DSB (Austria) - 2025-0.960.016

Text Ref. No.: 2025-0.960.016 dated March 20, 2026 (Case No.: DPA-D124.2107/25) [Processing Officer’s Note: Names and company names, legal forms and product names, addresses (including URLs, IP addresses, and email addresses), file numbers (and similar), statistical data, etc., as well as their initials and abbreviations, may have been abbreviated and/or altered for pseudonymization purposes. Obvious spelling, grammar, and punctuation errors have been corrected.] DECISION RULING The Data Protection Authority rules on the data protection complaint filed by Dipl. Ing. Michael A*** (complainant) on August 1, August 2025 against N*** Austria AG (respondent), with representation provided by Attorney Dr. Udo B***, regarding a violation of the right to confidentiality, as follows: 1. The complaint is upheld, and it is determined that the respondent violated the complainant’s right to confidentiality by processing his personal data in the context of a 360-degree feedback process. The respondent is prohibited from processing personal data as part of the 360-degree feedback process with respect to those employees who are not considered executives within the meaning of § 36(1)(3) of the Works Constitution Act (ArbVG) [Editor’s note: this presumably refers to § 36(2)(3) ArbVG.], until a valid works agreement is concluded in accordance with § 96(1) ArbVG, with immediate effect.The respondent is prohibited from processing personal data in the context of 360-degree feedback concerning those employees who are not considered managerial employees within the meaning of Section 36, paragraph 1, item 3, of the Works Constitution Act (ArbVG) [Editor’s note: this presumably refers to Section 36(2)(3) of the ArbVG], until a valid works agreement is concluded in accordance with Section 96, paragraph 1, of the ArbVG, with immediate effect. Legal basis: Art. 51(1), Art. 57(1)(f), and Art. 77(1) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of May 4, 2016, p. 1; Sections 1, 18(1), and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999, as amended; Para 36(1)(3) and Para 96(1) of the Works Constitution Act (ArbVG), Federal Law Gazette No. 22/1974, as amended.Legal basis: Article 51, paragraph 1; Article 57, paragraph 1, subparagraph f; and Article 77, paragraph 1, of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), Official Journal No. L 119 of May 4, 2016, page 1; Sections 1, 18(1), and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette Part I, No. 165 of 1999, as amended; Sections 36(1)(3) and 96(1) of the Works Constitution Act (ArbVG), Federal Law Gazette No. 22 of 1974, as amended. STATEMENT OF REASONS A. Arguments of the Parties and Course of Proceedings Note from the Data Protection Authority regarding the course of proceedings: The course of proceedings is not a legally mandatory element but is optional. Therefore, there is generally no need to specifically cite the parties’ arguments in the reasoning for the decision (see Hengstschläger/Leeb, AVG § 60, margin note 22). The Data Protection Authority therefore limits itself to providing an overview of the elements essential to the proceedings as set forth in the respective submissions of the parties. Note from the Data Protection Authority regarding the course of proceedings: The course of proceedings is not a legally mandatory element but is optional. Therefore, there is generally no need to specifically cite the parties’ submissions in the reasoning for the decision (see Hengstschläger/Leeb, AVG § 60, margin note 22). The Data Protection Authority therefore limits itself to providing an overview of the elements essential to the proceedings as set forth in the respective submissions of the parties. 1. On August 1, 2025, the complainant (hereinafter: BF), having amended the complaint by letter dated September 2, 2025, filed a complaint against the respondent (hereinafter: BG) alleging a violation of the right to confidentiality. As part of a program to increase staff efficiency within the framework of a 360-degree feedback process, the respondent collected the complainant’s personal data and made it available to the complainant’s supervisor. However, in the BF’s view, this measure necessarily required a works agreement, which was not in place, and therefore the processing was unlawful. 2. BG submitted a statement on this matter in a letter dated November 3, 2025, in which, in summary and to the extent relevant to the proceedings, it argued as follows: The BF’s argument that the absence of a works agreement indicates the unlawfulness of the data processing is incorrect, since a works agreement (hereinafter: WA) merely specifies the legitimate interests of a controller and is in no way intended to create a new legal basis. Consequently, the absence of a required BV does not mean that the data processing can no longer be based on Article 6(1)(f) of the GDPR. In this specific case, the BG bases the processing of the BF’s data not only on the legitimate interests already mentioned but also on subparagraph (b) of the aforementioned provision (performance of a contract). It should be noted that the question of whether a data processing notice would have been necessary for the 360-degree feedback at issue in this proceeding is a matter of labor law that cannot, however, be resolved in the proceedings before the Data Protection Authority.2. In a letter dated November 3, 2025, the BG submitted a statement on this matter, which, insofar as relevant to the proceedings, summarized its position as follows: The BF’s argument that the absence of a works agreement indicates the unlawfulness of the data processing is incorrect, since a works agreement (hereinafter: BV) merely specifies the legitimate interests of a controller and is in no way intended to create a new legal basis. Consequently, the absence of a required BV does not mean that the data processing can no longer be based on article 6(1)(f) of the GDPR. In this specific case, the BG bases the processing of the BF’s data not only on the legitimate interests already mentioned but also on subparagraph (b) of the aforementioned provision (performance of a contract). It should be noted that the question of whether a works agreement would have been necessary for the 360-degree feedback at issue in this proceeding is a matter of labor law that cannot, however, be resolved in the proceedings before the Data Protection Authority. 