GDPR and online education – a decision by the European Court

The European Court has ruled in the case C‑34/21 Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium срещу Minister des Hessischen Kultusministeriums, which concerns private data management and authorization. The case has the following background:

As is apparent from the file submitted to the Court, by two measures adopted in 2020, the Minister for Education and Culture of the Land Hessen established the legal and organisational framework for school education during the COVID-19 pandemic. That framework made it possible, inter alia, for pupils who could not be present in a classroom to attend classes live by videoconference. In order to safeguard pupils’ rights in relation to the protection of personal data, it was established that connection to the videoconference service would be authorised only with the consent of the pupils themselves or, for those pupils who were minors, of their parents. However, no provision was made for the consent of the teachers concerned to their participation in that service.

The Principal Staff Committee for Teachers at the Ministry of Education and Culture of the Land Hessen brought an action before the Administrative Court, Wiesbaden, Germany, complaining that the live streaming of classes by videoconference was not made conditional on the consent of the teachers concerned.

The Minister for Education and Culture of the Land Hessen, for his part, contended that the processing of personal data inherent in the live streaming of classes by videoconference was covered by the first sentence of Paragraph 23(1) of the HDSIG, so that it could be conducted without the consent of the teachers concerned being sought.

The Administrative Court, Wiesbaden states in that regard that, in accordance with the intention of the legislature of the Land Hessen, Paragraph 23 of the HDSIG and Paragraph 86 of the HBG fall within the category of ‘more specific rules’ for which Member States may make provision, in accordance with Article 88(1) of the GDPR, to ensure the protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context. However, that court has doubts as to whether the first sentence of Paragraph 23(1) of the HDSIG and Paragraph 86(4) of the HBG are compatible with the requirements laid down in Article 88(2) of the GDPR.

In the first place, the first sentence of Paragraph 23(1) of the HDSIG and Paragraph 86(4) of the HBG rely on ‘necessity’ as the legal basis for the processing of employees’ data. However, the insertion of the principle of ‘necessity’ into that law does not constitute a rule specifying the requirements contained in Article 88(2) of the GDPR, since the processing of data necessary in the context of an employment relationship is already governed by point (b) of the first subparagraph of Article 6(1) of the GDPR.

In addition, the first sentence of Paragraph 23(1) of the HDSIG applies, beyond the actual contractual relationship, to any processing of employees’ data. It follows from point (f) of the first subparagraph of Article 6(1) of the GDPR that, in the case of personal data processing going beyond processing that is strictly necessary under the employment contract, the fundamental rights and freedoms of the data subject, in the present case the employees and civil servants, must be balanced with the legitimate interest pursued by the controller, in the present case the employer. In so far as the first sentence of Paragraph 23(1) of the HDSIG does not provide for such a balancing exercise, that provision cannot be regarded as a specific sectoral norm after the entry into force of the GDPR.In the second place, the Administrative Court, Wiesbaden considers that the mere reference in Paragraph 23(5) of the HDSIG to the fact that the controller must, inter alia, comply with the principles set out in Article 5 of the GDPR does not meet the requirements of Article 88(2) of that regulation. The latter provision requires suitable and specific legislative provisions to be adopted in order to protect the data subjects’ human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity, and monitoring systems at the work place, and is not merely a rule which must additionally be complied with by those who apply a national provision. Those who apply the provision are not the addressees of Article 88(2) of the GDPR.

In those circumstances, the Administrative Court, Wiesbaden decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1) Is Article 88(1) of [the GDPR] to be interpreted as meaning that, in order to be a more specific rule for ensuring the protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context within the meaning of Article 88(1) of [the GDPR], a provision must meet the requirements imposed on such rules by Article 88(2) of [the GDPR]?

(2) If a national rule clearly does not meet the requirements under Article 88(2) of [the GDPR], can it nevertheless remain applicable?’

The Court’s decision:

1. Article 88 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that national legislation cannot constitute a ‘more specific rule’, within the meaning of paragraph 1 of that article, where it does not satisfy the conditions laid down in paragraph 2 of that article.

2. Article 88(1) and (2) of Regulation 2016/679

must be interpreted as meaning that the application of national provisions adopted to ensure the protection of employees’ rights and freedoms in respect of the processing of their personal data in the employment context must be disregarded where those provisions do not comply with the conditions and limits laid down in Article 88(1) and (2), unless those provisions constitute a legal basis referred to in Article 6(3) of that regulation, which complies with the requirements laid down by that regulation.