CJEU - C-34/21 - Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium
| CJEU - C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 88 GDPR |
| Decided: | 30.03.2023 |
| Parties: | |
| Case Number/Name: | C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium |
| European Case Law Identifier: | ECLI:EU:C:2023:270 |
| Reference from: | |
| Language: | 24 EU Languages |
| Original Source: | Judgement |
| Initial Contributor: | mg |
The CJEU found that a Member State cannot use Article 88(1) GDPR to specify the GDPR unless the Member State contextually implemented additional measures to protect employees’ rights and freedoms.
English Summary
Facts
During the Covid-19 pandemic, the Minister for Education and Culture of the Land Hessen established a legal framework to enable remote education through video-calls. According to this framework, pupils (or pupils’ parents) should give their consent to the processing of personal data. However, no similar provision applied to teachers.
A Committee of teachers brought an action before the Wiesbaden Administrative Court. According to the defendant, the provision that enabled the regional government to process data without teachers’ consent was § 23 of the Hessisches Datenschutz- und Informationsfreiheitsgesetz (Law on data protection and freedom of information of the Land Hessen). This provision would set “more specific rules” concerning workers’ data protection rights in accordance with Article 88 GDPR and in derogation to GDPR itself.
However, the Administrative Court suspected that the controller did not comply with Article 88(2) GDPR, as the latter provision requires “suitable and specific legislative provisions” to be adopted in order to protect data subjects’ rights. The German court wondered whether a national provision that does not meet this requirement, such as § 23 of the German data protection law, could be seen as a legitimate implementation of Article 88 GDPR. Moreover, the court was not certain about the faith of such a provision, in case a national judge found it in contrast with Article 88(2) GDPR.
In order to better clarify the relationship between paragraphs (1) and (2) of Article 88 GDPR, the German court issued a preliminary reference to the CJEU.
Holding
In the first place, the CJEU clarified that Article 88 GDPR covered the facts at issue in the main proceeding and more in general public employment, as this provision is not specific to the private sector. According to the CJEU, it is the existence of a relationship of subordination between the employee and the employer and not the legal nature of this relationship that justifies the open clause provided for in Article 88 GDPR.
When Member States use open clauses under Chapter IX GDPR they shall not undermine content and objectives of the regulation. In particular, the CJEU maintained that three conditions for the use of Article 88 GDPR shall be met: first, national law must have a content which is “specific to the area regulated” (in this case employment) and distinct from the general GDPR rules; second, the purpose shall be to protect rights and freedoms of workers; finally, suitable and specific measures should be in place in accordance with Article 88(2) GDPR. These measures should not simply reiterate the general protection offered by the GDPR. The CJEU stressed that such measures protect not only employees’ rights, but also the harmonisation of EU law itself, which would be otherwise put at risks by national derogations. Thus, the CJEU concluded that a provision adopted pursuant to Article 88(1) GDPR cannot be considered a “more specific rule” if the above mentioned conditions are not met.
It was for the German court to ascertain whether the German law complied with the requirements set out in Article 88(1) and (2) GDPR. However, at a first glance it seemed to the CJEU that the German law merely reiterated the content of the GDPR, without any additional element. If it was the case, the German court should disregard the law in light of the principle of EU law primacy. In this specific case, even if the German court found that national law did not satisfy the requirements of Article 88 GDPR, it should still check whether Article 6(1)(c) or (e) – legal obligation or public interest – applied as legal bases for the processing. This assessment should be performed in light of Article 6(3) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
