LAG Berlin-Brandenburg - 10 Sa 2130/19
From GDPRhub
| LArbG Berlin-Brandenburg - 10 Sa 2130/19 | |
|---|---|
 | |
| Court: | LArbG Berlin-Brandenburg (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 4(14) GDPR Article 9(1) GDPR Article 9(2)(b) GDPR Article 88 GDPR Article 31 CFR § 26 Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) |
| Decided: | 04.06.2020 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 10 Sa 2130/19 |
| European Case Law Identifier: | ECLI:DE:LAGBEBB:2020:0604.10SA2130.19.00 |
| Appeal from: | ArbG Berlin (Germany) Az. 29 Ca 5451/19 |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Entscheidungen der Gerichte in Berlin und Brandenburg (in German) |
| Initial Contributor: | n/a |
The Berlin-Brandenburg Regional Court for Labour Law held that an employer could not rely on Article 9(2)(b) GDPR to install time-tracking system which uses the fingerprints of employees.
English Summary
Facts
The employer runs a radiology practice and until 1 August 2018 had been using printed time sheets to keep track of how many hours the employees had worked. The employee who is a party to the case has refused to use the new fingerprint time-tracking system, and continued to manually write down the worked hours on the old time sheets. The employer then issued several warnings to the employee, urging him to use the new system.
On 5 October 2018, the employee received a first written warning from his employer, urging him to start using the fingerprint system. Despite the warning, he refused to do so and continued using the printed time sheets. On 26 March 2019, the employee received a second warning which threatened with the possibility of immediately terminating his employment if he continues to refuse using the fingerprint system.
Dispute
Were the employer's warnings rightfully issued, and the processing of the fingerprint data lawful in accordance with Article 9(2)(b) GDPR?
Holding
Both courts decided that the employer had to remove the warnings issued towards the employee, and that the employee was not obliged to use the fingerprint system and therefore did not violate his duties.
The courts first stated that the only possible legal grounds for the processing operation could be Articles 9(2)(a) or (b). As the employee clearly did not give his consent, the courts did not elaborate further on Article 9(2)(a). With regards, to article 9(2)(b), the first instance court (ArbG Berlin) carried out a three-step assessment, based on:
- the suitability of the biometric procedure for the purposes of the employment relationship - whether there were less intrusive means of attaining the purpose - a comprehensive weighing of interests
The court concluded that an employer's interest in biometric access control systems to areas with sensitive business, production, and development secrets would be more likely to prevail than in the context of a time-tracking system. Therefore, in this case the system was not considered to be necessary, despite the employer's claims that the system could make it more difficult for employees to manipulate the records of working hours. The employer could therefore not rely on Article 9(2)(b) GDPR.
The LArbG Berlin-Brandenburg also confirmed that the processing was not necessary in light of Article 9(2)(b) GDPR, and emphasised that the question of whether appropriate technical and organisational safeguards, such as pseudonymisation, are taken only comes up if the necessity of the processing operation is first affirmed and it is established that there are no conflicts with interests of the data subject worthy of protection. Furthermore, the court pointed to the fact that the employer had mentioned in July 2018 that there could still be a possibility to write down the working hours in case the fingerprint system will not work well, and that using another version of the system which does not process fingerprint data could also be possible.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Biometric time recording - compulsory preventive medical checkup guiding principle 1) As a rule, a biometric time recording system is not required in the sense of Art. 9 para. 2 lit. b DSGVO, § 26 para. 3 BDSG. 2) The order of a compulsory occupational health examination is only permissible as a measure as a result of a risk assessment in accordance with § 5 ArbSchG. (§ 3 para. 1 ArbMedVV). Tenor I. The defendants' appeal against the judgment of the Berlin Labor Court of October 16, 2019 - 29 Ca 5451/19 is dismissed. II. The defendant shall bear the costs of the appeal. III. The value of the fees for the appeal proceedings is set at EUR 7,298.61. IV. The appeal is not allowed. Facts of the case 1 The parties are in dispute over the effectiveness of three warnings in connection with biometric time recording and a preventive medical check-up. 2 The plaintiff is 57 years old (geb. ... 1962) and since 1 June 2007 with the deplored one and/or its legal predecessor, which operates a radiological practice, as medical-technical radiology assistant (MTRA) with last 2,432.87 EUR gross monthly employed. Pursuant to § 2 (2) of the employment contract, the employer reserves the right to employ the plaintiff in other areas of work and to assign him reasonable tasks that correspond to his training, skills and professional experience, if this is required for operational reasons or reasons related to the person or behavior of the employee. 3 Up to now, the defendant's employees entered both their working hours and their desired assignments by hand on the printed and displayed duty roster. As a rule, the handwritten working hours also showed hours of overtime worked. Occasionally, deviating working hours were provided verbally. 4 In order to ensure a completely correct time recording for accounting purposes and to be able to create a weekly duty roster that also corresponds to the employees' wishes, the defendant introduced the time recording system Model "ZEUS" of the company I. GmbH on August 1, 2018, together with a personnel deployment planning. Whether this system works flawlessly is disputed between the parties. A terminal "IT 8200 FP" also belongs to the system. 