Works council’s right to information in relation to sensitive personal employee data

In its decision of 9 April 2019 (ref. no.: 1 ABR 51/17), the German Federal Labor Court (BAG) took position on the right of the works council to request information from the employer according to Section 80 (2) of the German Works Constitution Act (BetrVG) and clarified what data protection restrictions such a request is subject to.

According to Section 80 (2) BetrVG, the works council has a right to request information from the employer to ensure, inter alia, that employee protection laws are respected. This includes provisions for the protection of pregnant employees. In the case at issue, the employer gave its employees the option of withholding this information from the works council. However, the works council maintained that its information and monitoring rights took priority. In its opinion, the employer must inform the works council without further request of any pregnancies known to it. This applies even if the respective employee has explicitly objected to this. Although the BAG was not able to decide the case conclusively, the judges clarified some important aspects for dealing with such requests for information from a works council:

Basic requirements for a request for information

The judges specified that the employer must provide the works council with comprehensive information in a timely manner, as per Section 80 (2) sentence 1 BetrVG, so that the latter could fully exercise its monitoring rights with respect to the employer. However, the prerequisites for such a request for information are, on the one hand, that it concerns a function of the works council and, on the other, that the requested information is necessary in the individual case concerned in order to perform the function. The works council must demonstrate this in detail. The right to information is strictly linked to the function and its scope is restricted by the principle of necessity. The works council must name the specific and normative occupational health and safety requirement. A simple general reference to standards of protection for pregnant employees is not sufficient. If the protection is only applicable in relation to specific operational conditions, these conditions must also be demonstrated. The example of nighttime work can be used to clarify this. If there are no provisions for nighttime work in the company, the works council cannot have any monitoring obligations in relation to the prohibition of nighttime work pursuant to Section 5 of the German Maternity Protection Act (MuSchG).

The permissibility of information under data protection law is not derived from Section 26 (6) of the German Federal Data Protection Act (BDSG). This provision is not a legal basis in itself. Section 26 (6) BDSG rather expresses that the protection of personal data of employees according to Section 26 BDSG and the rights of representation of staff councils complement each other. However, this neither restricts nor expands collective participation rights.

Protective measures by the works council

Rather, it might be considered as processing pursuant to Section 26 (3) sentence 1 BDSG. According to this provision, the processing of sensitive data, such as information on pregnancy, is, inter alia, permissible for the purposes of the employment relationship if it is necessary to comply with legal obligations arising from employment law. In this case, the employer has an obligation to inform according to Section 80 (2) BetrVG. However, according to Section 22 (2) BDSG, appropriate and specific protective measures have to be taken to safeguard the interests of the data subjects when processing sensitive data.

It must be noted that, when transmitting sensitive information to the works council, the employer itself cannot control compliance with the obligation to take appropriate and specific protective measures. The employer cannot impose any rules on the works council either, due to the independent nature of the latter. For this reason, when making a request for information that deals with sensitive data, it is incumbent on the works council to provide the employer with detailed information on how it will implement such measures. These measures may include, for instance, reliably ensuring that the data are secured, restricting access to individual members of the works council, etc. Should the works council not be able to specify such measures, the right to information is excluded. The court has clarified that, regardless of whether the works council is part of the data controller or not, the works council has an obligation to protect the data.

No right of objection for the data subjects

The court further specified that the objection of pregnant employees cannot prevent a – specific – request for information from the works council. The fulfillment of the functions assigned to the works council is not dependent on prior consent of the employees. The fulfillment of such tasks cannot be disposed of. Furthermore, the option of restricting data processing pursuant to Article 18 (1) (d) GDPR in conjunction with Article 21 (1) GDPR does not exist. The prerequisites of the right to object pursuant to Article 21 (1) GDPR are not met. The data are not disclosed and/or transmitted to the works council on the basis of Article 6 (1) (e) or (f) GDPR (performance of a task in the public interest or safeguarding the legitimate interests of the controller or of a third party), which would be required for the right to object to apply. Rather, the transmission is made on the basis of Article 9 (2) (b) GDPR in conjunction with Section 26 (3) BDSG.

Conclusion

The BAG has specified the restrictions which requests for information from the works council to the employer are subject to. The works council may only obtain personal data that are necessary for its statutory functions. In order for the employer, as the data controller, to be able to determine whether the data are necessary or not, the works council must present in detail what data is required for which specific function. The employer must also ask what protective measures the works council is implementing to ensure that the data are not used in an unauthorized manner. The BAG considers the explicit objection of the affected employees to be insignificant. Uncertain employers can use this judgment for guidance should they find themselves facing any further conflict between data protection and works constitution law.