During the COVID-19 pandemic, the Minister for Education and Culture of the Land Hessen in Germany established a framework so that pupils could attend classes live by videoconference. To safeguard pupils’ personal data protection rights, connection to the streamed service had to be authorised with the consent either of the pupils themselves or of their parents. However, no provision was made for teachers’ consent when participating in the service.

The Principal Staff Committee for Teachers at the Ministry of Education and Culture of the Land Hessen in Germany issued proceedings against the responsible Minister in relation to the lack of a provision making the live streaming of classes conditional upon the consent of the teachers concerned. The Minister argued that the processing of personal data inherent in the live streaming of classes was covered by national legislation, such that it could be conducted without the consent of teachers.

The German court found that national legislation governing the processing of teachers’ personal data falls within the category of “more specific rules” under Article 88(1) of the GDPR. Article 88 of the GDPR covers the processing of employees’ personal data in the employment context. Article 88(1) provides that Member States can provide for “more specific rules” to ensure the protection of the rights and freedoms of employees’ personal data in an employment context.

The German court asked the CJEU whether the German national legislation was compatible with the conditions under Article 88(2) of the GDPR, which provides that the “more specific rules” must include specific measures to safeguard the data subjects’ human dignity, legitimate interests and fundamental rights, with particular regard to transparency, the transfer of personal data and any monitoring systems used in the work place.

The CJEU held that the processing of teachers’ personal data during the live streaming of public educational classes falls within the scope of the GDPR. Further, it said, teachers are employees or civil servants who provide public services in the Land Hessen and the processing of their personal data therefore falls within the scope of Article 88 of the GDPR.

The CJEU held that Article 88(1) refers to rules that are specific to the area regulated, distinct from the GDPR. Further, Article 88(2) circumscribes the discretion of Member States wishing to adopt “more specific rules” under Article 88(1). Therefore, the CJEU said, any “more specific rules” that a Member State might adopt must not simply reiterate the conditions for the lawful processing of personal data as set out under the GDPR or merely refer to those conditions and principles. The “more specific rules” must seek to protect employees’ rights and freedoms in relation to the processing of their data and include suitable and specific measures to protect their human dignity, legitimate interests and fundamental rights.

In addition, particular regard must be had to transparency, the transfer of personal data and any monitoring systems in the work place. Therefore, to be categorised as a “more specific rule” under Article 88(1), the provision must satisfy the conditions in Article 88(2).

The CJEU said that it is for the referring court to assess whether national law complies with Article 88. However, the CJEU said, the German law in question, which makes the processing of employees’ personal data subject to the condition that such processing is necessary for the performance of an employment contract, appeared simply to reiterate the conditions for lawful processing as set out in the GDPR without adding a “more specific rule” pursuant to Article 88(1).

Therefore, the CJEU said, if the German court were to find that the national law did not comply with Article 88, it would have to disregard it in accordance with the principle of the primacy of EU law. In that situation, the processing of personal data in the employment context, both in the private and public sectors, would be directly governed by the GDPR. In that case, other exceptions for lawful processing under the GDPR, e.g. where the processing is necessary in the public interest or in the exercise of the official authority vested in the controller, might apply.

Accordingly, where a national court finds that the national law does not comply with Articles 88(1) and (2), it must then go on to consider whether, nevertheless, it constitutes a legal basis for processing under another Article of the GDPR. (Case C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums EU:C:2023:270 (30 March 2023) — to read the judgment in full, click here).