Traffic jams on the data highway

How the participation rights of the works council can delay the introduction of new software

By Dr. Martin Trayer, LL.M. and Frank Racky, LL.M., MPA

Beitrag als PDF (Download)

Introduction
The German Trade Union Confederation (Deutscher Gewerkschaftsbund, DGB) recently explained on its website how Microsoft Office 365 can be used to monitor employees, thereby triggering the participation rights of the works council. In 2018, the German Federal Labor Court (Bundesarbeitsgericht, BAG) held that even the use of Excel sheets to calculate sick pay is a matter for the works council. Other examples decided by the courts include allowing comments on a Facebook site and introducing new business software. The extensive view taken by the German Federal Labor Court in this respect has driven employers and works councils alike to the brink. With the ever-increasing speed of new software updates, it is hard to keep up with these participation rights. Works councils therefore often complain that they are only able to start getting involved once new software is about to be installed. Weak or delayed communication has brought many IT projects to a halt. A framework agreement that supports a clear process and contains underlying principles may provide relief for both employers and works councils while also helping to clarify the extent of the backlog of software updates that need to be introduced.

Participation rights of the works council
Introducing or updating software may trigger various participation rights of the works council. The most relevant participation right is related to “introducing and applying technical devices designed to monitor the employees’ conduct or performance” pursuant to section 87 paragraph 1 number 6 of the German Works Constitution Act (Betriebsverfassungsgesetz, BetrVG). Upon reading the law, it does not seem to be at all relevant to most standard or business software, as the employer generally has no intention of monitoring employee conduct or performance. However, the way this regulation has been interpreted by the German Federal Labor Court is that “designed to” monitor must be read as “capable of” monitoring. Taking this wide view, virtually any software seems capable of monitoring employees by recording their input or simply creating a time log for users. Software storing telemetric data may provide further information on the employee’s performance, such as the time a particular document has been opened.
The German Federal Labor Court has developed the participation rights of the works council in several decisions: In 1984, the court held that “monitoring includes collecting new information as well as evaluating already existing information” (BAG, September 14, 1984: docket number 1 ABR 23/82). It seems surprising how a person’s privacy may be impacted by simply typing in data already known to the employer. However, the Federal Labor Court deliberately took a wide view on this. The rationale behind this view was to protect the employee’s privacy against the increased potential for monitoring carried out by technical devices. The German legislature identified this potential as early as 1972, when section 87 paragraph 1 number 6 was introduced into the German Works Constitution Act. Its introduction was justified with the argument that “such devices hav[e] a strong impact on the employee’s privacy” (Comments on Government Draft of Works Constitution Act 1972, BT-Dr. VI/1786, p. 48 et seq.).
As to the subjective element (mens rea), it was stated in several decisions that a technical device may be qualified as being designed to monitor employees, irrespective of whether the employer actually intends to process or use the collected information in connection with an employee’s conduct or performance. In the Facebook case, an employer had allowed guests to leave comments on the company’s Facebook site. These comments were neither screened for information related to the employees’ performance nor even intended to serve this purpose. Nevertheless, the German Federal Labor Court held that the comment function must be considered a technical device designed to monitor employees (BAG, December 13, 2016: docket number 1 ABR 7/15).
In 2018, the German Federal Labor Court ruled there is no de minimis threshold for triggering the participation rights of the works council regarding technical devices. Even the intention of using a simple Excel sheet, or more precisely, its sum function, in the HR department for the purpose of calculating sick days may have to be discussed and agreed upon with the works council (BAG, October 23, 2018: docket number 1 ABN 36/18).
The works council’s participation rights include both the introduction of software as well as its application. If the employer ignores the works council’s right to participate, the works council may, inter alia, sue the employer before the German labor courts for injunctive relief. Thus, these participation rights could impede the speed of future digitalization.

Data protection
The protection of employee data is closely connected to the works council’s participation rights regarding technical devices designed to monitor employees. On the basis ofthe statutory obligation to monitor compliance with employees’ rights, the works council strives to ensure proper protection of employee data processed by new software. The measures that need to be taken and the level of protection granted have often given rise to discussions in the context of introducing new software.
However, with the General Data Protection Regulation (GDPR) coming into force, data protection has become a common interest for both the employer and the works council. This is even more true now that an agreement with the works council is recognized as a legal basis for data processing in section 26 paragraph 4 of the German Federal Data Protection Act (Bundesdatenschutzgesetz) in addition to individual consent of the data subject or statutory provisions permitting data processing.
Thus, an agreement with the works council may regulate the employee’s individual rights regarding his or her data, such as information rights (article 13 GDPR), right of access (article15 GDPR), right to rectification (article16 GDPR) and right to erasure (article 17 GDPR). Typically, such agreements also cover questions lsuch as access rights to the employee’s user or performance data and contain retention or deletion periods with regard to this data.

Framework vs. patchwork
Many employers have taken a piecemeal approach with regard to software programs. The works council is often contacted only after the decision to purchase new software has been made, or even worse, after it has been purchased. This approach results in a patchwork of different agreements on the use of the respective software. A general framework for introducing software, on the other hand, may help to save processing time by implementing a standard process and deal upfront with certain issues that come up in each case.
Defining standard processes for implementing new software may help increase efficiency and speed up the process. The same form can be used for each new piece of software. More importantly, a framework agreement may define different procedures depending on an evaluation of the impact a software may have on an employee’s privacy (for example, using a traffic light system). The employer would in this case carry out an assessment of the software and initiate the appropriate process. Thus, the process may be different for different kinds of software, depending on the intended use. If there is no intention whatsoever to use the performance data collected, the software may be introduced without requiring further discussion with the works council, whereas performance-tracking software would require a more detailed discussion with the works council. As a result, employers and works councils can both concentrate on tackling tougher ­challenges .
Remarkably, about 70% to 80% of agreements with the works council regarding new software cover exactly the same issues. Therefore, it makes sense to deal with these issues upfront rather than addressing them in each individual agreement with the works council. As stated before, a common ground may be found for the data protection principles. Moreover, definitions of technical measures and updates can greatly facilitate organizational alignment in future cases. A framework agreement can include the following elements that can be regulated upfront:
The employment agreement shall form the legal basis for data processing
Limitation of the monitoring of employees to the most minimal extent possible
Limitation of the scope of data ­processing
Limitation of access rights for internal and external personnel to what is necessary
Use of log files and protocols
Pseudonymization of data
Assurance of the integrity of data (for example, by encryption)

Summary
A framework agreement regulating the overarching principles that the employer must observe as well as the process for implementing new software can be a powerful tool in endeavoring to dissolve traffic jams blocking data highways. Such a framework agreement is a voluntary agreement for both parties pursuant to section 77 paragraph 2 and section 88 of the German Works Constitution Act, and as such, there is no mandatory arbitration process (Einigungsstellenverfahren) when negotiations fail. However, increasing efficiency should be as much in the works council’s interest as in the employer’s. For both the employer and the works council, trying to assess new software is a time-consuming task and requires resources not readily available elsewhere. The common interest in avoiding any conflicts with data protection rules further strengthens the common ground for an agreement. Once an agreement has been reached, the backlog for existing software needs to be reduced by implementing the defined standard process and engaging additional internal or external human resources with an IT background.

mtrayer@kpmg-law.com

fracky@kpmg-law.com