• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
easy GDPR - we make compliance with GDPR easy

easyGDPR

We make implementing General Data Protection Regulation Easy

  • Home
  • Services
    • Software
      • easyGDPR Quickcheck
      • (DEP) easyGDPR lite
      • (DEP) easyGDPR Standard
      • Data Subject Requests
      • Sophos
    • IT Security
    • network checkup
    • SME digitization funding
    • Data protection consulting
      • Data protection
      • Cybersecurity
    • Training
      • Data protection
      • Cybersecurity
  • Partner
    • Resellerprogramm
    • Affiliate programm
  • GDPR
    • GDPR News
    • FAQ
    • GDPR Decisions
    • GDPR penalties
    • GDPR legal text
  • Shop
  • Contact
    • Contact
    • Newsletter registration
  • Login
    • Shop / Affiliate Program
    • easyGDPR Software
  • German
  • English

Works councils must comply with data protection

11/09/2019 by Andreas Schindler

According to the decision of the Federal Labor Court, works councils are obligated to data protection

The employer is obliged to allow the works committee to inspect the non-anonymized gross remuneration lists. It is true that the inspection at issue is aimed at processing personal data. However, this is permissible. The court reasoned its decision as follows:

First, the Federal Labor Court (Bundesarbeitsgericht, BAG) defined the term processing and relied on the legal definition of Article 4(2) of the GDPR. It is stated that the granting of access to these lists by the employer to the works committee constitutes the processing of these data.

Furthermore, the BAG states that the disclosure of data to the works council constitutes data processing, regardless of whether the works council is a third party or a recipient within the meaning of the GDPR , and relies on the legal definition of Article 4(9) of the GDPR.

“According to Article 4(2) of the GDPR, the term processing means, inter alia, any operation which is performed upon personal data, whether or not by automatic means. This includes their disclosure by “transmission, dissemination or any other form of making available”, i.e. the specific disclosure of data to a recipient who – which in turn follows from Article 4(9) GDPR – need not be a third party. Thus, for the assumption of data processing – in contrast to § 3 para. 4 sentence 2 no. 3 BDSG in its version applicable from August 28, 2002 to May 24, 2018 (old), according to which only the disclosure of data to third parties constituted a data transfer – it is not decisive whether the Works Council Third in the sense of Article 4(9) GDPR Is.”

In this case, it is therefore irrelevant whether the works council is a “third party“. This is irrelevant for the existence of a transfer of personal data requiring a permit.

In this case, the BAG assumes that the works council is the recipient and that personal data is disclosed. Whether persons or bodies within a company are also considered recipients is still a matter of dispute, as the works council is endowed with special legal rights and obligations.

In this context, the classification of the works council as a recipient has implications for data controllers, for example in the implementation of data subject rights(Article 13ff) and in the context of the list of processing activities (Article 30).

Category iconGDPR Decisions,  Germany,  News

Primary Sidebar

IT-Security Whitepaper Downloaden
  • German
  • English
  • Data Protection Statement
  • Terms and Conditions
  • Imprint
  • Licence terms for easyGDPR
  • GDPR terms
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking "Accept", you consent to the use of ALL the cookies.
SettingsAccept All
Manage consent

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may have an effect on your browsing experience.
Necessary
Always Enabled

Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.

Non Necessary

Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.

functionality

Diese Art von Cookies erhöht die Benutzerfreundlichkeit unserer Website. Beispielsweise wird darin die von Ihnen ausgewählte Sprache gespeichert. Auch die Verfügbarkeit von Videostreams und sonstigem Inhalt kann von diesen Cookies abhängig sein. Wenn Sie diese Cookies ablehnen, ist die Benutzerfreundlichkeit eingeschränkt.

Save & Accept