German works council elections in 2026: Don’t forget about data protection
The German works council elections also include data protection responsibilities. By assessing early on what is really needed, clearly regulating access rights and preparing well for the handover, you can be sure that you are on the safe side when it comes to data protection.
No co-determination rights for works councils in data protection matters in Germany
In Germany, the works council does not have a right of co-determination insofar as the GDPR provides clear guidelines. These guidelines must not be deviated from, not even in works agreements.
Audit focus for 2026: How good is your data protection notice?
In the past few years, the data protection supervisory authorities have announced in advance which privacy topic will receive increased scrutiny for the calendar year. In 2026 information and transparency obligations have been chosen.
A new EU Data Act
The EU “Data Act” entered into application almost a week ago. What is it? And how does it relate to data protection?
Doctor’s note and data protection
Nobody has to tell their employer details about their state of health. However, in certain cases, the employer may still obtain certain additional details – but only the bare minimum.
Will the Data Privacy Framework (TADPF) be eliminated?
Keep an eye on data protection at US companies. Insofar as data transfers are based on the EU-US Data Privacy Framework, check whether EU standard contractual clauses can be concluded as well.
ECJ ruling on damages for violations of data protection
Last Thursday, the European Court of Justice (ECJ) handed down a ruling on compensation for data protection breaches.
AI integration: Emphasis on data protection
If artificial intelligence is to be used, do not give it any personal data. If this is not possible, the usual data protection requirements must be complied with.
What are the supervisory authorities paying attention to in 2024?
In 2024, the supervisory authorities’ focus will be on checking whether companies have good processes for handling data subject access requests in place.