Data Protection Conference on Regulations for Personal Data Transfer in Asset Deals and Surveillance
Die Datenschutzkonferenz erließ im September 2024 klare Regeln für den Umgang mit personenbezogenen Daten bei Asset-Deals und zur Überwachung am Arbeitsplatz. Kernpunkte sind die Unzulässigkeit des Datentransfers vor Deal-Abschluss und die Forderung nach expliziter Zustimmung bei reinem Datenverkauf. Zudem wird die Überwachung am Arbeitsplatz stark eingeschränkt und nur bei konkretem Verdacht auf eine Straftat erlaubt.
In September 2024, the Data Protection Conference issued important guidelines regarding the transfer of personal data within the scope of asset deals, as well as restrictions on employee monitoring. These new regulations shed light on the complex legal grey areas that repeatedly arise during corporate transfers and in daily digital work life.
A central topic concerns data transfer: The transfer of personal data is fundamentally not permitted before an asset deal is concluded. Furthermore, the sale of raw data—that is, the sale of data without an associated service package—mandates the explicit consent of the data subjects, which underscores the increased sensitivity of handling individual data.
Workplace monitoring has also been clarified. Employers may generally not monitor work-related communications, which includes, for example, emails or communication via tools like Teams. Compliance with the regulations requires careful adherence to the Federal Data Protection Act, internal guidelines, and existing works agreements. An exception is monitoring, which is only permissible if there is a concrete suspicion of criminal activity on the part of the employee.
These clarifications aim both to strengthen data protection and to increase legal certainty for companies that carry out such transactions or digitally manage employees.