Germany Update: Keep an eye out when exchanging employee data in the Group!

Within corporations, employee data is regularly exchanged. This is often useful and necessary. But this data processing also has clear legal limits. In a judgment of December 2021, the LAG Hamm has shown such limits:

Circumstance

The plaintiff was employed in a hospital and earned more than € 80,000 gross annually according to the employment contract. The defendant employer operates a hospital as part of a group. Part of this group is also a management company whose task consists in the organization, management and personnel controlling in the hospital network. There is a management contract between the defendant and the management company, on the basis of which the management company must agree to the conclusion or amendment of employment contracts above an annual salary of € 80,000 gross.

The management company initiated a Group-wide survey of the pay data of employees earning more than € 80,000 gross. According to the defendant, this served to obtain an overview of the current salary structure in order to create homogeneous working conditions for this group of people in the future and to adapt salaries to comparable positions in future contracts or changes. To this end, it turned to the personnel managers of the companies concerned. They also sent the management company data of the plaintiff such as personnel number, surname and first name, the operational organizational unit, the type of service, the function, the date of recruitment/contract amendment, any time limit, the annual gross salary, the target premium/bonus and the other benefits granted in terms of designation and amount.

The plaintiff defended herself against this transfer of data in the group in court and got justice (LAG Hamm Urt. v. 14.12.2021 – 17 Sa 1185/20).

Decision of the LAG Hamm

In the opinion of the LAG Hamm, the forwarding and thus the processing of the plaintiff’s data was not permissible, neither under § 26 para. 1 BDSG nor under Art. 6 para. 1 lit. f) GDPR.

§ 26 sec. 1 BDSG justifies the processing of personal data of employees for the purpose of carrying out the employment relationship, such as payroll accounting or the maintenance of a personnel file. However, since the defendant itself had a human resources department and the plaintiff’s employment contract did not contain a group transfer clause, the LAG Hamm assessed the transfer of data as not necessary.

The LAG Hamm also considered the data transfer to be unjustified under Art. 6 para. 1 lit. f) GDPR. It is true that the defendant and management GmbH have a legitimate interest in transmitting the plaintiff’s salary data, since the processing is intended to enable a group-wide comparison of the salaries and other remuneration components of the employees employed in the group. However, the processing in the concrete form was not necessary. As a less intensive interference with the applicant’s fundamental rights and freedoms, a pseudonymised forwarding of the data to the management company would have been sufficient. It was not necessary to transmit such personal data as the first and last name and the personnel number. The management company could have carried out the objective it pursued, namely to ensure a homogeneous salary structure, even without a clear identification of the persons concerned.

The plaintiff was awarded €4,000 in damages.

Assessment

The GDPR does not recognize a corporate privilege that privileges the transfer of personal data from one company to another company within a group. Rather, the general regulations of the GDPR or the BDSG also apply to such transfers. The transfer of data must therefore also be necessary within the Group and reduced to the bare essentials, such as pseudonymisation. Since this is often lived differently in practice, special attention should be paid to this according to the clarifying judgment of the LAG Hamm.

By Johannes Fischer, MELCHERS, Germany, a Transatlantic Law International Affiliated Firm.  

For further information or for any assistance please contact germany@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.