Collective agreements, in particular works agreements, are only a suitable legal basis for the processing of employee data if they fulfil high requirements. The European Court of Justice (ECJ) recently made this key statement as part of a preliminary ruling procedure. The background and implications of the judgement of 19 December 2024 (case reference C-65/23) are outlined below.
Facts of the case
The ECJ’s decision concerns a legal dispute between an employee and his employer regarding the permissibility under data protection law of processing personal data on the basis of an existing works agreement.This works agreement alsohad the function of a legal basis within the meaning of Section 26 (4) BDSG for the processing of employee data. The employee claimed that the processing of selected personal data was nevertheless carried out without a sufficient legal basis. Specifically, the employer had also processed particularly sensitive data using the HR application “Workday“ and transferred it to servers located in the USA without the works agreement legitimising this form of data processing. Following a referral by the Federal Labour Court, the ECJ had to clarify which requirements a works agreement must meet in order to be classified as a sufficient legal basis under the GDPR .
Key statements of the ECJ
With regard tothis legal question , the ECJ comes to the following conclusions:
Insofar as it is possible in an EU member state tojustifythe processing ofemployee data on the basis of a works agreement (in Germany, Section 26 (4) BDSG), theseworksagreementsmust
1. contain more specific requirements for dealing with employees (cf. Art. 88 para. 1 and 2 GDPR, in this direction already ECJ, judgement of 30.
03.2023, Ref. C-34/21, see our blog post here) and
2. fulfilthe requirements of Art. 5 (data protection principles), Art. 6 (legalbases) and Art. 9 GDPR(further requirements for the processing of particularly sensitive data).
With regard to compliance with these requirements, in particular with regard to the definition of the necessity of data processing, the parties to the agreement have a certain amount of leeway. At the same time, this assessment is subject to judicial review. Under no circumstances, however, may the provisions made in works agreements lead to the level of protection of the GDPR being undermined.
Effects on practice
The ECJ clarifies that works agreements only constitute a suitable legal basis for the processing of personal data in accordance with Art. 88 para. 1 GDPR (Section 26 para. 4 BDSG) if they contain sufficiently clear and precise regulations. In particular, they must clearly definethe type of data processed, the purposes of the processing and the rights of the employees . It must also be ensured that the agreement complies with the principles of the GDPR, in particular transparency and proportionality. Finally , works agreements should also contain statements about the – actual – legal basis on which specific data processing is to be based. Particularly with regard to the processing of particularly sensitive employee data (e.g. data relating to health, religion, trade union membership or biometric data), more justification may be required at this point.
The long-established approach (often favoured by both parties for practical reasons) of being able to “interfere” further with the rights of employees with regard to their personal data (“do ut des”) in works agreements by granting special safeguards can no longer be maintained for the future.
Organisations with works or staff councils should therefore review existing collective agreements for (1.) completeness and (2.) their compatibility with the requirements of the ECJ. If the principles now established are not complied with, there is a risk that the entire clause in the works agreement will be invalid. This is because,apart from a few exceptions, the strict prohibition of a reduction in scope applies in labour law. In the case of invalid clauses in employment contracts or works agreements, the clause is cancelled without replacement and the statutory provisions apply. This strict approach serves to protect employees and is intended to encourage employers and the parties to employment contracts and company agreements to draft them carefully and in compliance with the law.
If you need assistance with the review, we will be happy to advise you.