5 This system uses a biometric fingerprint identification according to the data sheet provided to the employees. In concrete terms, this is described as follows in the product sheet of company I: 6 Biometric recognition 7 The procedure used by I. for identification or verification by means of a fingerprint stores only the minutiae (coordination of the intersection points) of a fingerprint. 8 It is not possible to read out the data due to appropriate protective measures. Within the IT 8200 FP there is only a record number and the corresponding minutiae. A reference to a natural person cannot be established. 9 In an e-mail of July 27, 2018 to the employees, they were informed, enclosing a data sheet and a declaration of conformity, that the new time recording system of Company I. would be put into operation as of August 1, 2018. It was pointed out that the system does not store fingerprints, only minutiae. These would be converted into a numerical code. However, neither the minutiae nor a fingerprint could be reproduced from this code. It was also not possible to read this numerical code from the system. 10 As of August 1, 2018, only the working times determined by time recording would be valid. It was also announced that from September 1, 2018, the duty roster will also be created using this system. 11 The plaintiff did not use the time recording system in August and September 2018. He continued to record his working hours in the previous form. The defendant then issued a warning to the plaintiff on October 5, 2018. This essentially reads as follows: 12 in the previous week, we gave you written instructions to use the time recording system ZEUS to record the start and end of your work Unfortunately, we can see from the missing entries in the time recording system that you are still resisting this instruction today. Therefore, we are now unfortunately forced to issue you with a warning. 13 We once again urge you to fulfill your official duties by using the time recording system ZEUS with the corresponding fingerprint scanner properly from now on. If you continue to disobey our instructions, we will take further action under labor law, including termination. 14 After the plaintiff continued to refuse to use the time recording system, the defendant issued a second warning to the plaintiff under March 26, 2019. This essentially reads as follows: 15 Unfortunately, we have noticed that you are still not using the time recording system ZEUS to record your start and end of work despite our written request and our warning dated October 5, 2018. The use of the time recording system is necessary for the correct management of your hours and vacation account in connection with duty scheduling. Therefore, we are now unfortunately forced to issue you with a final warning again and to ask you to fulfill your official duties by using the time recording system ZEUS with the corresponding fingerprint scanner properly from now on. 16 If you still do not follow our instructions, we will take further measures under labor law. Immediate termination is also possible in case of continued violation. 17 In addition, the plaintiff received a third warning, also dated March 26, 2019, for failing to take advantage of a preventive medical examination ordered by the defendant. The warning letter essentially reads as follows: 18 Unfortunately, we have found that on March 20, 2019, you refused to undergo the prescribed company medical examination organized by the company for the entire MTRA team without giving any reasons, even though the company physician had expressly pointed out the mandatory nature of the examination. As you are aware, you will not be able to carry out your job without the regular examination of your health suitability. We therefore warn you and ask you to make up for the required examination outside working hours. 19 If you do not complete the examination in time, we will have to terminate the employment relationship on our part, as you will then no longer be allowed to be employed as an MTRA. 20 The plaintiff does not consider the warnings to be justified and requests their removal from his personnel file. Regarding the first two warnings there is no data protection-legal permission for a time registration under use of the biometric data of the plaintiff. It is denied that there were any problems with another time registration at the parent company. 21 The plaintiff also considers the third warning to be ineffective, as he has no obligation to take part in this investigation. There is neither a tariff nor a contractual obligation to it. The plaintiff neither works with infectious substances nor does he work in a laboratory or come into contact with patients from whom blood must be taken or contrast medium injected. He works exclusively on the computer. The activities listed in the Annex, Part 2, Paragraph 1, Point 3 lit bb ArbMedVV have never been assigned to the plaintiff. The plaintiff rather sits at the PC and examines the respective patient, who was assigned to him by the physician. He never injects contrast media. Sedative syringes, saline solutions or similar. He never comes into contact with body fluids. He never pulls a cannula from his arm. In the case of the defendant's legal predecessor, this had been the task of the physician. Even now, the plaintiff was not standing by when the doctor injected contrast medium. The plaintiff does not lead also no preliminary clarifying discussions. However it stores the patients in the equipment, does not come there however with the body fluids into contact. After § 2 exp. 1 No. 3 ArbMedVVV the participation in an investigation is voluntary. It is unusual that the study was not considered necessary between 2007 and 2018. 22 The defendant assumes a data protection permission regarding the time recording with the minutiae of the plaintiff. The fulfillment of the employment contract between the parties depends to a large extent on the observance of the agreed working hours. The deplored one decided for this system, because it seizes the necessary data (beginning and end of work) manipulation-safe. The experience of the defendant's parent company with different time recording systems as well as with the identical system in question at several locations has shown that all other recording methods (transcripts, entry of identification numbers, electronic chip cards, etc.) can be manipulated with little effort and thus the time actually spent cannot be verified and recorded without error. In addition, the system is directly linked to duty scheduling. 