According to Section 26 (1) BDSG, personal data may be processed if this is necessary for the establishment, implementation or termination of an employment relationship or for the exercise or fulfillment of other rights and obligations under employment law. The ECJ has ruled that this is not a "more specific" norm in the sense of Art. 88 GDPR and that Section 26 BDSG therefore no longer applies. Thus, the general legal basis of the GDPR also apply in the employment relationship, in particular Art. 6 (1) p. 1 lit. b) GDPR for processing that is necessary in the context of the employment relationship.
Background
The ruling has its origins in a legal dispute from the times of the Corona pandemic. Because of Corona, school lessons in the German federal state of Hessen were conducted via video livestream. The consent of the students or their parents has been obtained - while the "consent" of the teachers - so the Hessian Ministry of Education thought - was not required, because the teaching staff was in an employment relationship with the school. Logically, this has been based on Section 23 (1) sentence 1 of the Hessian Data Protection Act (HDSIG), according to which personal data of employees are processed, for example, if it is required for the establishment or implementation of the employment relationship.
Opening clause according to Art. 88 GDPR
The Main Staff Council of Teachers at the Hessian Ministry of Education and Cultural Affairs had a different opinion and filed a complaint against the Minister of the Hessian Ministry of Education and Cultural Affairs before the Administrative Court in Wiesbaden. It was complained, that the consent of the teachers concerned had not been obtained for the live streaming of lessons by video conference.
In response to this complaint, the Wiesbaden Administrative Court states that, in its view, Section 23 of the HDSIG and Section 86 of the HBG fall into the category of "more specific provisions" according to the intention of the Hessian state legislature. This means that with so-called "opening clauses" for certain provisions, the GDPR leaves room for EU member states to take into account their country-specific and national peculiarities by allowing national "more specific" (i.e. additional, stricter or restrictive) national provisions to supplement the GDPR. With Section 23 of the HDSIG, the German legislator has made use of such an opening clause of Article 88 (1) of the GDPR and thus of the possibility to adopt more specific regulations for employee data protection, which are intended to take into account the national particularities of the employer.
Doubts of the Wiesbaden Administrative Court prove to be correct
However, the Wiesbaden Administrative Court had doubts about the compatibility of Section 23 (1) sentence 1 HDSIG and Section 86 (4) HBG with the requirements of Article 88 (2) GDPR and therefore, against this background, suspended the proceedings in order to submit the following questions to the European Court of Justice for a preliminary ruling:
- Must a legal provision that is supposed to constitute a "more specific" national provision meet the requirements set out in Art. 88(2) GDPR?
- If a national provision clearly does not meet the requirements of Art. 88(2) GDPR, can it still remain applicable?
The ECJ confirms the doubts of the VG Wiesbaden. In its ruling of March 30, 2023, the European Court of Justice determined that Article 23 (1) of the HDSIG is contrary to European law (see ECJ, ruling of March 30, 2023 - C-34/21). This means that the almost identically formulated central federal provision of Section 26 (1) sentence 1 BDSG is also likely to be contrary to European law.
As a result, the ECJ ruled that Art. 23 (1) HDSIG is not a more specific norm in the sense of Art. 88 GDPR. Art. 6 (1) sentence 1 lit. b) GDPR is therefore the legal basis for processing that is required in the context of the employment relationship.
According to the ECJ, Section 23 HDSIG and thus also Section 26 BDSG do not differ from the general rules of the GDPR
According to the ECJ ruling, in order to be classified as a "more specific provision" within the meaning of Article 88(1) of the GDPR, a legal provision must meet the requirements of Article 88(2) of the GDPR. However, as the Advocate General already noted in his Opinion, provisions such as Section 23(1) HDSIG and Section 86(4) HBG, which make the processing of personal employee data conditional on it being necessary for specific purposes in connection with the performance of an employment or service relationship, appear to repeat the condition for the general lawfulness of processing already set out in Article 6(1)(b) GDPR, without adding a more specific provision within the meaning of Article 88(1) GDPR.
As a result, the ECJ ruled that national laws must remain inapplicable in the employment context if they do not comply with the conditions and limits set forth in the very same Art. 88 (1) and (2).
Conclusion and consequences for practice: What companies must observe in the future
The decision generally has practical implications for maintaining your record of processing activities. If you base processing activities in your record of processing on Section 26 (1) BDSG, you must observe the following:
If the corresponding processing is necessary for the employment relationship in any form (e.g., storage of bank data for payment of salary, etc.), then from now on the new processing must generally be based on Art. 6 (1) p. 1 lit b) GDPR instead of Section 26 (1) BDSG.
In addition, you should review your data protection notices for employees. If you have referred to Section 26 (1) BDSG in it, the legal basis should be changed to Art. 6 (1) p. 1 lit. b) DSGVO.
What happens next: The Federal Ministry of the Interior and the Federal Ministry of Labor and Social Affairs (BMAS) are currently in the process of creating new regulations for employee data protection and have already developed concrete proposals. The execution and implementation remains to be seen.
WTS Legal Rechtsanwaltsgesellschaft mbH will keep you informed.
