No automatic access to data in HR systems for works councils

Facts of the case

Two employers, with a combined total of 19 regional offices, had concluded a group works agreement (‘GBV’) with the group works council regarding the uniform introduction of a human resources management system. The system includes, amongst other things, a time and attendance module. Under the GBV, local works councils were granted access rights to various time and attendance data, including the reasons for absences (e.g. sickness, parental leave, maternity leave).

A local works council compiled an analysis of the reasons for absence among employees at its site. After this analysis appeared in unencrypted form on an internal company drive, the employers, on the advice of the data protection officer, revoked the access rights of all works councils. The General Works Council is demanding that the local works councils’ access rights be reinstated.

The decision

The Cologne Regional Labour Court (LAG) dismissed the application by the General Works Council. In the court’s view, the General Works Council lacked the competence to effectively regulate access rights in the first place. The granting of access rights to works council members was not covered by the right to co-determination regarding the introduction of technical facilities under Section 87(1)(6) of the Works Constitution Act (BetrVG). In particular, there was also no ‘ancillary competence’. Rather, access to data served to enable the exercise of the statutory monitoring and information rights under Section 80 of the Works Constitution Act (BetrVG), which in principle are vested in the local works councils. For a regulation at the group-wide level, there would therefore have had to be a corresponding transfer of competence.

Furthermore, the court expressed significant data protection concerns regarding permanent access to personal data relating to working hours and absences. Permanent online access is not necessary for the works council to carry out its duties. It is also particularly problematic that, through the reasons for absence, health data – and thus special categories of personal data – are also being processed. The court did not consider the requirements of the potentially relevant legal bases for such access under Section 26(3) and (4) of the Federal Data Protection Act (BDSG) or Article 9 of the General Data Protection Regulation (GDPR) to have been met.

Implications for practice 

The ruling makes it clear that the responsibilities of group, central and local works councils must be carefully examined when designing digital HR systems. Not every issue relating to an IT system subject to co-determination automatically falls within the remit of the central or group works council.

At the same time, the Cologne Regional Labour Court makes it clear that no general entitlement to permanent direct access to data sets can be derived from the works council’s rights to information. Rather, a legal basis is always required. If this is lacking, it may call into question the validity of such arrangements. Employers therefore have additional grounds to fend off demands from works councils to grant access rights.

Practical tip

Companies should review existing group, central and works agreements relating to HR and time-recording systems to ensure that the relevant provisions were concluded by the competent body. It is also advisable to review role and authorisation frameworks from a data protection perspective. Particular attention should be paid to access to health data or other personal information requiring special protection, as stricter legal requirements apply in these cases.