Austria: "Thin ice" employee data - What data may companies (not) share with the works council?

25 Jan 2024    2 minute read
Workforce Redesign Personal Employee Data GDPR Works Councils HR Developments Violations Penalties Lawsuits EC Featured Content

In brief

"All information about employees!" In practice, this is what works councils often request from employers. Works councils have a legitimate interest in being involved in HR developments. However, personal employee data is usually a taboo for the works council. Sharing more information than necessary with the works council may result in severe consequences for companies.

Contents

In depth

Sharing employee data without express permission is unlawful

Personal employee data may only be shared with the works council if there is an explicit legal basis for doing so. Without such a legal basis, information must not be disclosed and corresponding requests for information from the works council must be rejected. The provisions of the Austrian Labour Constitution Act provide information on what data may be shared with the works council. This includes, for example, salary information, working time records, planned terminations and reasons for employee transfers. Employers should therefore ensure that they have legal permission for the specific purpose before disclosing any data to the works council.

What employee data may be shared with the works council?

There is a range of information that generally lacks a legal basis for disclosure. This information must not be shared with the works council, even upon an explicit request from the works council. This includes the following, for example:

  • Employees' private home addresses, private email addresses or birth dates.
  • Information of highly personal topics, such as religious affiliation or sexual orientation.
  • Information on family situation, including financial situation (credit obligations, financial situation of the employee or their partner, maintenance obligations).
  • Health data, such as specific diagnoses.
  • Any personal relationships or connections between colleagues mentioning names.

Violations can result in high penalties and lawsuits

  • If an employer discloses employees' personal data to the works council without a sufficient legal basis, the GDPR provides for fines of up to EUR 20 million or up to 4% of the global annual turnover of the previous financial year (whichever is higher).
  • In addition, employees may file injunctive and/or compensatory actions.

Recommendation

To avoid data protection violations and any resulting penalties and lawsuits, we recommend checking the following points before sharing employee data with the works council:

  • Is there a specific legal obligation to actively inform the works council?
  • Does the works council claim to have a specific right to information? If so, which one?
  • Does the law specify certain data or documents that must be provided to the works council?
  • What is the purpose of the works council's right to information?
  • Is sharing data in the interest of employees?
  • Is the principle of data minimization being adhered to and thus data transfer limited to the extent necessary?

Click here to read the German version.

Contact Information
Dr. Philipp Maier
Partner
Vienna
Read my Bio
philipp.maier@bakermckenzie.com
Simone Liebmann-Slatin
Senior Counsel
Vienna
Read my Bio
simone.liebmann-slatin@bakermckenzie.com
Sophie Loidolt
Associate
Vienna
Read my Bio
sophie.loidolt@bakermckenzie.com

Copyright © 2024 Baker & McKenzie. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms). The Content is protected under international copyright conventions. Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All Content is for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulations and practice are subject to change. The Content is not offered as legal or professional advice for any specific matter. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any Content. Baker McKenzie and the editors and the contributing authors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The Content may contain links to external websites and external websites may link to the Content. Baker McKenzie is not responsible for the content or operation of any such external sites and disclaims all liability, howsoever occurring, in respect of the content or operation of any such external websites. Attorney Advertising: This Content may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Content may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. Reproduction: Reproduction of reasonable portions of the Content is permitted provided that (i) such reproductions are made available free of charge and for non-commercial purposes, (ii) such reproductions are properly attributed to Baker McKenzie, (iii) the portion of the Content being reproduced is not altered or made available in a manner that modifies the Content or presents the Content being reproduced in a false light and (iv) notice is made to the disclaimers included on the Content. The permission to re-copy does not allow for incorporation of any substantial portion of the Content in any work or publication, whether in hard copy, electronic or any other form or for commercial purposes.