Employee data protection: ECJ calls German provisions into question

The European Court of Justice (ECJ) recently called into question the German provisions on employee data protection in its eagerly awaited judgment of 30 March 2023 in the request for a preliminary ruling on the live streaming of classes by videoconference in Hessen.

In its ruling, the Court focused mainly on the relevant provisions of employee data protection in section 23 of the Hessen Data Protection Act. However, the Court’s critical considerations are certainly transferrable to the virtually identical rules on employee data protection in section 26 of the German Federal Data Protection Act.

The ECJ left it to the referring German court to decide on the compatibility of the relevant German national provisions with the European General Data Protection Regulation (GDPR). However, the ECJ clearly indicated it did not consider the German provisions on employee data protection compatible with the relevant provisions of Article 88 of the GDPR.

The ruling is a major blow to the German legislature, which has so far failed to produce legally watertight and appropriate regulations on employee data protection despite ongoing criticism.

If the German legislature does not remedy the situation soon by comprehensively revising the regulations on employee data protection in the German Federal Data Protection Act in conformity with EU law, or even by introducing a separate Employee Data Protection Act which the German data protection authorities have long been calling for, in future only the general GDPR provisions will apply to the processing of employee data. In principle, these provisions also apply in the context of employment. In this regard, the ECJ expressly stated in its ruling that the legal bases laid down in Article 6 of the GDPR were in themselves exhaustive and conclusive.

However, it remains to be seen whether the German lawmakers will actually take the ECJ ruling as an opportunity to quickly revise German data protection law. Companies should therefore check as soon as possible which alternative legal bases they could use for processing employee data instead of section 26 of the German Federal Data Protection Act.