On 19 December 2024, the Court of Justice of the European Union (CJEU) delivered its judgment in Case C-65/23, MK v. K GmbH, addressing the processing of employees’ personal data. The decision focuses on the interpretation of Article 88 of the General Data Protection Regulation (GDPR), which allows Member States to adopt ‘more specific rules’ for employment-related data processing, and its interaction with the general principles and requirements of the GDPR, including those in Articles 5, 6, and 9. The judgment clarifies that any national rules or collective agreements adopted under Article 88 must comply not only with the safeguards outlined in Article 88(2) but also with the broader GDPR framework, particularly the principles of necessity, transparency, and proportionality. The CJEU further ruled that while parties to collective agreements may have a margin of discretion in determining the necessity of data processing, this discretion is subject to full judicial review to ensure compliance with GDPR standards. The judgment underscores the importance of maintaining a high level of protection for employees’ personal data and reaffirms the primacy of GDPR principles over national or sector-specific rules.
Laroussi Chemlali (Tue,) studied this question.