German draft Employee Data Protection Act

The German Federal Government is taking a new attempt for a national Employee Data Protection Act (Draft Act), taking due consideration of the digital work environment and it implications for employee data protection. The draft legislation has been leaked via social media mid of October 2024, and contains various clarifications and provisions for employers in their role as data controllers, including inter alia:

• Requirements on voluntary employee consent in particular in relation to performance and behavioural monitoring, biometric scan technologies and health checks; the Draft Act clarifies that the parties to a works council agreement, collective bargaining agreements and similar arrangements can further specify the details of the proper legal basis of processing, whereas such instruments do not establish the legal basis of processing as such;
• Excluding evidence from court proceedings that the employer may have obtained in breach of data protection rules (e.g. by installing and applying security and monitoring systems that do not conform with the GDPR requirements), unless there is a disproportionate unbalance between the level of interference with the rights and freedoms of the employee as a data subject and the vested constitutional interest of the employer; this rule is likely to have a considerable impact in dismissal claims where, for example, the employer bases a dismissal on alleged criminal acts of the employee (fraud, theft, harassment etc.), which can only be shown through monitoring tools and other systems of processing employee data.
• Rules on information requirements, impact assessments, and privacy by design and by default principles for high-risk data processing in the context of AI applications, such as automated decision-making, profiling, or location tracking.

German government is trying to bring the Draft Act through Parliament in 2024; if so, it could enter into force in August or September 2025.

Initial reactions to the Draft Act have been vocal about the legal clarity in regard to the digital work environment, but also have expressed concern about the additional burdens for employers and some missed opportunities in creating more flexibility.