Monthly Dose Employment Law 09/2025

Data protection limits on test data processing in the employment context

In its judgement of 8 May 2025 (8 AZR 209/21), the German Federal Labour Court (Bundesarbeitsgericht, BAG) ruled that the processing of personal data in the context of software testing is only permissible if it is based on a clear and legally compliant basis. The use of real data beyond the categories agreed in a works agreement violates the General Data Protection Regulation (GDPR) if it is not covered by a legal basis permissible under EU law, in particular Art. 6 (1) GDPR. Test processing constitutes a change of purpose and can only be justified in exceptional cases under Article 6(1)(f) GDPR if the use of dummy data is not sufficient. However, this only applies to the period from 25 May 2018 onwards.

Facts

• The plaintiff is employed by the defendant as an IT Expert and is the chairman of the works council elected at the defendant's company.
• In 2017, the defendant planned to introduce the cloud-based software ‘Workday’ as a new personnel information management system throughout the group. Between 24 April 2017 and 18 May 2017, the defendant transferred the plaintiff's personal data to a Sharepoint page of the group's parent company in the USA in order to test it in Workday. In addition to work-related information, the transferred data also included personal data that was particularly sensitive but not relevant to Art. 9 GDPR, such as salary details, private address, date of birth, marital status, social security number and tax ID.
• On 3 July 2017, the defendant concluded a works agreement with the works council on the provisional operation of Workday (BV Duldung), which regulated the categories of personal data of the defendant's employees that could be used for the test operation of Workday (including personnel number, date of entry, place of work) and prohibited the use of Workday for personnel management during the test period.
• The data at issue included categories of personal data that were not covered by BV Duldung (including private contact details, contract and remuneration details), which were also processed in Workday during the term of BV Duldung. The plaintiff claimed that these data not covered by BV Duldung constituted a violation of the GDPR.
• The defendant invoked Sec. 26 (4) BDSG (= permissibility of processing this personal data for the purposes of the employment relationship on the basis of a collective agreement) for the processing of personal data categories beyond the scope of the BV Duldung and also argued that there was no immaterial damage.
• The BAG initially suspended the legal dispute and referred the matter to the European Court of Justice (ECJ) for a ruling on the compatibility of Sec. 26 (4) BDSG with the legal requirements of Art. 88 GDPR. In its judgment of 19 December 2024 (C-65/23), the ECJ ruled that Sec. 26 BDSG is not compatible with the requirements of Art. 88 GDPR and therefore cannot be used as a basis for authorising the collection of the relevant data under data protection law.
  

Reasons for the decision

• Eligibility requirements under Art. 82 (1) GDPR: The plaintiff is entitled to compensation for non-material damage, as according to the BAG, there has been a violation of the GDPR, damage has been caused and there is a causal link.
• Data protection violation by the defendant: The defendant processed personal data that was not covered by BV Duldung and is therefore unlawful. The defendant processed data beyond the scope of the BV Duldung, such as private contact details, contract and remuneration details, social security number, tax ID, nationality and marital status, without sufficient legal basis. In doing so, the BAG expressly emphasises that the legality of the BV Duldung itself under Art. 88 GDPR was not at issue because the plaintiff no longer objected to the data referred to therein in the appeal proceedings.
• Insufficient legal basis: Sec. 26(1) of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) does not meet the requirements of the opening clause in Art. 88 GDPR and therefore cannot serve as a legal basis. The processing is also not justified under Art. 6(1)(f) GDPR, as it went beyond the data agreed in the BV Duldung and was not necessary. Justification under Art. 6 (1)(b) GDPR is also ruled out, as the test purposes did not serve to fulfil the employment contract. In principle, test data processing can be justified under Art. 6 (1)(f) GDPR if the employer can demonstrate specifically that dummy data is not sufficient – which was not the case here. In addition, the BAG emphasises that the continuation of the processing from 25 May 2018 onwards is subject to the GDPR, even though the data transfer itself took place in 2017.
• Existence of non-material damage: The plaintiff suffered non-material damage in the form of a loss of control over his personal data as a result of the unlawful data processing. Even a short-term loss of control can constitute compensable non-material damage if it can be proven. In this specific case, the damage was causally caused by the defendant's data protection breach.
• Assessment of damages: The amount takes into account the sensitivity of the data concerned, the limited circle of recipients within the group and the duration of the loss of control. The fact that the data was transferred to a third country (the USA) was not taken into account in the assessment, as the plaintiff did not invoke violations of Art. 44 et seq. GDPR. The BAG set the non-material damages at EUR 200.
  

