Banner1.jpg

CJEU - C‑65/23 - K GmbH

From GDPRhub
Revision as of 11:04, 8 January 2025 by Tjk (talk | contribs) (Created page with "{{CJEUdecisionBOX |Case_Number_Name=C‑65/23 K GmbH |ECLI=ECLI:EU:C:2024:105 |Opinion_Link= |Judgement_Link=https://curia.europa.eu/juris/document/document.jsf?mode=DOC&pageIndex=0&docid=293835&part=1&doclang=EN&text=&dir=&occ=first&cid=166598 |Date_Decided=19.12.2024 |Year=2024 |GDPR_Article_1=Article 88(1) GDPR |GDPR_Article_Link_1=Article 88 GDPR#1 |GDPR_Article_2=Article 88(2) GDPR |GDPR_Article_Link_2=Article 88 GDPR#2 |GDPR_Article_3= |GDPR_Article_Link_3= |GD...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
CJEU - C‑65/23 K GmbH
Cjeulogo.png
Court: CJEU
Jurisdiction: European Union
Relevant Law: Article 88(1) GDPR
Article 88(2) GDPR
§ 26(4) BDSG
Decided: 19.12.2024
Parties: MK
K GmbH
Case Number/Name: C‑65/23 K GmbH
European Case Law Identifier: ECLI:EU:C:2024:105
Reference from: BAG
8 AZR 209/21 (A)
Language: 24 EU Languages
Original Source: Judgement
Initial Contributor: tjk


The CJEU decided that national provisions providing for data processing based on collective agreements must assure compliance with the whole GDPR, and such agreements are subject to full judicial review.

English Summary

Facts

The data subject is employed by the controller, a company governed by German law. In 2017, the group of companies to which the controller belongs (the parent company) introduced a cloud-based new software throughout that group as a single personnel information management system. In that context, the controller transferred personal data of its employees from the to-be-replaced software to a server of the D group’s parent company in the USA. The controller and its works council had concluded an agreement confirming acquiescence to the introduction of the new software, which limited the transfer of data to certain categories.

In that context, the data subject brought applications before the Arbeitsgericht (Labour Court, Germany) and then before the Landesarbeitsgericht (Higher Labour Court, Germany) for access to certain information, erasure of data concerning him, and the award of compensation. Not fully satisfied, the data subject brought an appeal before the Bundesarbeitsgericht (Federal Labour Court, Germany), claiming that the transfer of his personal data to the parent company’s server was neither necessary for the purposes of the employment relationship (as the controller still used the to-be-replaced software) nor for the purpose of testing the new software, since the use of dummy data would have been sufficient. Secondly, the data subject claimed that, even if the works agreement confirming acquiescence could constitute a valid basis for that processing, the authorisation contained therein was exceeded, since the controller transmitted data other than those provided for.

The Federal Labour Court stayed the proceedings and referred the following questions to the CJEU: (1) Is a national legal provision that has been adopted pursuant to Article 88(1) GDPR – such as Paragraph 26(4) BDSG – and which provides that the processing of personal data, including special categories of personal data, of employees for the purposes of the employment relationship is permissible on the basis of collective agreements subject to compliance with Article 88(2) GDPR, to be interpreted as meaning that the other requirements GDPR – such as Article 5, Article 6(1), and Article 9(1) and (2) GDPR – must always also be complied with? (2) If the answer to Question 1 is in the affirmative: May a national legal provision adopted pursuant to Article 88(1) GDPR – such as Paragraph 26(4) BDSG – be interpreted as meaning that the parties to a collective agreement (in this case, the parties to a works agreement) are entitled to a margin of discretion in assessing the necessity of data processing within the meaning of Article 5, Article 6(1), and Article 9(1) and (2) GDPR that is subject to only limited judicial review? (3) If the answer to Question 2 is in the affirmative: In such a case, to what is the judicial review to be limited?

Holding

Regarding the first question The court argued that while the wording is inconclusive on the first question, Article 88(1) and (2) GDPR must be interpreted as meaning that, even where Member States introduce ‘more specific rules’, by law or by collective agreements, the requirements arising from the other provisions must also be satisfied. Otherwise, Article 88 GDPR’s objective of protecting employees’ rights and freedoms in the context of data processing and the member state’s responsibility not to undermine the content and objectives of the GDPR stated in Recital 10 GDPR would be circumvented. According to the court, this also follows from Article 88 GDPR’s context, as generally, the ‘Principles’ of Chapter II are of a general scope extending also to ‘specific … situations’, as clear especially from Article 6(2) and (3) GDPR. Therefore, Chapter II also applies to the ‘Provisions relating to specific processing situations’ in Chapter IX, which includes Article 88 GDPR. Therefore, Article 88(1) and (2) GDPR must be interpreted as meaning that a provision of national law which concerns the processing of personal data for the purposes of employment relationships and has been adopted pursuant to Article 88(1) of that regulation must have the effect of requiring its addressees to comply not only with the requirements arising from Article 88(2) of that regulation but also with those arising from Article 5, Article 6(1), and Article 9(1) and (2) thereof.

Regarding the second question The court argued that due to the primacy of EU law, if a court finds that national law does not comply with the GDPR, it must disregard those provisions. The same applies to the judicial review of collective agreements (to which the works agreement affirming acquiescence belongs, as clarified in Recital 155 GDPR). The parties to such an agreement have a margin of discretion when determining whether the processing of personal data is ‘necessary’, within the meaning of Article 5, Article 6(1), and Article 9(1) and (2) GDPR. However, as a collective agreement must not undermine the GDPR’s objective of ensuring a high level of protection of employees’ freedoms and fundamental rights Article 88(1) GDPR must be interpreted as not to prevent full judicial review by the national court where a collective agreement falls within the scope of that provision.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!