62021CJ0034_RES
Case C‑34/21
Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium
v
Minister des Hessischen Kultusministeriums
(Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden)
Judgment of the Court (First Chamber), 30 March 2023
(Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 88(1) and (2) – Processing of data in the employment context – Regional school system – Teaching by videoconference due to the COVID-19 pandemic – Implementation without the express consent of teachers)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Scope – Derogations – Processing of data in the course of an activity which falls outside the scope of EU law – Activity which is intended to safeguard national security or which falls into that category – Meaning – Activity relating to the organisation of public education – Not included
(European Parliament and Council Regulation 2016/679, recital 16 and Art. 2(1) and (2)(a) and (b))
(see paragraphs 32-37)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Processing of employees’ data in the employment context – Meaning – Live streaming by videoconference of the educational classes provided by teachers as part of a public service – Included
(European Parliament and Council Regulation 2016/679, recital 10 and Arts 1(2) and 88)
(see paragraphs 39-56)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Processing of employees’ data in the employment context – Notion of more specific rules – Option granted to Member States – Objective of protecting employees’ rights and freedoms in the processing of their data – Conditions and limits laid down by the regulation – National legislation not satisfying those conditions and limits – Not included
(European Parliament and Council Regulation 2016/679, recital 10 and Art. 88(1) and (2))
(see paragraphs 58-75, operative part 1)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Processing of employees’ data in the employment context – Conditions and limits laid down by the regulation – National measures making provision for live streaming by videoconference of the public educational classes provided by teachers without their express consent – Not permissible – Consequences – Inapplicability of those measures – Limits
(Art. 288, 2nd para., TFEU; Regulation of the European Parliament and of the Council 2016/679, recital 45 and Arts 5, 6(1), first para., and (3), and 88(1) and (2))
(see paragraphs 77-89, operative part 2)
Résumé
Live streaming by videoconference of classes in state school education falls within the scope of the GDPR
By two measures adopted in 2020, the Minister for Education and Culture of the Land Hessen (Germany) established the legal and organisational framework for school education during the COVID-19 pandemic, providing, inter alia, for the possibility for pupils who could not be present in a classroom to attend classes live by videoconference. In order to safeguard pupils’ rights in relation to the protection of personal data, it was established that connection to the videoconference service would be authorised only with the consent of the pupils themselves or, for those pupils who were minors, of their parents. However, no provision was made for the consent of the teachers concerned to their participation in that service.
Taking issue with the fact that the live streaming of classes by videoconference, as provided for by the national legislation, was not conditional on the consent of the teachers concerned, the Principal Staff Committee for Teachers at the Ministry of Education and Culture of the Land Hessen brought an action against the Minister responsible for those matters. The Minister contended that the processing of personal data inherent in the live streaming of classes by videoconference was covered by national legislation, so that it could be conducted without the consent of the teachers concerned being sought.
The administrative court hearing the case stated that, in accordance with the intention of the legislature of the Land Hessen, the national legislation on the basis of which the teachers’ personal data is processed, falls within the category of ‘more specific rules’ which the Member States may lay down, in accordance with Article 88(1) of the General Data Protection Regulation, (
1
) in order to ensure the protection of employees’ rights and freedoms with regard to the processing of their personal data in the employment context. (
2
) However, that court had doubts as to whether that legislation was compatible with the conditions laid down in Article 88(2) of the GDPR. (
3
) It therefore made a reference to the Court of Justice for a preliminary ruling.
By its judgment, the Court holds that national legislation cannot constitute a ‘more specific rule’, within the meaning of Article 88(1) of the GDPR, where it does not satisfy the conditions laid down in paragraph 2 of that article. In addition, the Court states that the application of national provisions adopted to ensure the protection of employees’ rights and freedoms with regard to the processing of their personal data in the employment context must be disregarded where those provisions do not comply with the conditions and limits laid down in Article 88(1) and (2) of the GDPR, unless the provisions at issue constitute a legal basis for the processing, referred to in another article of the GDPR, (
4
) which complies with the requirements laid down by that regulation.
