§ 11 SächsDSG
Processing of employee data
(1)1Public bodies may process personal data, including data within the meaning of Article 9(1) of Regulation (EU) 2016/679, of applicants or employees only insofar as this is necessary for the establishment, performance, termination or settlement of the employment or service relationship, or for the implementation of organisational, personnel and social measures, in particular also for the purposes of personnel planning and deployment, or where a legal provision, a collective agreement or a service or works agreement so provides. 2This shall also apply to data of third parties whose processing is necessary for the purposes referred to in sentence 1.
(2)1When processing personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679, appropriate and specific measures shall be taken to safeguard the interests of the data subject. 2Taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons posed by the processing, such measures may include, without prejudice to the measures referred to in Articles 25, 32 and 36 of Regulation (EU) 2016/679, in particular:
(3)The publication of employee data shall, without prejudice to Article 6(1)(a) of Regulation (EU) 2016/679, only be lawful where it is necessary for the purpose of informing the general public or other employees and where no legitimate interests of the data subject preclude such publication.
(4)1Data collected before the commencement of an employment or service relationship shall be erased without undue delay as soon as it is established that such a relationship will not be entered into. 2This shall not apply where there is reason to believe that the erasure would impair the legitimate interests of the data subject. 3The data subject shall be notified thereof.
(5)Employee data collected for the purpose of behavioural or performance monitoring may only be processed for that purpose.