23 The defendant believes that the plaintiff would be obligated to the specified investigation according to the ArbMedVV. During practice of its activity the plaintiff has direct patient contact. The deplored one as an employer has the obligation to let examine the persons employed among other things in regular intervals of maximally three years industrial-medically with being present certain endangerment on the job. 24 In order to reduce the risk of infections, both in relation to oneself and patients, and to prevent the spread of infectious diseases, the "Precautions for activities involving a risk of infection" are legally required for employees in medical practices according to the ArbMedVV (§ 4). This obligation is set out in the appendix "Occupational Medical Preventive Care", part 2, point 3, letter d. The G 42 prescribed there is relevant for the plaintiff. This consists of blood sampling, blood analysis and urine test. 25 If the mandatory examination is not initiated or not initiated in time, an administrative offence is present on the one hand if the plaintiff continues to be used as an MTRA with direct patient contact. Without the investigation quasi an employment prohibition for the deplored one exists opposite the plaintiff. Anyhow appendix part 2, exp. 1 number 3 lit bb ArbMedVV is relevant for the plaintiff. Since the plaintiff is employed as MTRA, this standard is relevant. The fact that he works only on the computer, is not applicable. The plaintiff had direct access to the patients, e.g. when storing the patient in the large radiological equipment and when injecting saline solutions and/or contrast agents by cannula/syringe, which was necessary in 20-40% of the patients. 26 In its ruling of October 16, 2019, the Labor Court upheld the complaint and ordered the defendant to remove the warnings. The plaintiff had not committed any breach of duty. He was not obliged to use the time recording system ZEUS with his biometric data. Therefore the first two warnings are ineffective and must be removed from the plaintiff's personnel file. 27 In terms of data protection law, the minutiae data set is biometric data in accordance with Article 9 (1) of the Basic Data Protection Regulation (DSGVO) and special categories of personal data in accordance with Section 26 (3) of the Federal Data Protection Act (BDSG). It is inherent in these data that processing them could violate the privacy of the employee and thus the right to informational self-determination to a particularly great extent. The processing of biometric data - and thus also of minute data records - is therefore fundamentally prohibited under Article 9 (1) of the DPA. However, Article 9 para. 2 DSGVO contains several elements of permission, which (exceptionally) allow processing. In particular, the elements of permission "necessity", "voluntary consent" and "collective agreement" are relevant under labour law. Since there is no collective agreement and no consent of the plaintiff, it depends on whether the processing of the biometric data is necessary within the scope of the purposes of the employment relationship within the meaning of Section 26 (1) BDSG so that the defendant can comply with the rights and obligations arising "from employment law, social security law and social protection law". The collection and use of biometric features must meet the following requirements within the framework of the three-step examination: 28 1. the biometric procedure must be suitable for the purposes of the employment relationship, i.e. it must actually be possible to promote the purpose related to the employment relationship. 29 2. no other equally effective means that less impairs the right of personality may exist. 30 3. as a result of a comprehensive weighing of the interests and fundamental rights of the employee and the employer that are worthy of protection, the impairment of the employee's personal rights by the biometric procedure must be in reasonable proportion to the intended purpose of the data use. 31 The following rule applies: The more intensively the right of personality is to be interfered with, the more serious the concrete purpose pursued by the employer with the procedure must weigh. Thus the interest of the employer in a biometric access control to areas with sensitive business, production and development secrets will rather outweigh than with a desired access protection to normal office areas. For example, biometric data could be used to control access to secure areas, but not for timekeeping. 32 Even if misuse of time recording systems may occur occasionally due to incorrect entries or, in the case of a stamp card, due to colleagues "stamping along", it is nevertheless generally assumed that the vast majority of employees act in accordance with the law, i.e. there is no reason for this type of control. It could be different if concrete circumstances in the individual case (evidence of abuses to a not inconsiderable extent) could justify the necessity of such a measure. However, the defendant had not submitted any such evidence. It had neither submitted that the previous "manual" system of time recording had been subject to considerable abuse, nor had it been able to demonstrate that in the case of the introduction of another time recording system (without the storage of biometric data) abuse was to be feared to a considerable extent or even only to a significant extent. It had also not been shown that the plaintiff had attracted negative attention in the past through false statements regarding his working hours. 33 Also the third warning is ineffective and therefore from the personnel file of the plaintiff to remove. The plaintiff did not offend against any obligation to participate in a medical examination. 