§ 26 BbgDSG
Data processing in the context of employment relationships
(1)Personal data of applicants and employees may only be processed where this is necessary for the establishment, performance, termination or settlement of the service or employment relationship, or for the implementation of internal, planning, organisational, personnel, social, budgetary or cost-accounting measures, in particular for the purposes of personnel planning and personnel deployment, or where it is provided for by a legal provision, a collective agreement, or a service or works agreement (collective agreement). A transmission of employee data to persons and bodies outside the public sector shall be permissible only where the recipient demonstrates a legal interest, official business requires it, or the data subject has given consent. The transmission of data to a future employer shall be permissible only with the consent of the data subject.
(2)Where the processing of personal data of employees is based on consent, the dependency existing in the employment relationship of the employed person and the circumstances under which the consent was given shall in particular be taken into account in assessing the voluntariness of the consent. Voluntariness may in particular be present where a legal or economic advantage is achieved for the employed person, or where the employer and the employed person pursue aligned interests. The consent shall be given in writing or electronically unless a different form is appropriate due to special circumstances. The employed person shall be informed in text form of the purpose of the data processing and of his or her right of withdrawal pursuant to Article 7(3) of Regulation (EU) 2016/679.
(3)Derogating from Article 9(1) of Regulation (EU) 2016/679, the processing of special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679 shall be permissible for employment purposes where it is necessary for the exercise of rights or the fulfilment of legal obligations arising from labour law, civil service law, the law of social security and social protection, and there is no reason to assume that the legitimate interest of the data subject in the exclusion of the processing prevails. Where the processing is based on consent, the consent must expressly relate to such data.
(4)The provisions of the Land Civil Service Act on the processing of personnel file data of employees and trainees applicable to civil servants shall apply mutatis mutandis, unless special legal provisions or collective agreements take precedence.
(5)The storage, alteration or use of data collected through medical or psychological examinations and tests for the purpose of determining suitability shall be permissible only where it is necessary for the purposes of the establishment or performance of a service or employment relationship. Processing of such data for other purposes shall be permissible only with the consent of the data subject. The employing authority may request from the examining physician or psychologist only the transmission of the result of the fitness examination and of risk factors identified therein.
(6)Personal data collected prior to the establishment of a service or employment relationship shall be deleted without undue delay as soon as it is established that a service or employment relationship will not come into being, unless the data subject has consented to further storage. After the termination of a service or employment relationship, personal data shall be deleted where such data are no longer needed, unless legal provisions preclude this.
(7)Insofar as employee data are stored in the context of the implementation of technical and organisational measures pursuant to Article 32 of Regulation (EU) 2016/679, they may not be used for the purposes of behavioural or performance monitoring.
(8)Einzelnorm