No Enforceable Co-Determination Right in Data Protection Law

No Enforceable Co-Determination in Data Protection

In practice, works councils frequently seek to co-determine in matters of data protection, particularly in the context of introducing new IT systems. This can lead to significant delays in implementation and, consequently, considerable costs for the employer. However, there is no enforceable co-determination right of the works council in data protection matters.

Proceedings before the Hesse Regional Labour Court

In a decision by the Hesse Regional Labour Court (LAG) dated 5 December 2024 (Decision 5 TaBV 4/24), the court ruled on the validity of an arbitration committee's decision. The matter concerned a works agreement regarding the introduction of a new personnel management system. The agreement included various provisions, such as those relating to the software's functionalities and the conditions under which performance and behavioural monitoring via log data would be permissible. While it contained individual provisions on data protection law, it lacked a comprehensive framework. The works council challenged the validity of the decision, citing deficiencies in data protection and inadequate provisions concerning the processing of employee data, particularly in the United States.

LAG Hesse: No Enforceable Co-Determination Right of the Works Council in Data Protection Matters 

The LAG upheld the decision of the Labour Court Fulda, confirming the validity of the arbitration committee's ruling. The arbitration committee's mandate is limited to matters in which the works council holds an enforceable co-determination right. Such a right does not exist in relation to data protection law. Although the works council has a general supervisory role and a right to information under Sections 80(1) and (2) of the Works Constitution Act (BetrVG) in the context of employee data protection, the formulation and fulfilment of data protection obligations are not subject to the arbitration committee's decision. These matters cannot be interpreted as falling within the scope of co-determination rights under Section 87(1), No. 1 or 6 BetrVG. According to Section 87(1), Sentence 1 BetrVG, co-determination rights only apply where the matter is not already governed by statutory provisions. While Article 88 of the General Data Protection Regulation (GDPR) and Section 26(4) of the Federal Data Protection Act (BDSG) allow employers and works councils to agree on more specific rules via a works agreement to ensure employee data protection, this does not constitute a co-determination right that may be enforced.

Implications for Practice

The decision of the LAG is undoubtedly favourable from the employer's perspective. Even in cases falling under Section 87(1), No.1 or 6 BetrVG, i.e. in matters relating to the organisation of the workplace and the conduct of employees, as well as the introduction and use of technical systems for monitoring behaviour or performance, data processing operations are regularly involved. Nevertheless, this does not result in a general enforceable co-determination right for data protection matters. Employers should bear this in mind during negotiations with the works council. They are not obliged to engage in negotiations over data protection details but must be able to justify the lawfulness of data processing operations.

In certain scenarios, it may be advisable to make use of the opening clause in Article 88 GDPR and Section 26(4) BDSG to voluntarily establish more specific rules on data processing within a works agreement, thereby clarifying the abstract general clauses of the GDPR. However, according to the case law of the European Court of Justice (ECJ), works agreements must not deviate from the core provisions of the GDPR (ECJ judgment of 19 December 2024, C-65/23), which significantly reduces the appeal of such agreements.

It remains to be seen whether other regional labour courts will follow the LAG Hesse's decision. In any case, the ruling already provides employers with a useful tool to curtail excessive negotiations with the works council regarding data protection in the context of IT system rollouts.