Data Protection Conference on Regulations for Personal Data Transfer in Asset Deals and Monitoring

The Data Protection Conference issued important regulations in September 2024 regarding the transfer of personal data in the context of asset deals and restrictions on employee monitoring. These decisions highlight the complex legal requirements that companies must consider when undertaking business acquisitions and handling employee data.

A central point concerns data transfer before the completion of an asset deal: The transfer of personal data is generally not permitted before the actual asset deal is finalized. Furthermore, the new guidelines emphasize that the sale of raw data explicitly requires obtaining the express consent of the data subjects, in order to strengthen individual rights and prevent misuse.

There are also clear limits in the area of employee protection. Employers may generally not monitor work-related communications, which includes, among other things, emails or communication via tools like Teams. Monitoring is restricted to cases where there is a concrete suspicion of criminal activity by the employee. Companies must ensure compliance with the Federal Data Protection Act, internal policies, and existing works agreements.

These regulations underscore the increased duty of care required from companies when handling sensitive data throughout the entire corporate lifecycle, especially during structural changes such as asset deals.