3. The BF responded to this in a statement dated November 20, 2025, in which it reaffirmed its legal position that the data processing at issue in these proceedings would have required a works agreement, which, however, was not in place. It was also clear that the processing of personal data in a 360-degree feedback process could serve the purpose of evaluating employees and thus constituted a measure within the meaning of Section 96 of the Works Constitution Act (ArbVG). The BF stated that it continued to view its right to confidentiality under Para 1 of the Data Protection Act (DSG) as having been violated.3. The BF commented on this in a statement dated November 20, 2025, in which it reaffirmed its legal position that a works agreement would have been mandatory for the data processing at issue in the proceedings, but that no such agreement existed. It was also clear that the processing of personal data in a 360-degree feedback process could serve the purpose of evaluating employees and thus constituted a measure within the meaning of Section 96 of the ArbVG. The complainant stated that she continues to believe her right to confidentiality under Section 1, paragraph 1 of the Data Protection Act (DSG) has been violated. B. Subject Matter of the Complaint The subject matter of the complaint therefore concerns the question of whether the BG violated the complainant’s right to confidentiality by processing personal data relating to the complainant as part of a 360-degree feedback process. C. Findings of Fact 1. The complainant was employed by BG from August 2018 to June 2025. She served as a manager in the finance department and was responsible for up to five employees in both a professional and disciplinary capacity. 2. BG is an Austrian stock corporation headquartered in S***. In addition to a central works council, the enterprise also has an employee works council, which was responsible for BF. BG employs 2,600 people in Austria. 3. BG has entered into a framework works council agreement with the Central Works Council regarding the processing of employees’ personal data. A supplementary agreement was also concluded regarding the processing of employees’ personal data in the “LogHR” data application. “LogHR” is a group-wide human resources (HR) solution designed to support operational processes. Section 4.2 of the supplementary agreement states that the data processed in the system is described in Appendix 2. 4. The categories of data specified in Appendix 2, which are to be processed in the “LogHR” data application, are as follows: Fig. Appendix 2 of the supplementary agreement on the processing of employees’ personal data in the “LogHR” data application. 5. As part of the 360-degree feedback process, personal data regarding the BF was collected and further processed from the BF himself as well as from a total of 17 other individuals (including the BF’s supervisor, three of his employees, and other BG staff members). The personal data consisted of the evaluation of the BF by the aforementioned individuals across a total of 27 categories, such as: “consults with others when making key decisions” or “focuses the team’s efforts on key priorities and avoids distractions.” All categories in which data was collected relate to an assessment of the BF’s (leadership) behavior in workplace situations. In addition to the BF themselves, their supervisors also had access to the data from the 360-degree feedback. Fig.: Excerpt from the evaluation form submitted by BF. Overall, the evaluators’ ratings are presented across nine different categories. 6. Within the BG Group, there is no specific company agreement (as a supplement to the framework agreement) governing data processing in connection with 360-degree feedback. 7. In addition to BF, personal data has been or is currently being collected and processed from other BG executives as part of a 360-degree feedback process. Assessment of the Evidence: The findings are based on the consistent or uncontested statements of the parties to the proceedings and the thus undisputed record. The framework works agreement and the supplementary agreement on the “LogHR” data application are included in the case file and, together with the other documents submitted, form the basis for the DPA’s decision. The finding regarding Point 6 is based on a comprehensive review of the respective submissions by the parties to the proceedings, as well as on the fact that, despite having had the opportunity to do so, the BG did not submit a corresponding works agreement by the conclusion of the present proceedings. Rather, as explained in Point A, the BG relies on legitimate interests under Article 6(1)(f) of the GDPR or on the performance of a contract under Article 6(1)(b) of the GDPR, and thus expressly does not rely on a corresponding works agreement. The finding regarding the number of BG employees is based on an ex officio internet search conducted by the DPA on the BG’s website (https://www.n.at/enterprise [], accessed on January 29, 2026, 8:15 a.m.). The finding regarding C.7. is based on a review of the respective submissions by the parties to the proceedings. For example, there was a dedicated project group tasked with designing the 360-degree feedback process. The stated objectives included, among other things, strengthening the corporate culture by promoting a culture of feedback within the BG Group, as well as further embedding BG’s values within the workforce. The project description submitted by BG also shows that a dedicated online tool was created to manage the feedback process, which is capable of distinguishing between different categories of employees (e.g., those with and without personnel responsibility). All of this leads