GDPR: Over-reach gets a boost

Latest CJEU ruling on GDPR adds complexity to employee data processing agreements, subjecting them to full judicial review. This raises concerns about GDPR over-reach and how there needs to be a move to a more balanced approach

The key points to know:  The CJEU ruling means employee data processing agreements are subject to full judicial review. It highlights the reality that national provisions must comply with entire GDPR, not just Article 88(2). The CJEU ruled that:

• Article 88(1) and (2) GDPR must be interpreted as requiring national laws to comply with GDPR Articles 5, 6(1), and 9(1) and (2)
• Collective agreements are subject to comprehensive judicial review, rejecting any discretion not subject to judicial review

Why this matters:  Adds complexity to employee data processing agreements. May undermine efficacy of employer-works council agreements on data processing.

Meanwhile: The CJEU ruled against SNCF's practice of requiring passengers to disclose their gender when buying train tickets online, saying it violates GDPR, as gender data is not necessary for rail transport. The case was taken by a French LGBTQ+ rights group, Mousse. CNIL, the French data protection authority had rejected Mousse’s initial complaint in 2021. It appealed that decision at the French Conseil d’État, which in turn, asked the CJEU for clarification. See Euronews story for more details and background

ADDITIONAL INFORMATION:

• CJEU decision 
• See DLA Piper analysis of decision

Download this week’s Europe newsletter as a PDF