In Germany, the committee representing teachers at the Ministry of Education of the Land of Hesse is challenging the fact that, during the Covid-19 period, the consent of teachers was not sought when they connected to the videoconferencing service, contrary to the established obligation for pupils (or their parents) to give their consent (Case C-34/21).
According to the regional ministry, the processing of personal data during the online dissemination of courses was already covered by the national regulation on the basis of which the processing of personal data of the taught is carried out.
Referred to by the German administrative court, the Court examines whether the national rules at issue fall into the category of “more specific rules” under the General Data Protection Regulation (GDPR) (2016/679). According to Article 88 of the GDPR, Member States may provide, by law or by means of collective agreements, for additional rules to ensure the protection of employees’ personal data in the context of employment relationships for the purposes, in particular, of the performance of the employment contract and the organisation of work.
In its judgment, the Court ruled that a national regulation constitutes a more specific rule when it contains normative content specific to the field regulated and distinct from the general rules of the GDPR. Member States thus cannot ‘merely’ reiterate the provisions of that regulation. Particular attention must therefore be paid to the transparency of the processing of personal data, the transfer of such data within a group of companies and the monitoring systems in the workplace.
It is for the national court which referred the case to assess whether the national provisions at issue comply with the conditions and limits laid down in Article 88 of the GDPR. If the Commission considers that the national provisions do not meet the required conditions, it should in principle leave them unapplied, unless they constitute a legal basis for the application of rules covered by another article of the GDPR.
See the Court’s judgment: https://aeur.eu/f/653 (Original version in French by Mathieu Bion)