data protection in Human Resources
HR departments process the most sensitive data in the company, from incoming applications to employment references. We support human resources departments in working in a legally compliant and data-protection-compliant manner:
- Applicant data privacy: background checks, internet research on applicants, talent pools, retention periods
- Digital personnel file: Structure, access concepts, deletion concepts
- Right of access by employees pursuant to Art. 15 GDPR, including emails and HR notes
- Monitoring of business emails and internal communication
- Internal investigations in suspected cases: Admissibility of evidence, proportionality, involvement of the works council
- Data transmission within the group of companies and to external service providers (data processing)
- Data breaches involving employee data: Notification pursuant to Art. 33 GDPR and internal communication
- Training courses for HR teams on handling employee data
Frequently Asked Questions
Do we need a works agreement for every new software?
Not necessarily for every system, but for significantly more systems than many assume. As soon as software is technically capable of monitoring employee behavior or performance, co-determination under Section 87 (1) No. 6 of the German Works Constitution Act (BetrVG) applies. According to case law, this applies even if there is merely the capability, not just upon actual intent to monitor. An enterprise-level IT framework agreement can significantly streamline the process for future implementations.
What rules apply to working from home and mobile working?
We recommend a company agreement on remote work that regulates: which systems may be used, how data security is ensured, and what control rights the employer has. The works council has a right of co-determination here pursuant to Section 87 (1) no. 6 of the German Works Constitution Act (BetrVG). When working from abroad, data protection issues regarding third-country data transfers also apply.
How long are we allowed to keep application documents?
Under Section 15 of the General Equal Treatment Act (AGG), application documents must be retained long enough to enable you to defend yourself in the event of a discrimination lawsuit (deadline: two months after rejection). A retention period of three to six months is therefore recommended. Thereafter, the data must be deleted in accordance with Article 17 of the GDPR. Exception: The applicant explicitly consents to longer storage for future job postings (talent pool). This consent must be voluntary, revocable at any time, and documented.
What rights of access do employees have regarding their data?
Under Article 15 of the GDPR, employees have a comprehensive right to information: What data is stored? For what purpose? To whom has it been disclosed? How long is it kept? The information must be provided within one month and is generally free of charge. Emails, notes in HR systems, or performance reviews can also be affected. Exceptions apply to trade secrets and third-party data. We assist you in responding to such requests in a legally compliant manner.
Are we allowed to monitor our employees' work emails?
This depends essentially on whether private use is permitted. In the case of purely official use, random checks while observing the principle of proportionality are more feasible. If private use is permitted or tolerated, significantly stricter standards apply. In any case, the following applies: clear rules in advance, involvement of the works council, and documentation. Total surveillance without cause is inadmissible.
How does the consultation work?
In an initial consultation, we will discuss your matter together, whether it is the introduction of a new system, a conflict with the works council, or a specific data protection question from the HR department. We will outline the legal situation and develop a practical solution. We are also happy to take over negotiations with the works council, the preparation of the necessary documents, and the ongoing support of your HR processes.