Judgment;Abstract — ECLI:EU:C:2023:270
Date: 2023-03-30
Language of the case: German
Court formation: First Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Summary C-34/21 – 1 
Case C-34/21 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
20 January 2021 
Referring court: 
Verwaltungsgericht Wiesbaden (Germany) 
Date of the decision to refer: 
21 December 2020 
Applicant: 
Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen 
Kultusministerium 
Other party: 
Minister des Hessischen Kultusministeriums (as head of the 
ministry) 
Subject matter of the main proceedings 
Legislation of the Länder on staff representation, specifically: legal basis of data 
protection in the processing of employee data 
Subject matter and legal basis of the request 
Interpretation of Article 88 of Regulation 2016/679; Article 267 TFEU 
Questions referred 
1. Is Article 88(1) of REGULATION (EU) 2016/679 OF THE EUROPEAN 
PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of 
natural persons with regard to the processing of personal data and on the free 
movement of such data, and repealing Directive 95/46/EC (General Data 
Protection Regulation – GDPR) to be interpreted as meaning that, in order to be a 
more specific rule for ensuring the protection of the rights and freedoms in respect 
of the processing of employees’ personal data in the employment context within 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-34/21 
 
2  
the meaning of Article 88(1) of REGULATION (EU) 2016/679, a provision must 
meet the requirements imposed on such rules by Article 88(2) of REGULATION 
(EU) 2016/679? 
2. If a national rule clearly does not meet the requirements under Article 88(2) 
of Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC, can it nevertheless remain applicable? 
Provisions of EU law cited 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC, in particular Article 88, and also Article 5 and Article 6(1)(b) and (f) 
Provisions of national law cited 
Hessisches Datenschutz- und Informationsfreiheitsgesetz (Law of Land Hessen on 
the protection of data and freedom of information; ‘the HDSIG’), Paragraph 23, in 
particular the first sentence of subparagraph (1), and also subparagraphs (4) and 
(5) 
Hessisches Beamtengesetz (Law of Land Hessen on civil service; ‘the HBG’), 
Paragraph 86(4) 
Brief summary of the facts and legal background 
1 The parties are in dispute as to whether the introduction of live streaming lessons 
by means of video conferencing systems also requires – in addition to the consent 
of the parents for their children or of the pupils who have reached the age of 
majority – the consent of the respective teachers, or whether the data processing 
which takes place in that context is covered by the first sentence of 
Paragraph 23(1) of the HDSIG, and they are also in dispute as to whether a right 
of co-determination or merely a right of participation exists under the relevant 
staff representation rules of the Land Hessen. 
2 The national legislature intended that Paragraph 23 of the HDSIG and 
Paragraph 86 of the HBG should be ‘more specific rules’ within the meaning of 
Article 88(1) of the GDPR. 
3 Paragraph 23(1) of the HDSIG, which corresponds to Paragraph 26(1) of the 
Bundesdatenschutzgesetz (Federal Law on data protection; ‘the BDSG’), reads: 
HAUPTPERSONALRAT DER LEHRERINNEN AND LEHRER 
 
