Know the legal bases for processing employee data, understand issues related to storing personnel records and workplace monitoring, and know the role of EU Works Councils and whistleblowing systems.

A German manufacturing company is rolling out a new biometric access-control system across its plant, where staff are represented by an established works council. The HR director has identified a valid Article 6 and Article 9 basis for the processing and prepared a data protection impact assessment. She asks whether the project can proceed once the GDPR documentation is finalised, given that employee data protection is now fully addressed. What is the most accurate position on the works council's role here?

• ASecuring a valid GDPR lawful basis discharges the company's obligations, so the works council has no formal role beyond being informed of the decision after it is made.
• BCo-determination and consultation duties owed to the works council under national labour law apply in addition to the GDPR, so the company must satisfy both before deploying the system.check_circle Correct
• COnce a works council exists, its approval replaces the need for a GDPR lawful basis, because a collective agreement is itself the legal basis for processing employee data.
• DThe works council's involvement is only required where the processing relies on employee consent, so a DPIA-backed legitimate interests basis avoids the consultation step entirely.

Why A is wrong: This is tempting because the GDPR is the headline instrument, but national labour law and the GDPR operate in parallel: works council co-determination rights over monitoring systems are a separate legal requirement that a GDPR basis does not displace.

Why B is correct: Correct: the GDPR expressly preserves more specific national rules on employment processing, and works council co-determination over technical monitoring systems is an independent labour-law obligation that runs alongside, not instead of, GDPR compliance.

Why C is wrong: A collective agreement can supply a more specific Article 88 rule and help frame the basis, but it does not eliminate the separate requirement to identify a lawful basis under Articles 6 and 9; the two are not interchangeable.

Why D is wrong: This conflates two unrelated regimes: the works council's co-determination right is triggered by the introduction of technical monitoring, not by the chosen GDPR lawful basis, so changing the basis does not remove the consultation duty.