At a glance
- On 8 October 2024, a new draft law on employee data, the Employee Data Act, was presented by the ministries in charge.
- The draft Employee Data Act introduces a separate employee data law outside the scope of the Federal Data Protection Act.
- The new regulations on employee data protection are much more detailed and comprehensive than the current regulation in the Federal Data Protection Act.
On 8 October 2024, the Federal Ministry of Labour and Social Affairs and the Federal Ministry of the Interior and for Homeland Affairs presented a draft bill for a "law to strengthen the fair handling of employee data and for more legal certainty for employers and employees in the digital world of work – Employee Data Act".
The draft Employee Data Act introduces a separate employee data law outside the scope of the Federal Data Protection Act. The Federal Data Protection Act will otherwise remain applicable, but section 26 of that Act (data processing for the purposes of the employment relationship) will be repealed.
The proposed changes include:
- Compared to section 26 Federal Data Protection Act, data processing in the employment context will face stricter proportionality tests, with greater weight being given to the interests of employees.
- Data processing for purposes other than originally intended is allowed only under strict conditions, with significant restrictions on using such data for performance evaluations.
- Employees have the right to be informed about the use of Artifical Intelligence (AI) and profiling. They can request information about how AI systems work and the protective measures required.
- Compliance investigations, video surveillance and other monitoring measures are strictly regulated. Hidden surveillance is only permitted if there is suspicion of criminal activity, and performance monitoring is generally prohibited.
- The works council will extend co-determination rights, in particular with regard to the appointment and dismissal of data protection officers and the use of new technologies such as AI.
Conclusion and next steps
The draft has already been widely criticised. The comprehensive regulations could lead to a considerable administrative burden for companies and restrict data processing flexibility. According to press reports, the ministries in charge are aiming for the cabinet to pass the draft this year. The legislative process should then be completed by the middle of next year and the law could come into force by summer 2025.