Consequences for practice

The BAG judgement has significant practical implications for employers. Software tests in the HR area (especially the Workday software, which is currently very popular in practice) may only be carried out with real data in very limited exceptional cases; in principle, dummy or test data must be used. Works agreements set binding upper limits for the permissible data categories – any processing beyond these limits is automatically unlawful. Since Sec. 26 BDSG does not meet the requirements of Art. 88 GDPR, the permissibility of test data processing is governed directly by the GDPR; justification under Art. 6 (1)(b) GDPR is ruled out because tests constitute a change of purpose. Employers must specifically document the necessity in relation to Art. 6 (1)(f) GDPR and comply with strict data minimisation principles. Since intangible damage caused by a loss of control is already compensable, the liability risk for inadequately controlled testing and migration processes increases. Employers should comprehensively review their IT testing processes, works agreements, deletion concepts and internal data flows and adapt them to the requirements of the BAG.

No waiver of vacation entitlement through court settlement

In its judgement of 3 June 2025 (9 AZR 104/24), the BAG ruled that an employee in an existing employment relationship cannot waive their statutory minimum vacation entitlement, even through a court settlement.

Facts

• The parties are in dispute over compensation for statutory minimum vacation from the 2023 calendar year. The plaintiff was employed by the defendant as an operations manager from 1 January 2019 to 30 April 2023. His contractual vacation entitlement was 30 working days.• In a court settlement dated 31 March 2023, the parties agreed that the employment relationship would end on 30 April 2023 in return for, among other things, a severance payment of EUR 10,000.00.
• The plaintiff was continuously unable to work due to illness from 1 January 2023 to 30 April 2023 and was unable to take his vacation entitlement for that year.
• Clause 7 of the court settlement stipulated that ‘vacation entitlements shall be granted in kind’. The plaintiff took the view that this wording effectively led to an inadmissible exclusion of the statutory minimum vacation entitlement, even though the vacation had not actually been taken, and that he was therefore entitled to claim vacation compensation.
• In the correspondence between the parties prior to the conclusion of the settlement, the plaintiff's legal representative pointed out on 28 March 2023 that a waiver of the statutory minimum vacation entitlement was invalid. The plaintiff later agreed to the settlement, referring to the legal opinion expressed.
• In his action, the plaintiff sought compensation for his statutory minimum vacation from 2023 for seven working days. The lower courts upheld the action. The defendant pursued the dismissal of the action on appeal.

Reasons for the decision

• Ineffectiveness of the exclusion of claims: The appeal was unsuccessful. The BAG recognised that Clause 7 of the court settlement constituted an inadmissible exclusion of the statutory minimum vacation entitlement under Sec. 13 (1) sentence 3 of the German Federal Vacation Act (Bundesurlaubsgesetz, BUrlG). The provision was ineffective under section 134 of the German Civil Code (Bürgerliches Gesetzbuch, BGB).
• No waiver in the existing employment relationship: Neither the statutory entitlement to paid leave nor the entitlement to leave compensation, which only arises upon legal termination, can be waived in the existing employment relationship. This also applies if, at the time of concluding a court settlement on future termination, it is already foreseeable that the employee will no longer be able to take the statutory minimum vacation due to illness.
• EU law requirements (Art. 7 (2) Directive 2003/88/EC): Sec. 13 (1) sentence 3 BUrlG must be interpreted in accordance with Art. 7(2) Directive 2003/88/EC. Except in the case of termination, the statutory minimum vacation may not be replaced by financial compensation. A waiver (declared in advance) without financial compensation is even more excluded.
• No comparison of facts due to lack of actual uncertainties: Clause 7 of the court settlement does not contain a comparison of facts that would make a waiver possible. This presupposes that uncertainties about the actual conditions of a claim are to be dispelled by mutual concessions. Since the plaintiff had been continuously unable to work due to illness since the beginning of 2023, there was no room for doubt that no vacation in kind had been granted; thus, the necessary factual uncertainty was lacking.
• No basis for trust – Section 242 BGB not applicable: The defendant was not entitled to rely on the existence of an obviously unlawful provision. Especially since it had been expressly pointed out to it before the settlement was concluded that such a waiver was invalid, the BAG rejected a violation of good faith (Section 242 BGB).

