The Minister for Education and Culture in Hessen, Germany, established legal and organizational frameworks for school education during the COVID-19 pandemic, including the option for students to attend live classes by videoconference with their consent or the consent of their parents.
However, there was no provision for teachers to give consent for their participation in the service. The Principal Staff Committee for Teachers at the Ministry of Education and Culture brought an action against the Minister, arguing that teachers’ consent was necessary for the live streaming of classes by videoconference. The Minister argued that the processing of teachers’ personal data inherent in the live streaming of classes was covered by national legislation so that it could take place without the teachers’ consent.
The administrative court originally hearing the case recognized that the national legislation in question falls under the category of “more specific rules” that Member States can establish to protect employees’ personal data rights and freedoms under Article 88(1) of the GDPR (concerning personal data processing in the context of employment), and thus serve as an appropriate legal basis. However, the court had doubts regarding whether the legislation complied with the conditions set out in Article 88(2) of the GDPR, which provides that those rules are to include suitable and specific measures to safeguard the data subjects’ human dignity, legitimate interests, and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data and monitoring systems at the workplace. Therefore, the case was referred to the European Court of Justice for a preliminary ruling.
In its judgment of 30 March 2023, the European Court of Justice clarified two issues. First, the Court held that Article 88 GDPR can serve as an appropriate legal basis for national legislation allowing for the processing of teachers’ personal data during live streaming of classes if those national provisions comply with the abovementioned requirements established in that article. Second, if national legislation does not comply with those requirements, and Article 88 GDPR cannot serve as an appropriate legal basis, the national court must determine whether another GDPR provision could serve as an appropriate legal basis for that legislation. For instance, the referring court must verify whether national provisions on the processing of personal data in the employment context comply with the requirements laid down in Article 6(1) and (3) GDPR, which provides a legal basis for processing personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
Reference: case C-34/21 / ECLI:EU:C:2023:270.