3 
‘Personal data of employees may be processed for the purposes of an 
employment relationship where this is necessary for the decision on the 
establishment of an employment relationship or, after the establishment of 
the employment relationship, for the implementation, termination or 
administration thereof, as well as for the implementation of internal 
planning, organisational, social and personnel measures. This also applies 
to the exercise or discharge of the rights and obligations arising from the 
representation of employees’ interests and laid down by law or a labour 
agreement or works or service agreement (collective agreement). The 
personal data of employees may be processed for the purpose of detecting 
criminal offences only where factual indications, which must be 
documented, give rise to the suspicion that the data subject has committed a 
criminal offence in the context of the employment relationship, the 
processing is necessary for the detection, and the  legitimate interest of the 
employee or employees in precluding the processing is not overriding – in 
particular, the nature and extent of the processing are not disproportionate, 
having regard to the reason for the processing.’ 
4 In the present context, reference should also be made to subparagraphs (4) and (5) 
of Paragraph 23 of the HDSIG. They provide as follows: 
‘(4) The processing of personal data, including special categories of 
personal data of employees, for the purposes of an employment relationship 
is permitted on the basis of collective agreements. In so doing, the 
negotiating parties shall comply with Article 88(2) [of the GDPR]. 
(5) The controller must take appropriate measures to ensure that, in 
particular, the principles for the processing of personal data set out in 
Article 5 [of the GDPR] are complied with.’ 
5 The explanatory memorandum to the draft legislation states, with regard to 
Paragraph 23(1) of the HDSIG, that ‘Subparagraph (1) regulates the purposes for 
which and the conditions under which personal data may be processed before, 
during and after the employment relationship where this is necessary for the 
purposes of the employment relationship. In that context, the employer’s interests 
in the data processing and the personality rights of the employee must be carefully 
balanced in such a way that both sets of interests are taken into account to the 
greatest extent possible.’ 
6 In so far as the second sentence of Paragraph 23(7) of the HDSIG refers to the 
HBG, the first sentence of Paragraph 86(4) of the HBG must be taken into account 
in the present case. That sentence provides as follows: 
‘The employer may collect personal data on applicants, civil servants and 
former civil servants only if this is necessary for the establishment, 
implementation, termination or administration of the employment 
relationship or for the implementation of organisational, personnel and 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-34/21 
 
4  
social measures, in particular for the purposes of personnel planning and 
deployment, or if it is permitted by a legal provision or a service 
agreement. …’ 
Brief summary of the basis for the request 
7 The referring court has doubts as to whether the first sentence of Paragraph 23(1) 
of the HDSIG and the first sentence of Paragraph 86(4) of the HBG are provisions 
that are to be regarded, in each case, as a more specific rule in respect of the 
processing of employees’ personal data pursuant to Article 88(1) and (2) of the 
GDPR, since the requirements set out in Article 88(2) of the GDPR have not been 
met either in the respective provisions themselves or by supplementary 
requirements imposed on those provisions elsewhere in the respective laws. This 
is because both the first sentence of Paragraph 23(1) of the HDSIG and 
Paragraph 86(4) of the HBG merely cite ‘necessity’ as the legal basis for the 
processing of the data of employees and civil servants, respectively. 
8 With regard to the question as to the extent to which those provisions permissibly 
constitute more specific rules for the purposes of Article 88(1) and (2) of the 
GDPR, the national case-law, in particular that of the labour courts, proceeds on 
the assumption that the provision in the first sentence of Paragraph 26(1) of the 
BDSG, which corresponds, at the federal level, to the provision of Länder 
legislation in the first sentence of Paragraph 23(1) of the HDSIG, is applicable to 
any handling of employee data, going beyond the actual contractual relationship – 
that is to say, not only with regard to data processing that is necessary in 
connection with a relationship under an employment contract, which is already 
regulated in Article 6(1)(b) of the GDPR. 
9 Article 6(1)(f) of the GDPR requires that the processing is necessary for the 
purposes of the legitimate interests pursued by the controller or by a third party, 
except where such interests are overridden by the interests or fundamental rights 
and freedoms of the data subject which require protection of personal data. 
10 Consequently, for any processing of employee data that goes beyond that required 
solely within the framework of the employment contract, there must be a 
balancing of interests with regard to the further processing of the employee data, 
that is to say, a balancing of interests that goes beyond mere ‘necessity’, as 
provided for by the first sentence of Paragraph 23(1) of the HDSIG and by 
Paragraph 86(4) of the HBG. This is because the fundamental rights and freedoms 
of the data subject – in casu, the employee or civil servant – must be balanced 
against the legitimate interest pursued by the controller – in casu, the employer. 
11 The referring court takes the view that, as regards, specifically, the processing of 
employees’ personal data in the employment context at issue here, the national 
transposition legislation does not make provision for such a balancing exercise. 
The Bundesarbeitsgericht (Federal Labour Court, Germany; ‘the BAG’) takes a 
different view on this at national level. In an order of 7 May 2019, the BAG held 
HAUPTPERSONALRAT DER LEHRERINNEN AND LEHRER 
 
