[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZB0Kk2Z1Op2u4t_-okARVMWSiOtu_8c9LeJjY5086tA":3},{"article":4,"iocs":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":27,"category":28,"article_tags":32},"fa41f292-5877-4056-ab4b-0b11a366c02b","DSB (Austria) - 2025-0.960.016","dsb-austria-2025-0-960-016-fe02ec","Created page with \"{{DPAdecisionBOX |Jurisdiction=Austria |DPA-BG-Color= |DPAlogo=LogoAT.png |DPA_Abbrevation=DSB |DPA_With_Country=DSB (Austria) |Case_Number_Name=2025-0.960.016 |ECLI=ECLI:AT:DSB:2026:2025.0.960.016 |Original_Source_Name_1=RIS |Original_Source_Link_1=https:\u002F\u002Fwww.ris.bka.gv.at\u002FDokument.wxe?Abfrage=Dsk&Entscheidungsart=Undefined&Organ=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=&VonDatum=01.01.1990&BisDatum=&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRis...\" Show changes","The Austrian Data Protection Authority (DSB) ruled that a 360-degree employee feedback process was unlawful because it lacked the required works council agreement under the Austrian Labour Constitution Act. The employer's reliance on legitimate interests or contract performance under GDPR was insufficient to override this labor law requirement.","Austrian DPA rules 360-degree employee feedback unlawful without works council agreement.","Help DSB (Austria) - 2025-0.960.016: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 13:40, 6 August 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators257 edits Tag: Decisions [1.0] (No difference) Latest revision as of 13:40, 6 August 2026 DSB - 2025-0.960.016 Authority: DSB (Austria) Jurisdiction: Austria Relevant Law: Article 88 GDPR Article 6(1)(b) GDPR Article 6(1)(f) GDPR § 96 Austrian Labour Constitution Act (ArbVG) Type: Complaint Outcome: Upheld Started: 01.08.2025 Decided: 20.03.2026 Published: 05.08.2026 Fine: n\u002Fa Parties: n\u002Fa National Case Number\u002FName: 2025-0.960.016 European Case Law Identifier: ECLI:AT:DSB:2026:2025.0.960.016 Appeal: Not appealed Original Language(s): German Original Source: RIS (in DE) Initial Contributor: ds The DPA found a 360-degree employee feedback process unlawful because it lacked the works council agreement required under the Austrian Labour Constitution Act. The employer could not rely on contract or legitimate interests to circumvent this requirement. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The data subject was employed by an Austrian stock corporation (the controller) from August 2018 to June 2025. They worked as a manager in the controller’s finance department, with technical and disciplinary responsibility for up to five employees. The controller operated a 360-degree feedback process under which the data subject completed a self-assessment and 17 other individuals, including their supervisor, three subordinates and other employees, evaluated their leadership behaviour across 27 categories. Both the data subject and their supervisor had access to the results. The process was also used for other managers within the company. On 1 August 2025, the data subject lodged a complaint with the Austrian DPA, alleging a violation of their right to confidentiality. They argued that the processing carried out as part of the 360-degree feedback process required a specific works agreement and was therefore unlawful in the absence of one. The controller had a general works agreement on the processing of employee data and a supplementary agreement covering its HR system. The controller alleged that it relied on its legitimate interests under Article 6(1)(f) GDPR and on the performance of the employment contract under Article 6(1)(b) GDPR. It argued that a works agreement would merely specify its legitimate interests and that the absence of such an agreement did not render the processing unlawful. It further maintained that whether a works agreement was required was a labour-law issue that could not be determined in the proceedings before the DPA The data subject responded that the processing of personal data in a 360-degree feedback process served to evaluate employees and therefore constituted a measure within the meaning of § 96 of the Austrian Labour Constitution Act (ArbVG). Section 96 ArbVG lists certain workplace measures that can be introduced only with the works council’s consent through a works agreement. Holding The DPA first found that the data subject was an employee covered by the Austrian Labour Constitution Act, rather than a senior executive excluded from its scope. It further held that the assessments of the data subject’s leadership behaviour constituted personal data. The DPA explained that Article 88 GDPR enables Member States to adopt, through legislation or collective agreements, more specific rules protecting the rights and freedoms of individuals in the context of employment-related processing. Such rules must include appropriate safeguards