Also works councils are obliged to safeguard employee’s data

Created by Jacob Keyl | |  Labor Law

In its decision dated 9 April 2019 (reference 1 ABR 51/17) the German Federal Labour Court (BAG) has made it clear that also works councils are obliged to ensure that employees’ personal data is protected. The BAG has ruled that works councils are obliged to ensure that the interests of employees, that are affected by data processing are always protected through adequate and specific protective measures, if his general right to information against the company (article 80 sec. 2 sent. 1 German Works Council Constitution Act (BetrVG)) contains a specific category of personal data (“sensitive data” as defined by the Data Protection Act). As the court pointed out safeguarding this type of data is the eligibility criteria for its request for information.

In the case underlying the decision a works council has demanded, that the employer (a company within the aerospace sector) shall inform the works council about every pregnancy that the em-ployer becomes aware of. As reason for their request for information the works council stated that it was their obligation as a board to monitor that the employer observes and complies with the protective duties applicable for pregnant employees (e.g. Maternity Protection Act).

The Labour Court as well as the State Labour Court have acceded the works councils’ request. However, the German Federal Labour Court (BAG) has overruled the decision of the State Labour Court, referred the case back to the State Labour Court and ordered the State Labour Court to take the following into account when taking its decision:

  1. As according to article 80 sec. 2 sent. 1 German Works Council Constitution Act (BetrVG) the requirement for a works councils’ request for information is, that it needs the requested infor-mation to fulfil their duties. It is not sufficient to file a very general reference stating that the requested information is essential for the employer to meet their “(protective) duties” towards their employees and workforce. For the request of information to be granted the works council has to provide a detailed statement on the normative employment protection specification he is going to monitor. Only if the works council provides a detailed statement and description of the task, it is possible to evaluated whether the requested information is necessary for the works council to fulfil their duties. 
  2. From a data protection point of view the works council is obliged to state that the requested information containing the sensitive item “pregnancy” and thus is protected by the General Data Protection Regulations as well as the Federal Data Protection Act is essential for the works council to fulfil their duties. If the works council is not able to state this successfully the works council is not entitled to receive and access the requested information as well as to process any data (collection of the sensitive item pregnancy) relating thereto. 
  3. When filing a request for information that contains sensitive data the works council has to outline that it has taken appropriate measures to protect the legitimate interests of the affected employees. When forwarding sensitive data to the works council the employer is no longer in the position to ensure compliance with the regulations regarding adequate and specific protective measures as stated in the regulations of the Data Protection Act (article 26 sec. 3 sent. 3 in connection with article 22 sec. 2 Federal Data Protection Act (BDSG)). As the em-ployer is not in the position to set any respective requirements regarding data protection due to the independence of the works council, the works council is obliged – even before coming into possession of the sensitive data – to describe that respective protective measures are taken to safeguard the data. This includes ensuring that the data is kept strictly under lock at all times, access rights are limited (for example by restricting the access rights to individual members of the works council) and the data is deleted after the monitoring task has been completed. If these protective measures are missing or inadequate the works councils’ request for information from the employer is excluded.

Practical tip

Employers should always check 

  • Whether the information requested by the works is really necessary to fulfil their duties. For this purpose, it is essential that the works council specifically states what “normative employment protective specifications” he intends to monitor. A general reference to the “existing (protection) obligations is not sufficient;
  • whether the works council can ensure “adequate and specific data protective measures” re-quired by the relevant data protection regulations when provided with the sensitive data it re-quested.

Back