Exclusion of works council member for forwarding work-related emails to private email account

In its ruling of March 10, 2025 (Ref. 16 TaBV 109/24), the Hesse Regional Labor Court decided that the works council chairperson would be excluded for a gross violation of his data protection obligations.

Facts

The ruling of the Hesse Regional Labor Court (LAG) is based on the following facts:

The parties were in dispute over the exclusion of a works council member from the works council.

The employer operates a clinic and employs approximately 390 people. A works council consisting of nine members has been formed at the company. In September 2023, the employer discovered that a rule had been set up in the works council chairman's work email account whereby all incoming emails were automatically forwarded to his (private) GMX address. The employer considered this to be a violation of data protection regulations and issued a warning to the works council chairman.

On October 26, 2023, the employer discovered that the works council chairman had forwarded appointments to a new private email address, among other things. On November 7, 2023, the works council chairman sent a complete personnel list from his private email account to his work email account, containing the names of all employees, their position in the company, working hours, pay scale group, level, basic salary, pay scale progression, pay scale entry, classification, and comparative data for the group. On the same day, he sent the email and attachments (again) to the works council's email address. He had previously sent the file from his work email account to his private email address and edited it at home. He edited the file completely on his private storage media and then sent it back to his email account as a works council member.

The employer took the view that the works council chairman had grossly violated his legal obligations as a works council member by forwarding personal data to his private email account and applied to the labor court to have the chairman excluded from the committee. The works council chair and the works council claimed that the works council chair had only sent the email dated November 7, 2023, to his private email account so that he could work on the Excel spreadsheet at home on his larger screen. After completing the work, he deleted all of the data from his private storage media.

The labor court granted the employer's request.

Reasons for the decision

The Higher Labor Court upheld the decision in the appeal proceedings and justified its decision as follows:

The complaints of the works council chairman and the works council were unfounded. The labor court had rightly granted the employer's request in accordance with Section 23 (1) BetrVG.

According to Section 23 (1) sentence 1 BetrVG, the employer may (among other things) demand the exclusion of a member from the works council for gross violation of his or her statutory duties. The LAG states that, according to Section 79a sentence 1 BetrVG, the works council must comply with data protection regulations when processing personal data.

The list forwarded by the works council chairman to his private email address contained “personal data” within the meaning of Art. 4 No. 1 GDPR, according to the LAG. The works council chairman did not process this data lawfully (Art. 4 No. 2 GDPR). There was no necessity for forwarding the personal data of all employees to the works council chairman's private email account, as he could have processed the employee data required for the preparation of the works agreement to be concluded on the computer provided to him by the employer for works council activities in accordance with Section 40 (2) BetrVG. If necessary, he could have consulted with the employer's IT department to obtain a larger screen or an adapter to connect the works council laptop to his private, larger screen. There was therefore no reason to process the data in the sense of forwarding it to his private device by email.

The LAG also found violations of the principle of data minimization under Art. 5 (1c) GDPR and, in the absence of any justifying grounds, of Art. 6 (1) GDPR.  In the LAG's view, the breach of duty was also “gross” within the meaning of Section 23 (1) BetrVG. 

The chairman of the works council had committed an objectively significant and obviously serious breach of duty with regard to compliance with data protection in the exercise of his works council duties. The breach of data protection was therefore initially considered to be serious. The works council chairman had committed an objectively significant and obviously serious breach of duty with regard to compliance with data protection in the exercise of his works council office. The breach of data protection appears serious at first glance because it involved the disclosure of the amount of remuneration of each individual employee. The works council chairman could easily have recognized that the handling of such data must be treated with the utmost sensitivity. In addition, he was already aware, based on previous disputes with his employer regarding the forwarding of work-related emails to his private email account, that the employer considered this to be a (serious) breach of data protection.

Even the alleged urgency of the matter (preparation of a works agreement) does not excuse the data protection violation that was committed. Instead, the works council chairman should have requested better technical equipment from the employer.

Practical tip

The ruling by the Hesse Regional Labor Court makes it clear that data protection violations by works council members will not be tolerated. Repeated or grossly negligent violations of data protection rules can lead to exclusion from the works council. Anyone who forwards personal data to private email addresses without legal basis risks losing their position.

Forwarding personal data to private email accounts poses a significant risk in terms of data protection law. Employers are therefore obliged to put in place internal technical measures to prevent such transfers. These protective measures must be consistently implemented and any violations effectively sanctioned.

As an appeal has been granted, the decision on the matter by the Federal Labor Court remains to be seen.