MK – CJEU Judgment (Germany, 2024)

The data subject is employed by the controller, a company governed by German law. In 2017, the group of companies to which the controller belongs introduced a cloud-based new software as a personnel information management system. In that context, the controller transferred personal data of its employees from the to-be-replaced software to a server of the group’s parent company in the USA. The controller and its works council had concluded an agreement confirming acquiescence to the introduction of the new software, which limited the transfer of data to certain categories. In that context, the data subject brought applications before the Labour Court (Arbeitsgericht Ulm - AG Ulm) and then before the Higher Labour Court (Landesarbeitsgericht - LAG Baden-Württemberg) for access to certain information, erasure of data concerning him, and compensation. Not fully satisfied in the course of these procedure, the data subject brought an appeal before the Federal Labour Court (Bundesarbeitsgericht - BAG), claiming that the transfer of his personal data to the parent company’s server was neither necessary for the purposes of the employment relationship (as the controller still used the to-be-replaced software) nor for the purpose of testing the new software, since the use of dummy data would have been sufficient. Additionally, the data subject claimed that, even if the works agreement confirming acquiescence could constitute a valid basis for that processing, the authorisation contained therein was exceeded, since the controller transmitted data other than those provided for. The Federal Labour Court stayed the proceedings and referred the following questions to the CJEU: # Is a national legal provision that has been adopted pursuant to Article 88(1) GDPR – such as [https://www.gesetze-im-internet.de/bdsg_2018/__26.html Paragraph 26(4) of the German Federal Data Protection Act] (Bundesdatenschutzgesetz - BDSG) – and which provides that the processing of personal data, includin