Quick Hits

• Data processing activities prohibited by GDPR cannot be legitimised by a works agreement.
• All data processing must be lawful, transparent, and fully compliant with European data protection law.
• A mutual agreement between an employer and a works council does not create a lawful basis for otherwise noncompliant processing.

A recent case brought before…