Data Protection Conference sets guidelines for personal data transfer in asset deals and employee monitoring
The Data Protection Conference set new rules restricting personal data transfer in asset deals, requiring explicit consent for pure data sales. Additionally, employer monitoring is limited, permitting surveillance only when there is concrete suspicion of criminal activity by the employee.
In September 2024, the Data Protection Conference established new guidelines regarding the transfer of personal data in the context of asset deals, as well as concerning restrictions on employee monitoring. A central point of these new regulations concerns the data transfer before the completion of such a deal: In principle, the transfer of personal data before an asset deal is concluded is not permitted. Furthermore, for pure data sales, explicit consent from the data subjects is required.
In the area of employee protection, clear restrictions have also been enshrined. Employers may not monitor operational communications indiscriminately, which applies, for example, to emails or messages on platforms like Teams. Employee monitoring is thus limited to a narrow scope; according to the new requirements, it is only permissible if there is a concrete suspicion of criminal activity by the employee.
These guidelines aim to strengthen the rights of individuals in the course of major corporate acquisitions and in everyday working life, and to create transparency. Compliance with legal requirements is a high priority, specifically ensuring adherence to the Federal Data Protection Act, internal guidelines, and works agreements.