§ 26 BDSG
Data processing for the purposes of the employment relationship
(1)Personal data of employees may be processed for the purposes of the employment relationship where this is necessary for the decision on the establishment of an employment relationship or, after the establishment of the employment relationship, for its performance or termination or for the exercise or fulfilment of the rights and obligations of the representation of the interests of the employees arising from a law, a collective agreement or a works or service agreement (collective agreement). For the purpose of detecting criminal offences, personal data of employees may only be processed if there are documented factual indications that give rise to a suspicion that the data subject has committed a criminal offence in the employment relationship, the processing is necessary for the investigation, and the employee's legitimate interest in the exclusion of the processing does not outweigh it, in particular with regard to the nature and extent of the processing in proportion to the cause. Section 8 Subsection (1) of the Act on Works Constitution Bodies shall remain unaffected.
(2)Where personal data of employees are processed on the basis of consent, both the purpose of the data processing and the circumstances under which consent is given shall be taken into account for the assessment of the voluntariness of the consent. Voluntariness may in particular be given where a legal or economic advantage is achieved for the employee or the employer and the employee pursue the same interests. Consent shall be given in writing or electronically, unless another form is appropriate due to special circumstances. The employer shall inform the employee of the purpose of the data processing and of the right of withdrawal pursuant to Article 7 Subsection (3) of Regulation (EU) 2016/679 in text form.
(3)The processing of special categories of personal data of employees within the meaning of Article 9 Subsection (1) of Regulation (EU) 2016/679 for the purposes of the employment relationship shall be permissible where it is necessary for the exercise of rights or the fulfilment of legal obligations arising from labour law, social security law and the law of social protection, and there is no reason to assume that the data subject's legitimate interest in the exclusion of the processing overrides. Subsection (2) shall apply to consent for the processing of special categories of personal data; in addition, it must refer expressly to those data. Section 22 Subsection (2) shall apply.
(4)The processing of personal data, including special categories of personal data of employees, for the purposes of the employment relationship shall be permissible on the basis of collective agreements. In this respect, the negotiating parties to the collective agreement shall comply with Article 88 Subsection (2) of Regulation (EU) 2016/679.
(5)The controller shall take appropriate measures to ensure that in particular the principles set out in Article 5 of Regulation (EU) 2016/679 are complied with for the processing of personal data.
(6)The rights of the works council under Section 80 Subsection (1) No. 1 of the Works Constitution Act and of the corresponding staff representation bodies to monitor compliance with the provisions in favour of employees shall remain unaffected.
(7)Subsections (1) to (6) shall also apply where personal data, including special categories of personal data, of employees are processed without being or being intended to be stored in a filing system.
(8)Employees within the meaning of this Section shall mean: 1 persons in employment, including those in vocational training, and persons who are to be regarded as employee-like persons because of their economic dependence; also included shall be persons employed in home work and persons equivalent to home workers within the meaning of Section 1 of the Home Work Act; the second half-sentence shall not apply to Section 1 Subsection (2) No. 3 of the Home Work Act,; 2 civil servants of the Federation, judges of the Federation, soldiers and conscripted persons performing civilian service,; 3 persons receiving services under Book II or Book III of the Social Code who are assigned to an activity,; 4 persons undergoing rehabilitation measures,; 5 persons in a workshop for disabled persons and; 6 persons who apply for an employment relationship, as well as those whose employment relationship has ended.