Findings of the Court
As a preliminary point, the Court considers that the processing of teachers’ personal data during the live streaming by videoconference of the public educational classes which they provide falls within the material scope of the GDPR. It states, next, that that processing of the personal data of teachers who, as employees or civil servants, are part of the public service of the Land Hessen, falls within the personal scope of Article 88 of the GDPR, which concerns the processing of employees’ personal data in the employment context.
As a first step, the Court examines whether a ‘more specific rule’ within the meaning of Article 88(1) of the GDPR must satisfy the conditions laid down in paragraph 2 of that article. According to the Court, it is apparent from the use of the words ‘more specific’ in the wording of Article 88(1) of the GDPR that the rules referred to in that provision must have the normative content specific to the area regulated which is distinct from the general rules of that regulation. It is also apparent from the wording of Article 88 of the GDPR that paragraph 2 of that article circumscribes the discretion of Member States wishing to adopt ‘more specific rules’ under paragraph 1 of that article. Thus, the Court considers, first, that those rules cannot merely reiterate the provisions of that regulation laying down the conditions for the lawfulness of the processing of personal data and the principles of that processing, (
5
) or merely refer to those conditions and principles. Those rules must seek to protect employees’ rights and freedoms in respect of the processing of their data and include suitable and specific measures to protect the data subjects’ human dignity, legitimate interests and fundamental rights. Second, particular regard must be had to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity, and monitoring systems at the work place. Consequently, in order to be classified as a ‘more specific rule’ within the meaning of Article 88(1) of the GDPR, a rule of law must satisfy the conditions laid down in paragraph 2 of that article.
As a second step, the Court specifies the consequences which should be drawn from a finding that the national provisions at issue are incompatible with the conditions and limits laid down in Article 88(1) and (2) of the GDPR.
Thus, the Court recalls that it is for the referring court, which alone has jurisdiction to interpret national law, to assess whether the national provisions at issue comply with the conditions and limits laid down in Article 88 of the GDPR. However, the Court notes that those national provisions, which make the processing of employees’ personal data subject to the condition that such processing is necessary for certain purposes connected with the performance of an employment relationship, appear to reiterate the condition for general lawfulness already set out in the GDPR, (
6
) without adding a more specific rule within the meaning of Article 88(1) of that regulation. If the referring court were to find that those national provisions do not comply with the conditions and limits laid down in Article 88 of the GDPR, it would, in principle, be required to disregard them. In accordance with the principle of the primacy of EU law, in the absence of more specific rules that comply with the conditions and limits prescribed by Article 88 of the GDPR, the processing of personal data in the employment context, both in the private and public sectors, is directly governed by the provisions of that regulation.
In that regard, the Court notes that other provisions of the GDPR, (
7
) under which the processing of personal data is lawful where that processing is necessary, respectively, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or for compliance with a legal obligation to which the controller is subject, may apply to the processing of personal data such as that in the present case. With regard to those two situations where processing is lawful, the GDPR, (
8
) first, provides that the processing must be based on EU law or on the law of the Member State to which the controller is subject and, second, adds that the purposes of the processing are to be determined in that legal basis or are to be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Consequently, where the referring court finds that the national provisions on the processing of personal data in the employment context do not comply with the conditions and limits laid down in Article 88(1) and (2) of the GDPR, it must still verify whether those provisions constitute a legal basis for the processing, referred to in another article of the GDPR, (
9
) which complies with the requirements laid down by that regulation. If that is the case, the application of those national provisions must not be disregarded.
(
1
)	Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’).
(
2
)	Under Article 88(1) of the GDPR, which is an opening clause, Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of rights and freedoms in respect of the processing of employees’ personal data in the employment context, in particular for the purposes of the performance of the contract of employment, management, planning and organisation of work.
(
3
)	Article 88(2) of the GDPR provides that those rules are to include suitable and specific measures to safeguard the data subjects’ human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data and monitoring systems at the work place.
(
4
)	Article 6(3) of the GDPR.
(
5
)	Set out, respectively, in Article 6 and Article 5 of the GDPR.
(
6
)	Point (b) of the first subparagraph of Article 6(1) of the GDPR.
(
7
)	Points (c) and (e) of the first subparagraph of Article 6(1) of the GDPR.
(
8
)	Article 6(3) of the GDPR.
(
9
)	Provided for in Article 6(3) of the GDPR, read in conjunction with recital 45.