In brief

“All information about employees!” In practice, this is what works councils often request from employers. Works councils have a legitimate interest in being involved in HR developments. However, personal employee data is usually a taboo for the works council. Sharing more information than necessary with the works council may result in severe consequences for companies.

In depth

Sharing employee data without express permission is unlawful

Personal employee data may only be shared with the works council if there is an explicit legal basis for doing so. Without such a legal basis, information must not be disclosed and corresponding requests for information from the works council must be rejected. The provisions of the Austrian Labour Constitution Act provide information on what data may be shared with the works council. This includes, for example, salary information, working time records, planned terminations and reasons for employee transfers. Employers should therefore ensure that they have legal permission for the specific purpose before disclosing any data to the works council.

What employee data may be shared with the works council?

There is a range of information that generally lacks a legal basis for disclosure. This information must not be shared with the works council, even upon an explicit request from the works council. This includes the following, for example:

• Employees’ private home addresses, private email addresses or birth dates.
• Information of highly personal topics, such as religious affiliation or sexual orientation.
• Information on family situation, including financial situation (credit obligations, financial situation of the employee or their partner, maintenance obligations).
• Health data, such as specific diagnoses.
• Any personal relationships or connections between colleagues mentioning names.

Violations can result in high penalties and lawsuits

• If an employer discloses employees’ personal data to the works council without a sufficient legal basis, the GDPR provides for fines of up to EUR 20 million or up to 4% of the global annual turnover of the previous financial year (whichever is higher).
• In addition, employees may file injunctive and/or compensatory actions.

Recommendation

To avoid data protection violations and any resulting penalties and lawsuits, we recommend checking the following points before sharing employee data with the works council:

• Is there a specific legal obligation to actively inform the works council?
• Does the works council claim to have a specific right to information? If so, which one?
• Does the law specify certain data or documents that must be provided to the works council?
• What is the purpose of the works council’s right to information?
• Is sharing data in the interest of employees?
• Is the principle of data minimization being adhered to and thus data transfer limited to the extent necessary?

Click here to read the German version.