Austrian DPA Rules Employee Feedback Process Unlawful for Lacking Works Council Approval
An Austrian employer implemented a 360-degree employee feedback system without obtaining the mandatory works council agreement required under the Austrian Labour Constitution Act (ArbVG), rendering the entire data processing activity unlawful. Attempting to justify the processing under GDPR's legitimate interests (Art. 6(1)(f)) or contract performance (Art. 6(1)(b)) does not override national labor law co-determination rights. This case highlights that GDPR compliance alone is insufficient — organizations must also satisfy sector-specific and national statutory requirements before processing employee data. The ruling underscores the layered nature of data protection obligations in EU member states, where local labor laws frequently impose additional constraints on workplace data processing.
Tactical Insight
Immediate actions
- Audit all existing employee data processing activities to identify any that lack required works council or employee representative agreements.
- Suspend or pause any unlawful employee monitoring or evaluation systems until proper legal bases and co-determination approvals are secured.
Legal & compliance alignment
- Engage legal counsel to map national labor law requirements (e.g., ArbVG in Austria, BetrVG in Germany) alongside GDPR obligations before deploying any HR technology.
- Establish a mandatory pre-deployment checklist that requires sign-off from both DPO and HR legal teams before any new employee data processing begins.
- Document works council negotiations and agreements as part of the processing records under GDPR Art. 30.
Long-term improvements
- Implement a Data Protection Impact Assessment (DPIA) process specifically tailored for employee-facing systems that includes a labor law compliance gate.
- Train HR and management teams on the intersection of GDPR and national labor co-determination rights to prevent recurring violations.
- Establish a periodic review cycle for all HR data processing activities to ensure continued compliance with evolving national regulations.