DATA PROTECTION
Live streaming by videoconference of classes in state school education falls within the scope of the GDPR.
In the Judgment of the EU Court of Justice in Case C-34/21 | Hauptpersonalrat der Lehrerinnen und Lehrer, The Court clarified the following.
By two measures adopted in 2020, the Minister for Education and Culture of the Land Hessen (Germany) established the legal and organisational framework for school education during the COVID-19 pandemic, providing, inter alia, for the possibility for pupils who could not be present in a classroom to attend classes live by videoconference. In order to safeguard pupils’ rights in relation to the protection of personal data, it was established that connection to the videoconference service would be authorised only with the consent of the pupils themselves or, for those pupils who were minors, of their parents. However, no provision was made for the consent of the teachers concerned to their participation in that service.
Taking issue with the fact that the live streaming of classes by videoconference, as provided for by the national legislation, was not conditional on the consent of the teachers concerned, the Principal Staff Committee for Teachers at the Ministry of Education and Culture of the Land Hessen brought an action against the Minister responsible for those matters. The Minister contended that the processing of personal data inherent in the live streaming of classes by videoconference was covered by national legislation, so that it could be conducted without the consent of the teachers concerned being sought.
The administrative court hearing the case stated that, in accordance with the intention of the legislature of the Land Hessen, the national legislation on the basis of which the teachers’ personal data is processed, falls within the category of ‘more specific rules’ which the Member States may lay down, in accordance with Article 88(1) of the General Data Protection Regulation, in order to ensure the protection of employees’ rights and freedoms with regard to the processing of their personal data in the employment context. However, that court had doubts as to whether that legislation was compatible with the conditions laid down in Article 88(2) of the GDPR. It therefore made a reference to the Court of Justice for a preliminary ruling.
By its judgment, the Court holds that national legislation cannot constitute a ‘more specific rule’, within the meaning of Article 88(1) of the GDPR, where it does not satisfy the conditions laid down in paragraph 2 of that article. In addition, the Court states that the application of national provisions adopted to ensure the protection of employees’ rights and freedoms with regard to the processing of their personal data in the employment context must be disregarded where those provisions do not comply with the conditions and limits laid down in Article 88(1) and (2) of the GDPR, unless the provisions at issue constitute a legal basis for the processing, referred to in another article of the GDPR, which complies with the requirements laid down by that regulation.
Findings of the Court.
As a preliminary point, the Court considers that the processing of teachers’ personal data during the live streaming by videoconference of the public educational classes which they provide falls within the material scope of the GDPR. It states, next, that that processing of the personal data of teachers who, as employees or civil servants, are part of the public service of the Land Hessen, falls within the personal scope of Article 88 of the GDPR, which concerns the processing of employees’ personal data in the employment context.
As a first step, the Court examines whether a ‘more specific rule’ within the meaning of Article 88(1) of the GDPR must satisfy the conditions laid down in paragraph 2 of that article. According to the Court, it is apparent from the use of the words ‘more specific’ in the wording of Article 88(1) of the GDPR that the rules referred to in that provision must have the normative content specific to the area regulated which is distinct from the general rules of that regulation. It is also apparent from the wording of Article 88 of the GDPR that paragraph 2 of that article circumscribes the discretion of Member States wishing to adopt ‘more specific rules’ under paragraph 1 of that article. Thus, the Court considers, first, that those rules cannot merely reiterate the provisions of that regulation laying down the conditions for the lawfulness of the processing of personal data and the principles of that processing, or merely refer to those conditions and principles. Those rules must seek to protect employees’ rights and freedoms in respect of the processing of their data and include suitable and specific measures to protect the data subjects’ human dignity, legitimate interests and fundamental rights. Second, particular regard must be had to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity, and monitoring systems at the work place. Consequently, in order to be classified as a ‘more specific rule’ within the meaning of Article 88(1) of the GDPR, a rule of law must satisfy the conditions laid down in paragraph 2 of that article.
As a second step, the Court specifies the consequences which should be drawn from a finding that the national provisions at issue are incompatible with the conditions and limits laid down in Article 88(1) and (2) of the GDPR. Thus, the Court recalls that it is for the referring court, which alone has jurisdiction to interpret national law, to assess whether the national provisions at issue comply with the conditions and limits laid down in Article 88 of the GDPR. However, the Court notes that those national provisions, which make the processing of employees’ personal data subject to the condition that such processing is necessary for certain purposes connected with the performance of an employment relationship, appear to reiterate the condition for general lawfulness already set out in the GDPR, without adding a more specific rule within the meaning of Article 88(1) of that regulation. If the referring court were to find that those national provisions do not comply with the conditions and limits laid down in Article 88 of the GDPR, it would, in principle, be required to disregard them. In accordance with the principle of the primacy of EU law, in the absence of more specific rules that comply with the conditions and limits prescribed by Article 88 of the GDPR, the processing of personal data in the employment context, both in the private and public sectors, is directly governed by the provisions of that regulation.
In that regard, the Court notes that other provisions of the GDPR, under which the processing of personal data islawful where that processing is necessary, respectively, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or for compliance with a legal obligation to which the controller is subject, may apply to the processing of personal data such as that in the present case. With regard to those two situations where processing is lawful, the GDPR, 8 first, provides that the processing must be based on EU law or on the law of the Member State to which the controller is subject and, second, adds that the purposes of the processing are to be determined in that legal basis or are to be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Consequently, where the referring court finds that the national provisions on the processing of personal data in the employment context do not comply with the conditions and limits laid down in Article 88(1) and (2) of the GDPR, it must still verify whether those provisions constitute a legal basis for the processing, referred to in another article of the GDPR, 9 which complies with the requirements laid down by that regulation. If that is the case, the application of those national provisions must not be disregarded.
