According to the decision of the Federal Labor Court, works councils are obligated to data protection
The employer is obliged to allow the works committee to inspect the non-anonymized gross remuneration lists. It is true that the inspection at issue is aimed at processing personal data. However, this is permissible. The court reasoned its decision as follows:
First, the Federal Labor Court (Bundesarbeitsgericht, BAG) defined the term processing and relied on the legal definition of Article 4(2) of the GDPR. It is stated that the granting of access to these lists by the employer to the works committee constitutes the processing of these data.
Furthermore, the BAG states that the disclosure of data to the works council constitutes data processing, regardless of whether the works council is a third party or a recipient within the meaning of the GDPR , and relies on the legal definition of Article 4(9) of the GDPR.
“According to Article 4(2) of the GDPR, the term processing means, inter alia, any operation which is performed upon personal data, whether or not by automatic means. This includes their disclosure by “transmission, dissemination or any other form of making available”, i.e. the specific disclosure of data to a recipient who – which in turn follows from Article 4(9) GDPR – need not be a third party. Thus, for the assumption of data processing – in contrast to § 3 para. 4 sentence 2 no. 3 BDSG in its version applicable from August 28, 2002 to May 24, 2018 (old), according to which only the disclosure of data to third parties constituted a data transfer – it is not decisive whether the Works Council Third in the sense of Article 4(9) GDPR Is.”
In this case, it is therefore irrelevant whether the works council is a “third party“. This is irrelevant for the existence of a transfer of personal data requiring a permit.
In this case, the BAG assumes that the works council is the recipient and that personal data is disclosed. Whether persons or bodies within a company are also considered recipients is still a matter of dispute, as the works council is endowed with special legal rights and obligations.
In this context, the classification of the works council as a recipient has implications for data controllers, for example in the implementation of data subject rights(Article 13ff) and in the context of the list of processing activities (Article 30).