A first-instance decision of the Austrian Data Protection Authority that has become final is attracting significant attention in the field of employee data protection law. At least for the time being, it is likely to have substantial implications for day-to-day business practice. What happened?
An employer used the HR tool “MyHR” to conduct a 360-degree feedback process. In doing so, it collected personal data relating to supervisors and made this information available to managers. While a framework works agreement governing the processing of employee data was in place, the specific tool was not covered by that agreement and was also not subject to any supplementary works agreement. An affected employee lodged a complaint with the Austrian Data Protection Authority. How did the authority decide?
The Austrian Data Protection Authority (DSB 2025-0.960.016) upheld the complaint and found that the processing of personal data as part of the 360-degree feedback process had infringed the employee’s right to data protection. In addition, it prohibited the employer from using the tool with immediate effect until a valid works agreement had been concluded.
The decision goes well beyond the individual case. In its role as supervisory authority under the GDPR, the Austrian Data Protection Authority addressed two key legal questions that had previously been the subject of considerable debate:
- First, it classified Section 96 of the Austrian Labour Constitution Act (ArbVG) as an employee data protection provision within the meaning of the opening clause in Article 88 GDPR. This is consistent with the approach taken by the Austrian Supreme Court (OGH) in case 6 ObA 2/23x: where the ArbVG regulates the processing of employees’ personal data in the employment context, it may constitute a more specific provision within the meaning of Article 88 GDPR.
- Secondly, the authority held that any processing of personal data carried out without the works agreement required under the ArbVG constitutes, in itself, a breach of both the GDPR and Section 1(1) of the Austrian Data Protection Act (DSG). In such circumstances, an employer cannot rely on a legitimate interest under Article 6(1)(f) GDPR to justify the processing where it is in breach of co-determination requirements under employment law.
What does this mean in practice?
The data protection compliance of any HR system must always be assessed against the requirement to involve the works council where such involvement is legally required. If a works agreement required under the ArbVG is missing, the processing of personal data will directly infringe both the GDPR and the fundamental right to data protection under Section 1(1) DSG. This may trigger all consequences available under the GDPR, including the imposition of administrative fines.
The decision demonstrates that employment law, and more specifically employee co-determination law, now has a direct impact on GDPR compliance. Employee data protection can no longer be considered independently of compliance with employment and labour constitution law requirements. As a result, employee data protection has become a significant compliance issue. Introducing HR tools that process employees’ personal data without taking employment law requirements into account constitutes a clear compliance breach, with all consequences that may follow under the GDPR.
It is also important to note that, following this decision, not only works councils and individual employees may challenge unlawful data processing through injunctive proceedings, but affected employees may also make use of the accessible and free complaint procedure before the Data Protection Authority. This may result in the authority prohibiting the employer from using the relevant tool.
Whether the authority’s legal reasoning will ultimately be upheld remains to be seen. In the interests of legal certainty, it is to be hoped that the Court of Justice of the European Union (CJEU) will also have an opportunity to provide guidance on these highly significant legal questions.
We would be pleased to support you in assessing the employee co-determination framework applicable within your organisation and in drafting the necessary works agreements. With more than 20 years of experience in employee data protection law and a long-established multidisciplinary data protection practice, we are ideally placed to assist. Please do not hesitate to get in touch.
Related Experts
