Art. 88 GDPR is an opening clause that allows Member States, “more specific provisions” for the protection of employees in the areas of collective agreements, management, planning and organization of work, equality and diversity, health protection and dismissal.
The Wiesbaden Administrative Court (VG) had submitted a question to the ECJ in this regard. It concerned decrees of the Hessian Ministry of Education and Cultural Affairs that allowed participation in lessons via video conference during the Corona period. It was stipulated that the connection to the video conference was only permissible with the consent of the students or their parents, but not the consent of the teachers – this was because the Hessian Data Protection Act permits the processing of employee data insofar as this is necessary for the establishment or implementation of the employment relationship (the same as § Section 26 (1) of the German BDSG). A teachers’ staff council had filed a complaint against this.
The ECJ came to the conclusionthat Member States may only adopt more specific rules in the area of employment if they comply with the requirements of Art. 88(2) GDPR. They must therefore special measures to safeguard the human dignity, legitimate interests and fundamental rights of the data subject. However, they cannot simply repeat the GDPR, nor can they amend Art. 6 and 9 GDPR (legal grounds).
The VG Wiesbaden must therefore now assess whether the relevant Hessian provision is applicable or not compatible with Art. 88 GDPR – if this should not be the case, Art. 6 GDPR will have to be examined. The question may also have an impact on Section 26 BDSG.