Association of German Data Protection Authorities (“Datenschutzkonferenz” or “DSK”) has issued a paper on employee data protection outlining what employers in private sector have to take into account when processing employee personal data.
It reaffirms the position of the Article 29 Working Party and the European Data Protection Board that consent can be used only in exceptional circumstances due to the nature of the relationship between employee and employer where it is usually unlikely that the consent can be given freely. Consent can be given in circumstances where an employer is providing additional benefits to the employee and by refusing to give consent an employment cannot be terminated.
All forms of processing of personal data of employees is covered under the Federal Data Protection Law, such as data which do not form a part of the system nor are intended to form a part of the system.
In addition to the above the paper addresses processing of personal data for the purpose of detection the crime, special categories of personal data, circumstances when the purpose of processing change etc.