34 A collective or individual contractual obligation is not relevant in this case. However, an obligation to carry out an examination pursuant to Annex Part 2 Paragraph 1 Number 3 lit. bb ArbMedVV could be considered. The prerequisite would then be that the plaintiff must carry out activities in which contact with bodily fluids, bodily excretions or bodily tissue could occur regularly and on a large scale, in particular activities with an increased risk of injury or a risk of splashing and aerosol formation, with regard to hepatitis B virus or hepatitis C virus. 35 This can be negated for the plaintiff without further ado. The deplored one maintains that the MTA with patients would come into contact and beside it would stand, if the physician injects contrast medium, whereby it can come also to the leakage of body fluids. Furthermore, the MTA pulled the cannula out of the arm after the examination. 36 However, the plaintiff had disputed these statements for his person. But even if one assumes that the relevant data of the deplored ones from the chamber date are correct, then the conditions for the obligation to examine are nevertheless not given. The standard requires that activities are carried out in which contact with bodily fluids, bodily excretions or bodily tissue can occur regularly and to a greater extent. 37 This could not be affirmed here. It is not evident that in the course of the plaintiff's activities there is regular and extensive contact with body fluids, body excretions or body tissue. Only quite exceptionally - so the deplored one - with the spraying of contrast media possibly an escape of body fluids can come into consideration, likewise with the pulling of the cannula from the arm. 38 In any case however the deplored one did not take up any proof also for the fact that concretely the plaintiff comes in such a way into contact with the patients. This applies all the more, since the plaintiff substantiated represented that he does not have evenly exactly this patient contact. He merely laid patients on the MRI machine. Also in the context of its personal questioning the managing director of the deplored one, Mr. M., only represented that the MTA stands beside it, if the physician injects contrast medium. Furthermore, the MTA pulled the cannula out of the arm after the examination. However, the managing director did not explain whether this also applied specifically to the plaintiff. He had only given a general presentation on the activities of the MTA in his practice. 39 The defendant filed an appeal against this judgment, which was served on the defendant's representative on November 18, 2019, on December 17, 2019, and after extending the deadline for giving reasons for the appeal accordingly, filed it on February 17, 2020. The labor court had overstretched the requirements for possible abuses in time recording. It was already unclear what the labor court regarded as abuse "to a considerable extent. An employer does not first have to tolerate abusive entries of working time to a certain extent before he can use a forgery-proof time recording system. The defendant had submitted that there had been misuse of other technical time recording systems in another affiliated company. Since the system is introduced for all employees, any misconduct on the part of the plaintiff is irrelevant. Card systems and other systems could, for example, falsely simulate attendance by handing over the cards to colleagues. 40 The labor court had only taken the interests of the plaintiff into account. The defendant had argued that the experience of its parent company with various time recording systems, including digital ones, using chip cards or transponders had shown that records of working hours could be manipulated with little effort. Employees had repeatedly given their chip cards or personnel numbers to colleagues, who then fed the time recording system with incorrect attendance times. Based on the experience with the analogous paper duty roster in Berlin, it is to be expected that the manipulation of the time recording by chip card will be continued, since it is technically just as simple. Also, the target working times are stored in the system that has now been introduced. These were previously extended or reduced on a regular and untraceable basis. 41 The defendant does not always have a practice manager on site who can check the actual presence. The company, which is active nationwide and to which the defendant belongs, wants a uniform recording of attendance times by means of fingerprint scanners. The personnel would be uniformly controlled by the group personnel department. This was a legitimate interest and also in the interest of the employees, who would be given opportunities for advancement within the Group. In the long run, time recording using finger scanners is cheaper than maintaining a smart card system, which has to be replaced or reprogrammed if a card is lost. Even if the chip card is forgotten or lost, it is not possible to record working hours accurately. 42 Further aspects for the system are the fact that sensitive health data is kept by the defendant. Therefore, it must be able to determine in a forgery-proof manner which employees actually stayed in the practice rooms at what time. 43 In view of the risks of infection, precise time recording is necessary to be able to clarify infection chains. This would serve to protect the other employees and patients. 44 There are no milder means that would guarantee protection against manipulation. The purpose pursued by the defendant was to set up an objective, reliable and accessible system that recorded working hours in a tamper-proof manner and to the minute. This purpose is apparent from the most recent ECJ case law on working time recording. On the other hand, the system should guarantee transparency and be accurate. It should automatically calculate the working hours and overtime, enable vacation planning, create control possibilities for the employer and thus facilitate time management and save costs. In the balancing process, it should be taken into account that the defendant has also taken special security measures in accordance with § 22 BDSG to protect the interests of its employees. No fingerprints are stored, but only the minutiae of the fingerprint, although, according to the defendant in the appeal hearing, these are not biometric data in her opinion. Protective measures would prevent the data from being read out, e.g. for the purpose of allocation to fingerprints. And at the terminal, pseudonymization takes place because only a record number, i.e. a code for the employee, is stored. This means that no link can be established between the minutiae and a natural person. 