§ 18 DSG NRW
Data processing in the employment context
(1)Personal data of applicants and employees may only be processed where this is necessary for the establishment, implementation, termination or settlement of the employment relationship or for carrying out organisational, personnel and social measures, in particular for the purposes of personnel planning and deployment, or where a legal provision, a collective agreement or a service agreement so provides, or the employee has given consent. The transmission of data of applicants and employees to persons and bodies outside the public sector shall be permissible only where the recipient demonstrates a legal interest, official business so requires, or the data subject has given consent. The transmission of data to a future employer shall be permissible only with the consent of the data subject.
(2)Where the processing of personal data of employees is based on consent, the dependency existing in the employment relationship of the employed person, as well as the circumstances under which consent was given, shall be taken into account in particular for the assessment of the voluntariness of the consent. Voluntariness may in particular exist where a legal or economic advantage is achieved for the employed person or where the employer and the employed person pursue congruent interests. The consent shall be given in writing, unless other forms are appropriate due to special circumstances. The employer shall inform the employed person about the purpose of the data processing and about the right of withdrawal pursuant to Article 7(3) of Regulation (EU) 2016/679 in text form.
(3)By way of derogation from Article 9(1) of Regulation (EU) 2016/679, the processing of special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679 for purposes of the employment relationship shall be permissible where it is necessary for the exercise of rights or the fulfilment of legal obligations arising from labour law, the law of social security and social protection, and there is no reason to assume that the legitimate interest of the data subject in the exclusion of processing prevails. Paragraph 2 shall also apply to consent to the processing of special categories of personal data; the consent must expressly refer to such data.
(4)Personal data of applicants for
(5)1. the police service, or
(6)2. an employment, training or internship relationship with police authorities
(7)may be transmitted to police and constitutional protection authorities for the purpose of verifying the conditions for appointment. The data may be processed in the case management and information systems of the police and constitutional protection authorities. The consent of the applicants is not required for this purpose.
(8)The civil service law provisions on the maintenance of personnel files pursuant to Section 50 of the Civil Service Status Act of 17 June 2008 (BGBl. I p. 1010) in the version applicable from time to time, as well as Sections 83 to 92 of the Land Civil Service Act of 14 June 2016 (GV. NRW. p. 310,
(9)corrected p. 642) in the version applicable from time to time, shall apply accordingly to all non-civil-servant employees of a public body, unless the particularities of collective bargaining and employment law regarding the inclusion and removal of certain documents and notes require different treatment.
(10)The further processing of data collected during medical or psychological examinations and tests for the purpose of establishing an employment relationship shall be permissible only with the written consent of the data subject. The appointing authority may as a rule only require the examining physician to transmit the result of the fitness examination and the risk factors identified during the examination.
(11)Personal data collected prior to the establishment of an employment relationship shall be erased without delay as soon as it is established that a service or employment relationship will not come into existence, unless the data subject has consented to further storage or periods for asserting claims under the General Equal Treatment Act of 14 August 2006 (BGBl. I p. 1897) in the version applicable from time to time must be observed. After the termination of an employment relationship, personal data shall be erased where these data are no longer required, unless legal provisions preclude erasure.
(12)The results of medical or psychological examinations and tests of employees may be processed by automated means only where this serves the protection of the employees.
(13)Insofar as data of employees are stored in the course of the implementation of technical and organisational measures pursuant to Article 32 of Regulation (EU) 2016/679, they may not be used for purposes of behavioural or performance monitoring.
(14)Appraisals may not be based solely on information obtained directly through automated data processing.
(15)Control centres and command centres of the institutions and organisations referred to in sentence 4 may, for the purpose of determining the geographical location, process personal data of the operational forces under their direction by means of electronic devices through a function of the digital radio for authorities and organisations with security tasks (BOS digital radio) or by other technical means without the consent of the data subject, insofar as this is necessary for operational reasons for the safety or coordination of operational forces. Location data may only be processed for the purposes specified in sentence 1. The data shall be erased without delay when they are no longer necessary for achieving the purpose of storage. Sentences 1 and 2 shall apply to operational forces of the authorised entities of Section 4(1), numbers 1.1, 1.5, 1.6, 1.7 to 1.9 of the BOS Radio Directive of 7 September 2009 (GMBl. 2009, p. 803) in the version applicable from time to time, insofar as these are municipal authorities or Land authorities.
(16)The participation rights of the employees' representative bodies shall remain unaffected.