§ 22 SDSG
Processing of employee data
(1)1Public bodies may process personal data of applicants or employees only insofar as this is necessary for the establishment, performance, termination or settlement of the employment or service relationship, or for the implementation of organisational, personnel and social measures, in particular also for the purposes of personnel planning and deployment, or where a legal provision, a collective agreement or a service or works agreement so provides. 2Section 7 shall apply in addition.
(2)By derogation from Article 9(1) of Regulation (EU) 2016/679, the processing of special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679 for purposes of the employment relationship shall be lawful where it is necessary for the exercise of rights or the fulfilment of legal obligations arising from employment law, the law of social security and social protection, and there is no reason to assume that the legitimate interest of the data subject in excluding the processing outweighs the interest in processing.
(3)For the purpose of detecting criminal offences or a serious breach of official duty, personal data of employees pursuant to paragraph 1 or 2 may only be processed where documented factual indications substantiate the suspicion that the data subject has committed a criminal offence or a serious breach of official duty in the employment or service relationship, the processing is necessary for the detection thereof and the legitimate interest of the employee in excluding the processing does not outweigh the interest in processing, in particular the nature and extent are not disproportionate in relation to the occasion.
(4)The personal data of employees stored pursuant to paragraph 1 may be combined by the controller for the purpose of enabling evaluations for the purposes referred to in paragraph 1 and may be retained for the duration of storage in the source systems.
(5)The controller shall take appropriate measures to ensure that in particular the principles for the processing of personal data set out in Article 5 of Regulation (EU) 2016/679 are complied with.
(6)The publication of employee data shall, without prejudice to Article 6(1)(a) of Regulation (EU) 2016/679, only be lawful where it is necessary for the purpose of informing the general public or other employees and where no legitimate interests of the data subject preclude such publication.
(7)1Data collected before the commencement of an employment or service relationship shall be erased without undue delay as soon as it is established that such a relationship will not be entered into. 2This shall not apply where there is reason to believe that the erasure would impair the legitimate interests of the data subject. 3The data subject shall be notified thereof.
(8)1The processing of personal data, including special categories of personal data, of employees for purposes of the employment relationship shall be lawful on the basis of collective agreements. 2In doing so, the negotiating parties shall comply with Article 88(2) of Regulation (EU) 2016/679.
(9)The participation rights of employee representation bodies shall remain unaffected. zur Einzelansicht § 22