45 The labor court also made an erroneous ruling on the third warning. The explanations of the plaintiff in the chamber hearing before the labor court had been wrong. The removal of a cannula from the arm of a patient is a task of the plaintiff under the employment contract and this was also noticed by him. This is also present, if contrast media were administered. The contrary statement of the plaintiff is wrong. The plaintiff is employed as MTRA. It is not necessary that the plaintiff actually regularly comes in contact with the substances specified in the appendix part 2 exp. 1 number 3 lit. bb ArbMedVV. It is sufficient an abstract danger. 46 Defendant and appellant requests that the Court 47 vary the judgment of the Berlin Labor Court of October 16, 2019 - 29 Ca 5451/19 to the extent that the defendant was ordered to pay the warning issued on October 5, 2018, which was received by the plaintiff on October 5, 2018, the warning issued on October 26, 2018, which was received by the plaintiff on October 5, 2018 March 26, 2019, the written warning regarding the company medical examination received by the plaintiff on March 26, 2019, and the written warning regarding the time recording received by the plaintiff on March 26, 2019, to be removed from the personnel file and the action to be dismissed to that extent. 48 The plaintiff and appellant claims that the Court should 49 dismiss the appeal; 50 The plaintiff denies an abuse of the time registration in the past. The fact that a system is manipulable is not sufficient. The plaintiff also denies that the FP system is cheaper than a smart card system. The desire of the company for the system used here is not yet a data protection purpose. Why FP time recording is necessary for the protection of health data was not presented by the defendant. The fingerprint reader increases the risk of infection for employees. 51 Regarding the third warning, the plaintiff replies that he has never administered liquids by injection and will not do so in the future. It is not apparent that the plaintiff has regular and extensive contact with the patients' body fluids. Contrary to the opinion of the deplored ones it concerns also not around an occupational fitness of the plaintiff, but around early recognizing occupation-conditional illnesses. 52 With regard to the further submissions of the parties in the appellate instance, reference is made to the content of the defendant's statement of grounds of appeal dated February 17, 2020, as well as to the written statement dated May 22, 2020 and the content of the plaintiff's answer to the appeal dated March 23, 2020, as well as to the minutes of the hearing dated June 4, 2020. Grounds of the decision I. 53 The appeal of the defendant, which is admissible according to § 64 para. 2 ArbGG, has been filed and substantiated in due form and time in the sense of §§ 66 para. 1 ArbGG, 519, 520 Code of Civil Procedure (ZPO). II. 54 The appeal is admissible but not substantiated. Because the deplored one did not succeed in demonstrating that the plaintiff with the behavior reprimanded in the three warnings hurt its obligations under the employment contract. In the result and also in the reasoning no other evaluation is justified than in first instance. The regional labor court follows the labor court Berlin regarding the reasoning and refrains to that extent in accordance with § 69 exp. 2 ArbGG from a only repetitive reasoning. The attacks of the appeal are not suitable to judge the legal situation differently. 1. 55 Contrary to the view expressed by the defendant in the appeal hearing, minutiae are biometric data. Minutiae are "only" finger line branches, so that the fingerprint belonging to them is not processed "as a whole". However, according to Art. 4 No. 14 of the European Basic Data Protection Regulation (DSGVO), biometric data are all personal data obtained using special technical procedures, including data on the physical and physiological characteristics of a natural person that enables or confirms the unique identification of that natural person. This is the case with minutiae. 2. 56 With its argumentation in the appeal, the defendant fails to recognize the regulatory content of the DSGVO. As the Labor Court has already emphasized, Art. 9 para. 1 DSGVO expressly states that the processing of biometric data for the purpose of unambiguously identifying a natural person is prohibited. As the Labor Court has also pointed out, Art. 9 para. 2 DSGVO does permit individual exceptions to this principle. In this case, only the exception under Art. 9 para. 2 lit. b DSGVO is applicable. According to this provision, the processing must be necessary in order for the defendant or plaintiff to be able to exercise the rights conferred on them by employment law and to comply with their obligations in this respect, insofar as this is permissible under Union law, national law or a collective agreement. 2.1 57 According to the most recent case-law of the European Court of Justice (ECJ) of 14 May 2019 in Case C-55/18, which was not yet known at the time of the warnings at issue in this case, Articles 3, 5 and 6 of Directive 2003/88/EC of the European Parliament and of the Council of 4 November 2003 concerning certain aspects of the organisation of working time, in the light of Article 31(1) of that directive, require the application of the provisions of Article 31(1) of Directive 2003/88/EC to the organisation of working time in the light of Article 31(1) of Directive 94/55/EC. 2 of the Charter of Fundamental Rights of the European Union and Articles 4(1), 11(3) and 16(3) of Council Directive 89/391/EEC of 12 June 1989 on the introduction of measures to encourage improvements in the safety and health of workers at work, require employers to establish a system for measuring the daily working time of each worker. 