Whoever processes data
owes accountability.

Employee data protection and employee monitoring

Data protection in the employment context is among the most conflict-prone areas of GDPR application. We advise companies on employee monitoring, on the introduction of technical systems with surveillance effects, and on the legally sound design of recruiting, HR and performance processes.

The tension between § 26 BDSG (German Federal Data Protection Act), the GDPR and § 87 Abs. 1 Nr. 6 BetrVG (German Works Constitution Act) is an advisory topic in its own right — and it grows with every new AI tool in HR.

Works councils: data protection training and codetermination advice

Works councils bear a special responsibility when new IT and AI systems are introduced — codetermination under the BetrVG meets data protection under the GDPR. Both areas require works councils to keep their knowledge current — a need that recent legislative reforms have expanded considerably.

We offer training for works council bodies on data protection and employee monitoring — also in combination with our AI training for works councils, when the council must at the same time assess new AI systems in the workplace. In addition, we advise in ongoing codetermination procedures and act as external experts where we are retained for that purpose.

When several reporting chains run at once

The 72-hour deadline of Art. 33 GDPR runs from awareness, with no allowance for weekends and holidays. Whoever meets it has clarified beforehand who assesses, who notifies, and who speaks to the supervisory authority. The decision against notifying also belongs in the record; it is the first thing a supervisory authority will later ask about.

If the same incident also hits a connected product or an entity under the BSI Act (BSIG), further reporting chains with their own triggers, deadlines, and recipients run in parallel. We keep them together in one matter, jointly with our practice area Cybersecurity & data economy.

Tracking, cookies, and consent

Storing information on the end user's device and accessing it require consent under § 25 TDDDG (German Telecommunications Digital Services Data Protection Act, successor to the TTDSG) as a rule — regardless of whether personal data is processed in doing so. Only at the second stage does the question of the legal basis for the subsequent processing arise.

We review consent banners and their design, the integration of analytics and marketing services, third-party fonts and maps, and the contractual and information obligations that follow from them. Mistakes here are visible from the outside and easy to prove — and therefore the most frequent trigger for complaints and cease-and-desist warnings (Abmahnungen).

Supervisory and fine proceedings

Representation before the data protection supervisory authorities — from answering a request for information through the hearing to the fine notice and the objection against it. Plus support in audits initiated on specific grounds and the post-incident review.

The range under Art. 83 GDPR extends to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. In practice, what matters more than the range is what a company can prove in the proceedings. Whoever has documented their processing negotiates from a different position.

Access, erasure, compensation

We assert data subject rights under the GDPR — access (Art. 15) as well as erasure and delisting (Art. 17), including against search engines. We cover the "right to be forgotten" and action against inaccurate search results in depth under Social media law.

Alongside these stands compensation for non-material damage under Art. 82 GDPR. In the Facebook scraping cases, the Bundesgerichtshof (Germany's Federal Court of Justice) held that the mere, even brief, loss of control over one's own personal data can in itself constitute non-material damage; no misuse of the data or further impairment needs to be added (judgment of November 18, 2024, VI ZR 10/24). The amounts in individual cases remain low; the number of proceedings does not. We advise both on enforcing such claims and on defending against serial claims after a data leak.

Training for companies and legal departments

Tailored formats on the GDPR, employee data protection, data protection impact assessments, and data law — from a basic module for mixed employee groups to advanced sessions for data protection officers and legal departments. Dates on request via our office.