The core German legal basis for processing employee personal data was recently annulled by the European Court of Justice (CJEU). The practical implications should be limited though because in most cases there will be an alternative legal basis for data processing. However, the recent publication of a German government position paper laying out their intentions to further shape employee privacy governance may have a more significant impact.
Further regulatory action required following recent CJEU ruling
Article 88 General Data Protection Regulation (GDPR) enables member states to enact specific rules governing the processing of employees' personal data in the employment context. Germany has made use of Article 88 GDPR by enacting the German Federal Data Protection Act (Bundesdatenschutzgesetz; BDSG), which among other things, sets out specific purposes for processing employee data and the rules on obtaining consent. Following the recent CJEU ruling, the German legislator will have to revise the BDSG, adding another regulatory action item to those identified in the German government’s position paper.
On March 30, 2023 the CJEU ruled that a section of the Hessian Data Protection Act, which is identical to the one in the BDSG, does not constitute a ‘more specific rule’ within the meaning of Article 88 GDPR as it merely repeats the conditions set out in the legal basis for processing for the performance of contracts, set out in Art. 6(1)(b) GDPR (CJEU C-34/21).
Practical...
Congress leader Rahul Gandhi recently took his bogus ‘Vote Chori‘ claims to a new level and accused the BJP and the Election Commission of India (ECI) of “Party Chori” (Party theft). In a post mad...