58 Although the defendant has stated that the main objective of the introduction of the time recording system Model "ZEUS" of the company I. GmbH together with a terminal "IT 8200 FP" is the prevention of working time manipulation and not the securing of fair and reasonable working conditions, as provided for in Art. 31 GRCh, in particular by limiting the maximum working time and the observance of daily and weekly rest periods. Nevertheless, according to the norms mentioned in the previous paragraph, an employer is obliged to establish an objective, reliable and accessible system to measure the daily working time performed by each worker. 59 However, it is not evident that an objective, reliable and accessible system requires the processing of biometric data of the claimant (or other employees). In paragraph 63 of the ECJ decision of 14 May 2019, the Court explicitly referred to paragraphs 85-88 of the Advocate General's Opinion. The Advocate General expressly stated in paragraph 87: 60 In this respect, it should be noted that current technology allows for a wide variety of systems for recording working time (paper records, computer programs, electronic time cards). 61 It is true that Art. 88 DSGVO permits additional national regulations on data processing in the employment context. The German legislator has made use of this in § 26 BDSG. However, the general provisions of the DSGVO also apply to the processing of data in the employment context. The opening clause in Art. 88 DSGVO is not an exception in the sense that the scope of application of the regulation is limited per se (see, for example, Nolte in Kommentar zur Datenschutzgrundverordnung, ed. von Gierschmann et al., Art. 88 RN 9). The standard for processing biometric data in the employment context is no different from that outside the employment context (Nolte, ibid. RN 13). Art. 88 DSGVO only permits a concretization or specification, but not a deviation or modification (Nolte, ibid. RN 19 with further details). 2.2 62 In a second step, it must therefore be examined whether the processing of biometric data of the plaintiff during time recording is "necessary" so that the defendant or plaintiff can exercise their rights or fulfill their obligations. In the explanatory memorandum to § 26 BDSG, the German legislator stated that the conflicting fundamental rights positions for the establishment of practical concordance must be weighed up in the context of the necessity test. The interests of the employer in data processing and the personal rights of the employee must be carefully balanced, taking both interests into account as far as possible (BT-Drs. 18/11325, p. 97). 63 In addition to the proportionality test in the context of necessity, there must be no reason to assume that the interests of the employees concerned worthy of protection outweigh the interests of the responsible employer in the processing (BT-Drs. 18/11325, p. 98). Only if this necessity and the statement that the interests of the data subjects worthy of protection do not conflict with each other should be affirmed in principle, does it depend on the "suitable guarantees for the fundamental rights and interests of the data subject" also stated by the defendant, i.e. technical and organizational precautions such as anonymization, pseudonymization and access restrictions to the biometric data of the plaintiff. 64 "Required" is a technical system that affects the personal rights of a person only if a legitimate purpose is pursued and no equally effective means that are less restrictive of the personal rights are available to achieve this purpose (BAG dated April 25, 2017 - 1 ABR 46/15). The Labor Court also correctly based its decision on this. 65 In the grounds of appeal on page 10, the defendant expressly stated, albeit perhaps inadvertently, that in addition to the terminal "IT 8200 FP" for the time recording system Model "ZEUS" of the company I. GmbH, there is also a terminal with the designation "IT 8200". This is an ID card reader system, i.e. a system without the use of biometric data of the plaintiff, which was confirmed by an internet research. This is to be operated with chip cards and transponders and other readable identification cards. 2.2.1 66 The deplored one stated that the time recording system in the enterprise (with biometric data among other things of the plaintiff) was to be operated, because in this system already the target working times were deposited, which had been extended or reduced before in the paper system regularly and not comprehensibly. This functionality would be just as completely usable with the terminal IT 8200, without processing biometric data of the plaintiff. 2.2.2 67 The defendant has further explained that the nationwide active group, to which the defendant belongs, wishes a uniform recording of attendance times by means of fingerprint scanners. The personnel would be uniformly controlled by the group personnel department. This was a legitimate interest and also in the interest of the employees, who would be given opportunities for advancement within the Group. Even if it is not entirely understandable why attendance times are relevant for the promotion opportunities of employees, this effect could in any case also be achieved with the IT 8200 terminal. 2.2.3 68 The defendant has also stated as a legitimate interest that time recording by means of finger scanners is cheaper in the long run than the maintenance of a chip card system, which has to be replaced or reprogrammed in case of card loss. The deplored one did not bring forward closer data for the calculation of the two variants, although the plaintiff in the statement of appeal from 23 March 2020 expressly denied that a finger mark system is to be operated more inexpensive and in the long run more favorably than a chip card controlled system. Therefore, in the absence of a corresponding presentation of facts by the defendant in these proceedings, it is not clear whether and, if so, which cost savings could justify the processing of biometric data of an employee. 