5 
that, with the first sentence of Paragraph 26(1) of the BDSG (which corresponds 
to the first sentence of Paragraph 23(1) of the HDSIG at issue here), the federal 
legislature made use of the saving clause in Article 88 of the GDPR in a 
permissible manner. 
12 Contrary to the view taken by the BAG, the referring court is of the opinion that 
merely stating, in Paragraph 23(5) of the HDSIG (which corresponds word for 
word to Paragraph 26(1) of the BDSG), that the controller must comply in 
particular with the principles set out in Article 5 of the GDPR does not meet the 
requirements of Article 88(2) of the GDPR. This is because Article 5 of the GDPR 
does not provide for any special protection for the fundamental rights and interests 
of employees specifically. Thus, the reference to that provision of the GDPR in 
the national provision on the protection of employee data (Paragraph 23 of the 
HDSIG or Paragraph 26 of the BDSG) does not achieve anything. 
13 The referring court takes the view that Article 88(2) of the GDPR has therefore 
not been transposed into the national provisions. Pursuant to that second 
paragraph, the more specific rules of the Member States, in this case 
Paragraph 23(1) of the HDSIG (or, at Federal level, Paragraph 26(1) of the 
BDSG) and Paragraph 86(4) of the HBG, are to include suitable and specific 
measures to safeguard the data subject’s human dignity, legitimate interests and 
fundamental rights, with particular regard to the transparency of processing, the 
transfer of personal data within a group of undertakings, or a group of enterprises 
engaged in a joint economic activity and monitoring systems at the work place. 
However, the inclusion of only the principle of ‘necessity’ in the national 
transposition legislation does not amount to the provision of more specific rules 
for the requirements contained in Article 88(2) of the GDPR. 
14 Although the legislature has in principle recognised and considered Article 88(2) 
of the GDPR in that it requires compliance with that provision in collective 
agreements, it has not addressed or fleshed out the list of requirements set out in 
paragraph 2, either in the law itself or in the explanatory memorandum to the 
respective statutory provisions. 
15 The view that a national provision should be interpreted in the sense that 
Article 88(2) of the GDPR must be taken into account by the controller with 
regard to the requirements mentioned in that provision is mistaken in so far as the 
regulation requires that the rules themselves are to include within their scope 
suitable and specific measures to safeguard the data subject’s human dignity, 
legitimate interests and fundamental rights, which also include monitoring 
systems at the work place. Accordingly, Article 88(2) of the GDPR requires 
necessary compliance in the respective national rules by the national legislature 
and is not merely a legal provision that must be additionally complied with by 
those who apply a national provision. This is because those who apply such 
provisions are not the addressees of Article 88(2) of the GDPR. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-34/21 
 
6  
16 In that context, the referring court is also unable to recognise that Article 88(1) of 
the GDPR in conjunction with the first sentence of Paragraph 23(1) of the HDSIG 
constitutes a lex specialis for the first sentence of Article 6(1)(b) of the GDPR in 
respect of the implementation of the employment relationship, since Article 88(1) 
of the GDPR was clearly not taken into account in its entirety in the determination 
of the content of Paragraph 23 of the HDSIG. 
17 Therefore, the question that arises for the referring court is whether or not the first 
sentence of Paragraph 23(1) of the HDSIG and Paragraph 86(4) of the BDSG – 
also taking into account the further provisions of the respective laws – meet the 
requirements of Article 88(1) and (2) of the GDPR or whether they remain 
applicable despite a breach of those requirements. 
18 If the first sentence of Paragraph 23(1) of the HDSIG and Paragraph 86(4) of the 
BDSG do not form a legal basis for the measure planned by the other party to the 
proceedings (Minister des Hessischen Kultusministeriums – Minister of the 
Hessen Ministry of Education) for handling employee data in video conferencing 
systems, such a legal basis would have to be created. Such a legal basis could be 
the conclusion of a service agreement between the parties to the proceedings 
pursuant to Paragraph 23(4) of the HDSIG.