to the conclusion that the processing in question was carried out for all managers at the enterprise (and not just at BF). It is not necessary at this point to determine the exact number of data subjects, as this figure is subject to constant change due to new hires and departures and, moreover, has no relevance to the legal conclusion.Assessment of Evidence: The findings are based on the consistent or uncontested statements of the parties to the proceedings and the thus undisputed record. The framework works agreement and the supplementary agreement regarding the “LogHR” data application are included in the record and, together with the other submitted documents, form the basis for the DPA’s decision. The finding regarding Point 6 is based on a comprehensive review of the respective submissions by the parties to the proceedings, as well as on the fact that, despite having had the opportunity to do so, the BG did not submit a corresponding works agreement by the conclusion of the present proceedings. Rather, as explained in Point A, the BG relies on legitimate interests under Article 6(1)(f) of the GDPR or on the performance of a contract under Article 6(1)(b) of the GDPR, and thus expressly does not rely on a corresponding works agreement. The finding regarding the number of BG employees is based on an ex officio internet search conducted by the DPA on the BG’s website (https://www.n.at/enterprise [****], accessed on January 29, 2026, 8:15 a.m.). The finding regarding C.7. is based on a review of the respective submissions by the parties to the proceedings. For example, there was a dedicated project group tasked with designing the 360-degree feedback process. The stated objectives included, among other things, strengthening the corporate culture by promoting a culture of feedback within the BG Group, as well as further embedding BG’s values among the workforce. The project description submitted by BG also shows that a dedicated online tool was created to manage the feedback process, which is capable of distinguishing between different categories of employees (e.g., those with and without personnel responsibility). All of this leads to the conclusion that the processing in question was carried out for all managers at the enterprise (and not just at BF). It is not necessary at this point to determine the exact number of data subjects, as this figure is subject to constant change due to new hires and departures and, furthermore, has no relevance to the legal conclusion. The complete documentation is included in the file and will serve as the basis for the DPA’s decision. D. From a legal perspective, the following conclusions follow: 1. Regarding Point 1 1.1. General Preliminary Remarks The central issue in this case is the assessment of whether there is a valid legal basis for the processing of personal data by the BF that is the subject of these proceedings. The existence of such processing, as well as its scope and the categories of personal data involved, are just as undisputed in the present case as the fact that there is no works agreement that explicitly regulates the processing (specifically, in this case: the collection and transfers to management) of personal data in the context of a 360-degree feedback process. 1.2 On the Right to Confidentiality of Personal Data Pursuant to § 1(1) of the Data Protection Act (DSG), every person has the right to confidentiality of personal data concerning them, provided there is a legitimate interest therein. The existence of such an interest is ruled out if data is not subject to a right to confidentiality due to its general availability or because it cannot be traced back to the data subject.According to Section 1, paragraph 1, of the DSG, everyone has the right to the confidentiality of personal data concerning them, provided there is a legitimate interest in such confidentiality. The existence of such an interest is excluded if data is not subject to a right to confidentiality due to its general availability or because it cannot be traced back to the data subject. The GDPR, and in particular the principles enshrined therein, must be used to interpret the right to confidentiality (see the decision of the DPA dated October 31, 2018, Ref. No. DPA-D123.076/0003-DPA/2018).The GDPR, and in particular the principles enshrined therein, must be used to interpret the right to confidentiality; see the decision of the DPA dated October 31, 2018, Ref. No. DPA-D123.076/0003-DPA/2018). According to Article 4(1) of the GDPR, “personal data” means any information relating to an identified or identifiable natural person (“data subject”); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.According to Article 4(1) of the GDPR, “personal data” means any information relating to an identified or identifiable natural person (“data subject”); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that express the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. The CJEU has already held, with regard to Article 2(a) of Directive 95/46/EC, that the term “personal data” is based on a broad interpretation. Accordingly, the term is not limited to sensitive or private information, but potentially encompasses all types of information, both objective and subjective in nature, in the form of opinions or assessments, provided that the information relates “to” the individual in question.” (see the judgement of the CJEU of December 20, 2017, Nowak, Case C-434/16).The CJEU has already held, with regard to article 2(a) of Directive 95/46/EC, that the term “personal data” is based on a broad interpretation. Accordingly, the term is not limited to sensitive or private information, but potentially encompasses all types of information, both objective and subjective in nature, in the form of opinions or assessments, provided that the information relates “to” the person in question.” See the judgement of the CJEU of December 20, 2017, Nowak, Case C-434/16). Evaluations of a natural person regarding their leadership behavior or other parameters in the context of an employment relationship as part of a 360-degree feedback process can easily be subsumed under the concept of personal data, since the very purpose of such a process is to provide a specific person with feedback regarding their behavior. A 360-degree feedback assessment for an unidentified or anonymized person, on the other hand, would be meaningless and therefore need not be considered further. 