Consequences for practice

In an ongoing employment relationship, a waiver of the statutory minimum vacation entitlement is just as excluded as a waiver of the compensation claim that only arises upon legal termination. The approach frequently encountered in HR practice to date of excluding vacation entitlements by means of a factual settlement – in particular by formulating that the vacation is ‘granted in kind’ – can only continue to be applied in light of this ruling by the BAG if there is actually a disputed factual uncertainty regarding the conditions for the vacation entitlement (see also the presentation for our Deloitte Legal webcast on 1 October 2025). If there is no such actual dispute – for example, in the case of continuous incapacity to work due to illness – a comparative ‘in kind’ arrangement is invalid.

An effective waiver can therefore only take place after the legal termination of the employment relationship in the form of an agreement on the compensation claim that has already arisen. Employers should also make consistent use of the instrument of irrevocable garden leave (unwiderrufliche Freistellung) in order to fulfil vacation entitlements in a legally compliant manner and avoid subsequent compensation claims.

Bonus payment in cryptocurrency as payment in kind

In its judgement of 16 April 2025 (10 AZR 80/24), the BAG ruled that, under certain conditions, remuneration for work performed may also be paid in cryptocurrency as a payment in kind in accordance with Sec. 107 (2) of the German Trade Regulation Act (Gewerbeordnung, GewO) – with the exception of the non-attachable portion of the remuneration.

Facts

• The plaintiff was employed by the defendant's company, which traded in cryptocurrency. In accordance with the relevant agreements in her employment contract, she received a basic salary plus a bonus payment as commission (Provision), which was to be calculated in EUR and converted into the cryptocurrency Ether (ETH) at the ‘current exchange rate’ on the due date.
• No settlement of commission claims for February and March 2020 and no transfer of ETH took place until the end of the employment relationship on 31 December 2021, although the plaintiff repeatedly requested the defendant to do so and provided her with a so-called wallet for the payment.
• Instead, at the end of 2021, after a flat-rate calculation of the commission claims, the defendant made a commission payment in the gross amount of EUR 15,166.16. In addition, the defendant transferred other types of cryptocurrencies (AGG tokens and US dollar coins) to the plaintiff's private wallets to offset the commission claims, which it credited accordingly in its calculation of the asserted ETH claims.
• The plaintiff then sought a court order for the transfer of 19.194 ETH units, taking into account the gross amount of EUR 15,166.16 paid by the defendant and the cryptocurrencies transferred by it, converted into ETH in each case.
• The lower courts upheld the claim. The BAG dismissed the defendant's appeal.

Reasons for the decision

• ETH as payment in kind: The BAG stated that the cryptocurrency ETH is not legal tender (‘money’) and therefore Sec. 107 (1) GewO (calculation and payment in euros) is not applicable. Nevertheless, under certain conditions, the transfer of ETH may be permissible as remuneration in the form of payment in kind pursuant to Sec. 107 (2) sentence 1 GewO.
• Requirements: According to Sec. 107 (2) sentence 1 GewO, remuneration may be granted in part in non-cash benefits if this is objectively in the interest of the employee or corresponds to the nature of the employment relationship. Remuneration in ETH could, for example, be in the interest of the employee. This was affirmed in the specific case, as the plaintiff was familiar with cryptocurrencies, a congruence between the euro amounts determined as the basis for calculation and the ETH cryptocurrency value to be transferred was contractually guaranteed, and the transfer of ETH offered a particular benefit to the plaintiff in the form of a real and not just remote chance of profit due to its market value development.
• No subsequent contract adjustment: The BAG rejected a subsequent contract adjustment based on the principles of frustration of contract (Sec. 313 BGB) in view of the interim price increases of ETH after the commissions became due. This was essentially based on the argument that the risks – as well as the opportunities – of further price developments in the event of proper performance of the contract at the due date lie exclusively with the plaintiff.
• Exception for the non-attachable portion of remuneration: However, at least the non-attachable portion of remuneration (Sec. 850 et seq. of the German Code of Civil Procedure (Zivilprozessordnung, (ZPO)) must be paid in cash in accordance with Sec. 107 (2) sentence 5 GewO; in this respect, the non-cash remuneration agreement was partially void. Since the LAG did not correctly take into account the garnishment exemption limits, the BAG referred the case back to the LAG for a new hearing and decision.

