Collection of employee quality and quantity performance data when using technical tools at the workplace - how far may the employer go in data processing? Where is the red line to impermissible employee monitoring? The decision of the Administrative Court Hannover (Ref.: 10 A 6199/20) opens up the collection and utilisation of versatile employee performance data to employers who communicate transparently and weigh up their interests.
The facts of the case
The plaintiff has its employees continuously document every work step by means of hand scanners and evaluates this data in real time via software. In addition to controlling the work processes, this data is also used for feedback discussions and decisions on the termination of employment.
The employer was officially prohibited from this uninterrupted use by the State Commissioner for Data Protection ("LfD") of Lower Saxony by order. The employer successfully sued against this, arguing that it had a legitimate interest in the collection and processing of data.
The ruling of the VG Hannover of February 9, 2023
In its reasoning, the court assumes that the collection and evaluation of the work steps in real time can be based on Art. 88(1) of the GDPR in conjunction with Sec. 26(1) sentence 1 of the BDSG, as it is necessary for the performance of the employment relationship or its termination. This is the only way that the employer can coordinate the tightly timed work processes and effectively counteract backlogs or idle time directly. A mere average consideration of the employees' performance was out of the question, as this was subject to considerable fluctuations.
The interference with the informal right of self-determination of the employees under Art. 8 CFR and Art. 2 (1) in conjunction with Art. 1 (1) GG associated with the data processing is not disproportionate to the legitimate interests of the employer. The reason for this is the employer's open communication to the employees regarding the collection and processing of the data, which only originates from the business sphere. In addition, no movement profiles but only performance profiles are created and the knowledge gained is only passed on to the management levels according to the "need-to-know" principle. The main purpose of the data collection is not to (secretly) monitor or even control employees, the court said in its reasons for the decision.
No permanent pressure to perform
The court also considers it essential that the permanent evaluation of the employees' performance does not create any pressure to perform and justifies this with the labour market. Since the labour market is increasingly developing into an employee market, a permanent fear of losing one's job and an associated permanent pressure situation cannot be assumed. It remains to be seen whether other courts will follow this line of argument.
Further exploitation
According to the court, the use of employee performance data for feedback discussions was in the interest of the employees. It was precisely the meticulous recording and evaluation that enabled the employer to give the employees targeted feedback.
Likewise, the court has no reservations about the use of the performance data obtained for the question of the term of office being extended. It draws a comparison to the performance evaluations used for judges for the question of tenure.
The decision in light of the ECJ's ruling on Art. 88 GDPR
As expected, in its recent decision of March 30, 2023, Rs. 34/21, the ECJ expressed concerns as to whether Sec. 26 (1) sentence 1 BDSG meets the requirements of Art. 88 DS-GVO.
The VG Hannover has already countered this decision in advance with the present decision and has stated that if Sec. 26 (1) sentence 1 BDSG is inapplicable, the lawfulness of the processing would only be given under the more far-reaching Art. 6 (1) lit. f DS-GVO. Here, too, further developments will have to be observed.
Conclusion for the practice
For employers, the ruling of the VG Hannover, against which an appeal to the OVG Lüneburg has been admitted, provides a basis for recording and creating performance profiles by means of data collection and‑ evaluation in real time. However, this requires open communication with the workforce and a "need-to-know" approach to the findings. A precise weighing of interests and their documentation, together with accompanying security measures and a data protection impact assessment, remains indispensable. The latter even if the personal aspects of the employees are not to be assessed.
However, it remains to be seen whether the labour courts will also follow this judgement on a broad scale. Different directions of protection collide in the intersection between labour law and data protection law. For example, in its ruling on "keylogger software" (ruling of July 27, 2017, ref. 2 AZR 681/16), the BAG ruled that measures taken by the company in which employees can be permanently monitored are generally considered disproportionate and thus impermissible.
Inevitable on the employer's side is a prepared and well-founded internal communication and information about the nature, scope and purpose of the data collection as well as the processing. Employers are advised to involve their works council, if any, as well as their data protection officer.
