Rights
GDPR with strict German additions on employee data
The GDPR applies directly, supplemented by the BDSG. Germany layers on works-council involvement and a lower threshold for appointing a data protection officer.
Key rules
- A DPO is mandatory where 20 or more people are regularly engaged in automated processing.
- Employee monitoring generally requires a works agreement.
- Sixteen state authorities plus the federal authority share supervision.
Governing law
- Bundesdatenschutzgesetz
- EU GDPR (Regulation 2016/679)
Penalties and consequences
- Up to €20 million or 4% of global turnover
In practice
Because supervision is decentralised, the competent authority depends on the establishment's Land, and their published guidance is not always identical.