Consequences for practice

The BAG's decision clarifies that payment of the entire remuneration in cryptocurrencies is not permissible because the non-attachable portion must be paid in cash pursuant to Sec. 107 (2) sentence 5 GewO. However, employers may pay parts of the remuneration as benefits in kind in cryptocurrencies, subject to the conditions specified by the BAG.

In particular, it must be examined in each individual case whether such an agreement is objectively in the interest of the employee – for example, due to crypto-related activities or relevant knowledge.

In order for crypto remuneration to be implemented in a legally compliant manner, clear contractual provisions are required – in particular regarding the conversion rate, the valuation date and the transfer to the wallet. Changes in the exchange rate after the due date are generally borne by the employee, while delays in payment are borne by the employer. Finally, tax obligations must be observed: for income tax and social security contributions, the EUR value at the time of receipt always applies.

Fixed-term contracts without objective reason also permissible for works council members

In its judgement of 18 June 2025 (7 AZR 50/24), the BAG ruled that a fixed-term employment relationship of a works council member without objective reason pursuant to Sec. 14 (2) of the German Part-Time and Fixed-Term Employment Act (Teilzeit- und Befristungsgesetz, TzBfG) ends when the fixed term expires and that there is no restriction on this provision under EU law. However, a works council member may be entitled to conclude a permanent follow-up employment contract if the non-transfer is due to works council activities.

Facts

• The parties are in dispute over the termination of a fixed-term employment relationship without objective reason and, in the alternative, over the defendant's obligation to offer the plaintiff a permanent employment contract.
• The plaintiff initially worked for the defendant as a temporary worker and on 15 February 2021 concluded a fixed-term employment contract until 14 February 2022, which was later extended until 14 February 2023.
• Since 28 June 2022, the plaintiff had been a member of the works council newly established at the defendant's company.
• On 19 August 2022, the plaintiff's supervisor contacted the works council by email because the plaintiff had repeatedly called in sick after works council activities and had carried out works council work during shift times without consultation.
• A total of 19 employees were employed on a fixed-term basis until 14 February 2023; 16 of them received an offer for a permanent follow-up contract, but the plaintiff and another works council member did not. The plaintiff suspects that he was not offered a follow-up contract because of his works council activities.
• In his action of 7 March 2023, the plaintiff sought a declaration that his employment relationship had not ended due to the expiry of the fixed term, or alternatively, an obligation on the part of the defendant to make an offer for a permanent employment contract.
• The defendant argued that the refusal to offer a follow-up contract was not due to the plaintiff's works council activities, but rather due to unsatisfactory work performance and specific incidents, such as a refusal to work on 25 August 2022.
• The lower courts dismissed the action; the plaintiff lodged an appeal, which was also unsuccessful.
  

Reasons for the decision

• Validity of the fixed term: The fixed term of the employment relationship is permissible under Sec. 14 (2) TzBfG, as it is within the two years permitted by law. The previous employment as a temporary worker is not prior employment within the meaning of Sec. 14 (2) sentence 2 TzBfG and was not to be taken into account. Membership of the works council does not preclude the application of Sec. 14 (2) TzBfG. No restriction on fixed-term contracts without objective grounds for works council members required by EU law was identified. A teleological reduction of the norm is also ruled out, as the intention of the legislator – not to exclude works council members from the scope of Sec. 14 (2) TzBfG – is clearly recognisable. A request for a preliminary ruling from the ECJ was not necessary.
• Entitlement to a permanent follow-up employment contract: An entitlement to the conclusion of a follow-up contract only exists if the employer's refusal was due to works council activities (Sec. 78 sentence 2 BetrVG in conjunction with Sec. 280 (1), 823 (2) and 249 (1) BGB). BAG bases the possible claim for damages on prohibited discrimination within the meaning of Sec. 78 sentence 2 BetrVG.
  

Whether discrimination has occurred must be determined on the basis of an overall assessment. The defendant has given comprehensible reasons for refusing the follow-up contract which are not related to the plaintiff's works council activities. The BAG considers the fact that other works council members received an offer of a permanent contract to be merely an indication against discrimination; this indication was refuted by the defendant's submission in the specific case. The LAG correctly found that there was no unlawful discrimination against the plaintiff on the basis of his works council activities.

