On 1 February 2017, the Federal Government of Germany presented a draft of a new Data Protection Act. The draft is based on EU Regulation 2016/67, on the protection of private persons with regard to the processing of personal data and on the free movement of such data, which came into force on 24 May 2016. The draft law shall replace the current German Federal Data Protection Act (BDSG).
Under the current Data Protection Act, the distribution of personal data shall be permissible if this is necessary to establish, carry out or terminate the employment relationship. In addition, the draft allows the processing of personal data if this is necessary to fulfill the rights and obligations resulting from a collective agreement with the trade union or the works council. Data processing with the consent of the affected employee shall also continue to be permissible. However, the employee’s consent always needs to be voluntary.
The draft law still has to pass the German parliament before it can come into force.