Automated Monitoring in the Workplace and the Search for a New Legal Framework: Lessons from Germany and Beyond

Abstract

Workers have specific data protection needs that cannot be addressed by general data protection rules. The GDPR was never designed to adequately handle these specific issues; it was designed under the assumption that data processing in the employment context would be regulated by a separate set of rules. The introduction of such specific rules has been debated for a long time but with little progress. Instead, a closer look at the policy and regulatory debate on the need for separate employee data protection legislation in Europe shows that the increasing calls from stakeholders for separate employee data protection legislation have been met by legislative inaction both at the Union and Member State levels. This paper explores the persistent policy gap in regulating employee data processing in the EU. It argues for the urgent need for independent legislation by Member States to address the challenges posed by new monitoring and algorithmic management systems to workers' privacy and data protection rights.

The paper builds on recent developments in Germany that can offer useful lessons—and serve as a cautionary tale for other Member States. The significant political momentum in Germany towards adopting workplace data protection legislation presents an opportunity for other Member States to follow suit. At the same time, the fact that the German rules regulating employee data processing were recently pronounced by the CJEU as incompatible with the GDPR should serve as a cautionary tale. The paper then provides guidelines for Member States on using the facultative clause under Article 88 of the GDPR to introduce independent employee data protection legislation and outlines key policy proposals for such legislation.

Keywords: GDPR, Article 88, labour law, employee monitoring, algorithmic management, workplace data protection, privacy, CJEU