Consequences for practice

The BAG's decision clarifies that fixed-term contracts without objective grounds pursuant to Sec. 14 (2) TzBfG remain valid even if the employee is elected to the works council during the term of the contract. There is no special protection against fixed-term contracts for works council members.
Employers can allow fixed-term contracts without objective grounds to expire as normal, but must take care when deciding on possible follow-up employment contracts not to cause any discrimination on the grounds of works council activities. If a follow-up employment contract is refused for this reason, the employee concerned may be entitled to claim damages for the conclusion of a permanent employment contract.

This puts the focus on ‘office-neutral’ and well-documented decision-making: reasons for or against a transfer must be transparent, consistent and verifiable in order to stand up to the graduated burden of proof and presentation.

Overall, the decision confirms the flexibility of fixed-term contracts without objective grounds under labour law, but at the same time tightens the requirements for the non-discriminatory treatment of works council members.

Entitlement of individual works council members to personalised email addresses

In its decision of 25 April 2025 (17 TaBV 62/24), the Lower Saxony Regional Labour Court ruled that individual works council members can also assert their own claims to the provision of material resources in accordance with Sec. 40 (2) BetrVG, provided that these are necessary within the scope of their independent works council activities. This may also include personalised email addresses that enable communication beyond the company domain.

Facts

• The employer operates several hundred supermarkets nationwide.
• A central email address under the domain ‘n.-online.de’ was set up for the applicant district works council, which all works council members can access. The employer did not provide the applicants – two non-exempt works council members – with their own personalised email addresses, while other employees (including exempt works council members) had personalised email accounts that also enabled external communication.
• The applicants, non-exempt members of the district works council, also requested personalised email addresses that would enable them to communicate with external bodies and employees outside the domain. They argued that this was essential for effective works council work, given the size of the company and the need for confidential communication. They contended that not only the works council as a body, but also individual works council members were entitled to such addresses.
• The employer refused to set up such personalised email addresses. In particular, it argued that the right to material resources was exclusively reserved for the works council as a collective body; furthermore, there was no corresponding decision by the body. Collective participation rights were to be exercised exclusively by the works council as a body.
• The Celle Labour Court dismissed the application. The works council members lodged an appeal against this decision and additionally claimed that the works council's work had been unlawfully obstructed.

Reasons for the decision

• The Regional Labour Court partially upheld the appeal and obliged the employer to provide the works council members with personalised email addresses with external communication options. The further application for a declaratory judgment (obstruction of the works council's work) was dismissed as inadmissible.
• Legal standing of individual works council members: If material resources are necessary for his or her independent activities, an individual works council member may base claims on Section 40 (2) BetrVG. A committee decision is not mandatory in such cases. The fact that the works council is the sole plaintiff does not follow from the wording of the provision or from a systematic or teleological interpretation. A contrary view would mean that a majority in the works council could effectively withhold the necessary material resources from the minority – the court considered this to be incompatible with the functional concept of the BetrVG.
• Personalised email addresses may be necessary: The applicants were allowed to request the provision of personalised email addresses – including for communication outside the company's own domain. In view of the size of the company, the large number of employees and the need for fast and confidential communication, a central works council address was not sufficient. Communication by telephone or written notes was neither practical nor appropriate in modern everyday business life and, in particular, did not allow for the confidential exchange of documents. Furthermore, it was unacceptable to refer employees to a central email address to which numerous people had access.
• No legitimate interests on the part of the employer: In view of the low cost of configuring the email addresses, there were no interests on the part of the employer that were worthy of protection. No specific security or organisational concerns were presented.
• Inadmissibility of the application for a declaratory judgment: The further application for a declaratory judgment that the employer was obstructing the works council's activities was rejected as inadmissible. An isolated finding of discrimination does not constitute a legal relationship capable of being determined within the meaning of Sec. 256 (1) ZPO.

Consequences for practice

The decision makes it clear that employers cannot simply refer to the works council as a whole when individual members request the provision of certain communication tools. As soon as a works council member demonstrates that a material resource – such as a personalised email address with external communication capabilities – is necessary for the independent performance of their duties, they have a direct claim under Sec. 40 (2) BetrVG. The employer cannot therefore refuse to provide this resource by citing a lack of resolutions or internal organisational issues.

The decision emphasises that modern workplace communication regularly requires personal availability, confidentiality and the exchange of documents. Cost arguments are only recognised by case law within narrow limits.

The Lower Saxony Regional Labour Court has allowed an appeal to the Federal BAG. The appeal is pending (7 ABR 27/25).