2.2.4 69 The defendant has indicated a further interest in the use of the system by stating that even if the chip card is forgotten or lost, the working time cannot be recorded without error. However, the defendant itself already assumed in an information mail of July 27, 2018 to the employees that there could also be situations of non-functioning with the IT 8200 FP terminal. There the defendant had explicitly stated: 70 "If the time recording does not work, please write down the working hours. These will then be entered into the system later. Doreen will take care of these tasks in the future ..." 71 Even if the defendant were to assume that employees of the defendant would forget or lose chip cards to a relevant extent, it would be up to the defendant to considerably minimize the risk of forgetting or losing them by using smaller transponders that could be connected to the key ring. Moreover, the court of appeal does not understand why, in the event of a technical failure of the system, manual recording should be sufficient, but not in the event of a human failure (of the system). In all other respects it would not be naturally also not refused to the deplored one to sanction an actual wrong behavior of the plaintiff. Since the plaintiff does his work together with other employees (and patients), it is not evident that any manipulation of working time in the enterprise would remain undiscovered even without practice managers who are permanently present. 2.2.5 72 Further aspects for the system of the processing of biometric data of the plaintiff were named by the defendant with the fact that sensitive health data would be kept with the defendant. Therefore it must be able to determine forgery-proof, which coworkers would have actually been at which time in the practice areas. 73 Apart from the fact that the defendant did not present any facts according to which the plaintiff or other employees would pose a risk to sensitive health data of the patients, it is to be assumed that the defendant did not openly store the health data of the patients, which like the biometric data of the plaintiff are recorded as special categories of Art. 9 DSGVO, in the practice rooms, but also secured them against unauthorized access within the practice rooms. But even independently of this, it is not clear to what extent a forgery-proof time recording system would particularly protect the patient data in the practice rooms. The defendant has neither explained in detail how patient data is stored nor to what extent it is at risk. However, even if this were the case, an access control system would at best be suitable for documenting entry to the practice rooms. A time recording system that (only) documents the authorized presence is unsuitable for this purpose. In this respect, the defendant's submission on the protection of patient data is not suitable to justify justified interests in the processing of biometric data of the plaintiff. 2.2.6 74 Finally, the defendant has stated that, in view of the risks of infection, accurate time recording is necessary to be able to clarify chains of infection. This would serve to protect the other employees and patients. However, the Federal Labor Court has decided that hazards at work must either be established or must be determined within the framework of a risk assessment in accordance with § 5 ArbSchG (or § 4 BioStoffVO or § 6 GefStoffVO) in order to derive necessary measures (BAG dated March 28, 2017 - 1 ABR 25/15). Admittedly, this was a decision on the scope of the powers of a conciliation body under § 76 BetrVG. However, since co-determination in the area of § 87, Subsection 1, No. 7, BetrVG, only applies if an employer has a duty to act, these principles also apply in a company without a works council. However, the defendant has neither presented facts from which fixed hazards result, which would require the clarification of a chain of infection as a necessary measure in the sense of § 3 ArbSchG, nor has the defendant presented the result of a risk assessment, which would require the clarification of a chain of infection as a necessary measure. 2.2.7 75 Thereafter, the only thing that remains is the demand of the defendant to exclude any manipulation in the time recording. The defendant rightly points out that an employer does not have to tolerate abusive entries of working time to a certain extent before he can use a forgery-proof time recording system. However, due to the fundamental prohibition of the processing of biometric data, the defendant has to demonstrate the necessity of the processing of biometric data on the basis of facts according to Art. 9 Para. 2 lit. b DSGVO as well as according to § 26 Para. 3 BDSG. 2.2.7.1 76 The defendant has submitted that, based on the experience with the analog paper duty roster in Berlin, it is to be expected that the manipulation of the duty roster by means of a chip card will be continued, since this is technically just as simple. The court of appeal is not able to follow this. This is because paper documentation can be changed at any time by overwriting, adding and/or deleting it using correction fluid. The electronic system "ZEUS" of the company I. GmbH stores the respective bookings as far as possible without biometric data of the plaintiff, so that it is always traceable when which entry was made. 2.2.7.2 77 The defendant's argument that a time recording system using a chip card or transponder system does not rule out the possibility that employees may pretend to be present without actually being present is correct. However, apart from the facts described under 2.2.4, this is likely to constitute working time fraud and thus a criminal offence. 78 If, however, personal data of employees may only be processed for the detection of criminal offences in accordance with § 26 (1) sentence 2 BDSG if "actual indications to be documented" justify the suspicion, this must apply all the more in the case that, in order to avoid criminal offences, the continuous processing of specially protected biometric employee data is to take place. This encroachment on fundamental rights is of high intensity due to the stipulation in § 9 DSGVO and can already be disproportionate as such if the reason for the encroachment is not sufficiently significant. Insofar as the intervention serves to avert certain dangers, the weight of the reason for the intervention depends to a large extent on the rank and type of danger to the protected goods (see also BVerfG of 27 February 2008 - 1 BvR 370/07, 1 BvR 595/07). 