Employee data protection and applicant data

In short: Employers may collect data of applicants and employees only as far as necessary for the employment relationship; covert surveillance and unnecessary questions are taboo.

In more detail: In employment relationships § 26 BDSG applies alongside the GDPR: data may be processed if it is necessary for the decision on establishing, carrying out or ending the employment relationship. Because employees are dependent, consent is only limitedly voluntary. This is general information and not legal advice; laws change and individual cases can differ. For concrete problems counselling (consumer advice, lawyer, data protection authority) helps.

In Depth

Application

Employers may ask what is relevant to the job (qualification, work experience). Inadmissible are questions about pregnancy, family planning, religion, party, union, criminal record (except for jobs where it matters, such as childcare), illnesses (except where relevant to the activity) and financial circumstances. For inadmissible questions you are not obliged to tell the truth and may if necessary answer untruthfully (right to lie, only for inadmissible questions). Application documents are confidential; after the procedure return or delete them (as a rule after about three to six months, because of possible claims under the AGG). Inclusion in talent pools needs consent. Googling applicants is only partly permissible (professional networks yes, private social media hardly).

In employment

Permissible: data for payroll, time recording, personnel file, social insurance. The personnel file must be complete, true and confidential; employees have a right of inspection. Private use of email/internet at work: regulation in the contract or works agreement needed. Monitoring (video surveillance, employee monitoring by software, GPS) only with concrete reason, proportionality and information; co-determination of the works council. Health data is particularly protected.

Employees’ rights

Access, rectification, erasure, restriction, objection apply here too. In case of violations you can turn to data protection officers, works council, data protection authority. Damages are possible. After the end of employment data must be deleted unless retention periods (tax, social insurance, payroll records for several years) stand in the way.

Tips

The same applies to trainees. Keep application, contract and reference documents safe. Photos of employees (website, social media) generally need voluntary written consent, which can be withdrawn. As an employer: privacy notices for applicants/employees, authorisation concepts for personnel data, deletion concept.

See also: Employment contract, Video surveillance, Data subject rights