for, among other things, human dignity, legitimate interests and the fundamental rights of data subjects. Recital 155 GDPR expressly refers to works agreements as a possible instrument for implementing such rules. It further stated that Austria had made use of the opening clause in Article 88 GDPR and that § 96 ArbVG constituted one of the more specific national rules protecting employees in the context of personal data processing. It determined that the 360-degree feedback process constituted a systematic and standardised assessment of employees falling under both § 96(1)(2) ArbVG, concerning personnel questionnaires, and § 96(1)(3) ArbVG, concerning monitoring measures affecting human dignity. It held that under § 96 ArbVG, the processing therefore required the works council’s consent through a valid works agreement. It pointed out that the controller’s existing works agreements did not cover the 360-degree feedback process or the categories of personal data collected through it. It therefore held that the processing could not be based on a works agreement under Article 88(1) GDPR in conjunction with § 96 ArbVG. The DPA held that the controller could not rely on Article 6(1)(f) GDPR. It stated that although personnel management and improving employee performance might generally constitute legitimate interests, an interest pursued through processing contrary to national law could not be regarded as lawful. It concluded that since the mandatory works council consent had not been obtained, the interest could not be regarded as legitimate under Article 6(1)(f) GDPR. Moreover, it pointed out that Article 6(1)(b) GDPR was also inapplicable because the feedback process was not necessary for the performance of the employment contract. It reasoned that the employment relationship could be performed without it, and the process was not applied to all employees. The DPA therefore found that the processing was unlawful and violated the data subject’s right to confidentiality. It prohibited the controller from continuing the 360-degree feedback process for employees covered by the relevant works-council safeguards until a valid works agreement was concluded. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Text Ref. No.: 2025-0.960.016 dated March 20, 2026 (Case No.: DPA-D124.2107\u002F25) [Processing Officer’s Note: Names and company names, legal forms and product names, addresses (including URLs, IP addresses, and email addresses), file numbers (and similar), statistical data, etc., as well as their initials and abbreviations, may have been abbreviated and\u002For altered for pseudonymization purposes. Obvious spelling, grammar, and punctuation errors have been corrected.] DECISION RULING The Data Protection Authority rules on the data protection complaint filed by Dipl. Ing. Michael A*** (complainant) on August 1, August 2025 against N*** Austria AG (respondent), with representation provided by Attorney Dr. Udo B***, regarding a violation of the right to confidentiality, as follows: 1. The complaint is upheld, and it is determined that the respondent violated the complainant’s right to confidentiality by processing his personal data in the context of a 360-degree feedback process. The respondent is prohibited from processing personal data as part of the 360-degree feedback process with respect to those employees who are not considered executives within the meaning of § 36(1)(3) of the Works Constitution Act (ArbVG) [Editor’s note: this presumably refers to § 36(2)(3) ArbVG.], until a valid works agreement is concluded in accordance with § 96(1) ArbVG, with immediate effect.The respondent is prohibited from processing personal data in the context of 360-degree feedback concerning those employees who are not considered managerial employees within the meaning of Section 36, paragraph 1, item 3, of the Works Constitution Act (ArbVG) [Editor’s note: this presumably refers to Section 36(2)(3) of the ArbVG], until a valid works agreement is concluded in accordance","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_2025-0.960.016&diff=52635&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F1\u002F1f\u002FLogoAT.png","2026-08-06T13:40:45+00:00","2026-08-06T14:00:11.117527+00:00",7,[18,21,24],{"name":19,"type":20},"DSB","vendor",{"name":22,"type":23},"360-degree employee feedback process","product",{"name":25,"type":26},"GDPR","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":27,"icon":29,"name":30,"slug":31},null,"Policy","policy",[33,37,42,44],{"category":34},{"id":35,"icon":29,"name":25,"slug":36},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":38},{"id":39,"icon":29,"name":40,"slug":41},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":43},{"id":27,"icon":29,"name":30,"slug":31},{"category":45},{"id":46,"icon":29,"name":47,"slug":48},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]