Conclusions of the Data Protection Congress: Transfer of Personal Data in Asset Deals and Employee Monitoring
The Data Protection Congress set clear rules in September 2024 for personal data transfer in asset deals and employee monitoring. Key takeaways include the general prohibition of data transfer before a deal's completion and the mandate for explicit consent in pure data sales. Furthermore, monitoring is restricted to cases of concrete suspicion of criminal acts.
The Data Protection Congress issued important guidelines in September 2024 regarding the transfer of personal data in the context of asset deals, as well as restrictions on employee monitoring. These new regulations illuminate complex legal gray areas that frequently affect companies during corporate succession and in daily work life.
In the context of asset deals, the transfer of personal data is generally not permitted before the completion of the transaction. Furthermore, pure data sales mandatorily require the explicit consent of the affected individuals. The guidelines also clarify the limits of employer monitoring law: employers may not monitor work-related communications in a blanket manner, such as emails or messages via Teams.
To ensure compliance, adherence to the Federal Data Protection Act, internal policies, and applicable works agreements must be guaranteed. Employee monitoring is only permissible if there is a concrete suspicion of a criminal act by the employee. These points underscore the necessity of a high degree of diligence and legal review for all data transfers and monitoring activities.