79 The statement of the deplored ones that it had come in a connected other enterprise to abuses with other technical time recording systems, did not explain the deplored one despite denials of the plaintiff more near. The fact that card systems and other systems would falsely simulate presences, for example by handing over the cards to colleagues (and the criminally relevant use by them), is correct. Why it is to remain undiscovered however in the enterprise of the deplored ones in Berlin, if the plaintiff (and/or other coworkers) appears too late or goes prematurely contrary to the duty roster and/or the planned working time deposited in the system, is not to be inferred from the lecture of the deplored ones. Even if, according to the defendant's presentation, a practice manager should not always be on site, the other employees are on site. That these would not notice a possible understaffing is not evident from the defendant's presentation. 2.3 80 According to all of the above, the defendant has not presented any facts according to which the processing of biometric data of the plaintiff in time recording is "necessary" so that the defendant or plaintiff can exercise their rights or fulfill their obligations. 81 Since the plaintiff has thus not violated any ancillary obligation under the employment contract by refusing to allow the defendant to process his biometric data during the recording of working hours, the warnings of October 5, 2018 and March 26, 2019 were unjustified and therefore, as already determined by the Labor Court in the contested judgment, these must be removed from the plaintiff's personnel file without replacement in corresponding application of §§ 242, 1004 BGB. 3. 82 The same applies to the third warning of the plaintiff dated March 26, 2019. 3.1 83 In this respect, the labor court also correctly decided that the plaintiff was not obliged to participate in the company medical examination. In this respect, reference can also be made to the reasons for the decision of the labor court according to § 69 ArbGG. Here again, the attacks of the appeal are not suitable to bring about a different result. The labor court correctly assumed that the defendant had not shown that the plaintiff could come into contact with bodily fluids, excretions or tissue "regularly and to a greater extent". 3.2 84 In detail, the defendant correctly stated that according to Part 2 Paragraph 1 No. 3c lit. bb of the Annex to the ArbMedVV it is sufficient to possibly come into contact with body fluids, excretions or tissue. A corresponding hazard is sufficient. 85 The statement of the deplored ones, in addition firstinstance sufficiently under evidence beginning to have brought forward, is however not correct. Although the defendant has claimed that the plaintiff (inadvertently referred to as the defendant in the statement of September 17, 2019) had direct contact with the patients, for example, when storing the patient in the large radiological equipment and when injecting saline and/or contrast media by cannula/syringe, which is necessary in 20 to 40% of patients. In this regard, the plaintiff had already stated in the statement dated August 2, 2019, that he did not come into contact with the patients, but worked exclusively on the computer. At the chamber hearing, the labor court had further clarified the facts of the case by questioning the plaintiff. In addition, the plaintiff had explained that due to the takeover from the defendant's legal predecessor, he would continue to be used as before in a certain way, which was limited to the storage of patients in the large devices in addition to working on the computer, without coming into contact with the substances according to Part 2, Paragraph 1, No. 3c lit. bb of the Annex to the ArbMedVV. However, the defendant did not provide any concrete data concerning the plaintiff, such as the frequency of specific work steps, in the grounds of appeal. 3.3 86 The defendant also overlooks the fact that it cannot at its discretion instruct its employees to undergo a company medical examination. Rather, the employer has to determine the scope of the occupational medical preventive measures on the basis of the risk assessment to be carried out generally according to § 5 ArbSchG (§ 3 para. 1 sentence 1 ArbMedVV). The existence of a risk assessment is a basic requirement for medical measures of the compulsory medical examination. Offer and desire precaution. Although the defendant stated in the appeal hearing on request that it assumed that there was a corresponding risk assessment because the examination had been organized by a company physician, the defendant again fails to recognize the essential content of the risk assessment that has been prescribed in the ArbSchG since 1996. In addition it would have required for the different activities in the enterprise of the deplored one evaluation of the dangers connected with the work. From this would have resulted then also whether the plaintiff exercises activities like all other MTRA and which endangerment is connected with it or whether the plaintiff has another activity cut with other endangerment. 87 Since the deplored one did not explain an appropriate endangerment evaluation and without endangerment evaluation no obligation precaution must be accomplished, as results from § 3 exp. 1 sentence 1 ArbMedVV, also the warning in this connection cannot have existence and is from the personnel file of the plaintiff to be removed. III. 88 The decision on costs follows § 64 Abs.6 ArbGG in connection with § 97 ZPO. The defendant shall bear the costs of the unsuccessful appeal. 89 The admission of the revision according to § 72 Abs. 2 ArbGG did not come into consideration, because the legal requirements did not exist.
