Germany Passes Reformed Data Protection Act

New Legislation Enacted

Germany passed the Federal Data Protection Act (FDPA), which incorporates the EU’s “General Data Protection Regulation” (GDPR) and reforms Germany’s national law. Some key aspects: First, with some exceptions, employee consent and agreements with the company’s works council remain a valid option to legitimize the processing of personal data. Second, while the GDPR requires companies to appoint a so-called Data Protection Officer only in very limited circumstances, under Germany’s FDPA, every company must do so. Third, in addition to the GDPR’s steep monetary fines, the FDPA provides for a prison sentence of up to three years for very serious infringements. The GDPR and FDPA become effective on May 25, 2018, requiring employers to implement new policies and procedures for handling EU employees’ personal data.

European Court of Human Rights on Monitoring of Private Use of Company Communication Devices

Precedential Decision by Judiciary or Regulatory Agency

On September 5, 2017, the European Court of Human Rights considered whether monitoring the use of company communication devices is a violation of Article 8 of the European Convention on Human Rights (ECHR). Here, although the company prohibited any private use of company resources, such prohibition did not specify that employees could be monitored. The Court explained that, besides notification of possible monitoring and the scope, legitimate monitoring grounds are needed. Additionally, employers must always consider the severity of the encroachment on Article 8 ECHR, opting for less severe measures and consequences than, for example, the termination of employment.

Changes in the Mass Dismissal Notice

New Regulation or Official Guidance

Under Germany’s strict law on dismissal protection, employers must notify the Employment Agency before a “mass dismissal,” utilizing specific forms which are subject to special requirements. Errors may lead to the ineffectiveness of all dismissals: A costly risk for employers. The Employment Agency recently updated the form, which confirms that all employees threatened by dismissal must be reported. After the new form, it is no longer necessary to specify the individual notice periods for the employees concerned. The period during which redundancies are to be made is sufficient.