(Source: Press Release of the EU Court of Justice no. 54/2023 - Ownership of the contents: EU Court of Justice).
By two measures adopted in 2020, the Minister for Education and Culture of the Land Hessen (Germany) established the legal and organisational framework for school education during the COVID-19 pandemic, providing, inter alia, for the possibility for pupils who could not be present in a classroom to attend classes live by videoconference. In order to safeguard pupils’ rights in relation to the protection of personal data, it was established that connection to the videoconference service would be authorised only with the consent of the pupils themselves or, for those pupils who were minors, of their parents. However, no provision was made for the consent of the teachers concerned to their participation in that service.
Taking issue with the fact that the live streaming of classes by videoconference, as provided for by the national legislation, was not conditional on the consent of the teachers concerned, the Principal Staff Committee for Teachers at the Ministry of Education and Culture of the Land Hessen brought an action against the Minister responsible for those matters. The Minister contended that the processing of personal data inherent in the live streaming of classes by videoconference was covered by national legislation, so that it could be conducted without the consent of the teachers concerned being sought.
The administrative court hearing the case stated that, in accordance with the intention of the legislature of the Land Hessen, the national legislation on the basis of which the teachers’ personal data is processed, falls within the category of ‘more specific rules’ which the Member States may lay down, in accordance with Article 88(1) of the General Data Protection Regulation, in order to ensure the protection of employees’ rights and freedoms with regard to the processing of their personal data in the employment context. However, that court had doubts as to whether that legislation was compatible with the conditions laid down in Article 88(2) of the GDPR. It therefore made a reference to the Court of Justice for a preliminary ruling.
By its judgment, the Court holds that national legislation cannot constitute a ‘more specific rule’, within the meaning of Article 88(1) of the GDPR, where it does not satisfy the conditions laid down in paragraph 2 of that article. In addition, the Court states that the application of national provisions adopted to ensure the protection of employees’ rights and freedoms with regard to the processing of their personal data in the employment context must be disregarded where those provisions do not comply with the conditions and limits laid down in Article 88(1) and (2) of the GDPR, unless the provisions at issue constitute a legal basis for the processing, referred to in another article of the GDPR, which complies with the requirements laid down by that regulation.
Findings of the Court.
As a preliminary point, the Court considers that the processing of teachers’ personal data during the live streaming by videoconference of the public educational classes which they provide falls within the material scope of the GDPR. It states, next, that that processing of the personal data of teachers who, as employees or civil servants, are part of the public service of the Land Hessen, falls within the personal scope of Article 88 of the GDPR, which concerns the processing of employees’ personal data in the employment context.
As a first step, the Court examines whether a ‘more specific rule’ within the meaning of Article 88(1) of the GDPR must satisfy the conditions laid down in paragraph 2 of that article. According to the Court, it is apparent from the use of the words ‘more specific’ in the wording of Article 88(1) of the GDPR that the rules referred to in that provision must have the normative content specific to the area regulated which is distinct from the general rules of that regulation. It is also apparent from the wording of Article 88 of the GDPR that paragraph 2 of that article circumscribes the discretion of Member States wishing to adopt ‘more specific rules’ under paragraph 1 of that article. Thus, the Court considers, first, that those rules cannot merely reiterate the provisions of that regulation laying down the conditions for the lawfulness of the processing of personal data and the principles of that processing, or merely refer to those conditions and principles. Those rules must seek to protect employees’ rights and freedoms in respect of the processing of their data and include suitable and specific measures to protect the data subjects’ human dignity, legitimate interests and fundamental rights. Second, particular regard must be had to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity, and monitoring systems at the work place. Consequently, in order to be classified as a ‘more specific rule’ within the meaning of Article 88(1) of the GDPR, a rule of law must satisfy the conditions laid down in paragraph 2 of that article.
As a second step, the Court specifies the consequences which should be drawn from a finding that the national provisions at issue are incompatible with the conditions and limits laid down in Article 88(1) and (2) of the GDPR. Thus, the Court recalls that it is for the referring court, which alone has jurisdiction to interpret national law, to assess whether the national provisions at issue comply with the conditions and limits laid down in Article 88 of the GDPR. However, the Court notes that those national provisions, which make the processing of employees’ personal data subject to the condition that such processing is necessary for certain purposes connected with the performance of an employment relationship, appear to reiterate the condition for general lawfulness already set out in the GDPR, without adding a more specific rule within the meaning of Article 88(1) of that regulation. If the referring court were to find that those national provisions do not comply with the conditions and limits laid down in Article 88 of the GDPR, it would, in principle, be required to disregard them. In accordance with the principle of the primacy of EU law, in the absence of more specific rules that comply with the conditions and limits prescribed by Article 88 of the GDPR, the processing of personal data in the employment context, both in the private and public sectors, is directly governed by the provisions of that regulation.
In that regard, the Court notes that other provisions of the GDPR, under which the processing of personal data islawful where that processing is necessary, respectively, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or for compliance with a legal obligation to which the controller is subject, may apply to the processing of personal data such as that in the present case. With regard to those two situations where processing is lawful, the GDPR, 8 first, provides that the processing must be based on EU law or on the law of the Member State to which the controller is subject and, second, adds that the purposes of the processing are to be determined in that legal basis or are to be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Consequently, where the referring court finds that the national provisions on the processing of personal data in the employment context do not comply with the conditions and limits laid down in Article 88(1) and (2) of the GDPR, it must still verify whether those provisions constitute a legal basis for the processing, referred to in another article of the GDPR, 9 which complies with the requirements laid down by that regulation. If that is the case, the application of those national provisions must not be disregarded.
(Source: Press Release of the EU Court of Justice no. 54/2023 - Ownership of the contents: EU Court of Justice).
