Employee Data Protection
How § 26 BDSG governs the processing of employee data, which legal bases apply in employment relationships, and what special requirements exist for employee monitoring and applicant data.
Data protection in the employment context is governed in Germany primarily by § 26 of the Federal Data Protection Act (BDSG), which serves as a national opening clause for Article 88 GDPR. This provision permits the processing of personal data of employees where necessary for decisions about the establishment, performance, or termination of the employment relationship.
Who Qualifies as an Employee?
The concept of 'employee' is broadly defined to include employees, trainees, employee-like persons, applicants, and former employees. The processing of their data must always be proportionate and limited to what is necessary.
For applicant data, the controller may store data only for the duration of the recruitment process. Following rejection, data must generally be deleted within three to six months to protect against potential claims under the General Equal Treatment Act (AGG). Consent from the applicant to retain their data for future vacancies is possible but must be genuinely voluntary.
Workplace Monitoring
Employee monitoring is a particularly sensitive area. Video surveillance in the workplace is permissible only under strict conditions: there must be a specific suspicion of a criminal act or other serious breach of duty, the measure must be proportionate, and less intrusive means must have been considered. Covert surveillance measures are generally impermissible.
Employee consent to data processing in the employment context is problematic, since the voluntariness of consent is frequently doubtful in light of the power imbalance inherent in the employment relationship. § 26(2) BDSG clarifies that consent is effective in the employment context only where the employee does not suffer legal or economic disadvantage through giving or withholding consent. Particular transparency and documentation are required.
Works Council Co-Determination
Works councils under the Works Constitution Act (BetrVG) have extensive co-determination rights with respect to measures that enable the monitoring of employee conduct or performance. The introduction of surveillance systems, time-recording tools, or analytics software generally requires the works council's agreement. Close coordination with the data protection officer and the works council is essential.