1.3 On the Processing of Personal Data in the Context of Labor Law Article 88 is the central provision in the GDPR addressing the issue of employee data protection. However, it contains only a catch-all provision with formal and substantive requirements, but no provision regarding the permissibility of data processing in the employment context per se (Goricnik in Knyrim, DatKomm Art. 88 GDPR, para. 1).Article 88 is the central article in the GDPR addressing the issue of employee data protection. However, it contains only a catch-all clause with formal and substantive requirements, but no provision regarding the lawfulness of data processing in the employment context per se (Goricnik in Knyrim, DatKomm article 88, GDPR, para. 1). The provision cited above allows Member States to establish, through legislation or collective agreements, more specific rules to protect the rights and freedoms of natural persons with regard to the processing of personal data in the context of employment. Pursuant to para 2 of the aforementioned provision, these provisions must include appropriate measures, among other things, to safeguard human dignity as well as the legitimate interests and fundamental rights of the data subjects.The provision cited above allows Member States to establish more specific rules through legislation or collective agreements to protect the rights and freedoms of natural persons with regard to the processing of personal data in the employment context. Pursuant to paragraph 2 of the aforementioned provision, these provisions must include appropriate measures, inter alia, to safeguard human dignity as well as the legitimate interests and fundamental rights of data subjects. Recital 155 of the GDPR also expressly mentions works agreements in this context as an instrument for implementing more specific provisions within the meaning of Article 88 of the GDPR.Recital 155 of the GDPR also expressly mentions works agreements in this context as an instrument for implementing more specific provisions within the meaning of article 88 of the GDPR. In the explanatory notes to the 2018 Data Protection Adaptation Act, the Austrian legislature assumed that provisions on employee data protection should be found in labor law regulations such as the Labor Constitution Act (ArbVG) and should not be established in the Data Protection Act (DSG) (ibid., margin note 5). As part of this approach, the opening clause of Article 88 of the GDPR was utilized, and, among other things, § 96 of the ArbVG, in keeping with the tradition of collective bargaining in Austrian labor law, a more specific provision was created to ensure the protection of employees’ personal data. Within the framework of this approach, use was made of the opening clause of article 88, GDPR, and, among other things, a more specific provision to ensure the protection of employees’ personal data was created in Section 96 of the ArbVG in keeping with the tradition of collective bargaining in Austrian labor law. Section 96 of the ArbVG covers four exhaustively listed “measures requiring consent”—namely, the company’s disciplinary regulations, detailed personnel questionnaires, monitoring measures and systems that affect human dignity, and performance-based compensation— which are particularly likely to jeopardize employees’ personal rights and therefore, as a matter of principle and without exception, may not be unilaterally implemented by the employer without equal co-determination by the workforce. The law requires the consent of the Works Council (BR) or the otherwise competent employee representative body in the form of a works agreement (BV) and, in the event that the BR refuses to grant consent, provides for neither judicial review nor the enforceability of such a BV (Jabornegg in Strasser/Jabornegg/Resch, ArbVG § 96, margin note 1, paragraph 96, The ArbVG lists four specific “measures requiring consent”—namely, the company’s disciplinary regulations, detailed personnel questionnaires, monitoring measures and systems that affect human dignity, and performance-based compensation— which are particularly likely to jeopardize employees’ personal rights and therefore, as a matter of principle and without exception, must not be unilaterally established by management without equal co-determination by the workforce. The law requires the consent of the Works Council (BR) or the otherwise competent employee representative body in the form of a works agreement (BV) and, in the event that the BR refuses consent, provides for neither judicial review nor the enforceability of such a BV (Jabornegg in Strasser/Jabornegg/Resch, ArbVG Section 96, margin note 1. D.1.4. On the Merits Regarding the BF’s Status as an Employee Although the BF held management responsibilities within the BG Group, she can nevertheless be considered an employee within the meaning of the ArbVG. The exception under para 3 of § 36 of the ArbVG does not apply to the BF, since, as the manager of a small team of no more than 5 people, she did not have a significant influence on the management of the business within a corporate group with 2,600 employees and therefore cannot be considered a senior executive within the meaning of the ArbVG. A senior executive within the meaning of para. 2, item 3 is, above all, an employee who, due to his or her position alongside the employer and the exercise of employer functions, may find himself or herself in a conflict of interest with the other employees (Mayr, Labor Law § 36 ArbVG (as of Aug. 1, 2024, rdb.at). Although BF held management responsibilities within the BG group, she can nevertheless be regarded as an employee within the meaning of the ArbVG. The exception provided for in Section 36, paragraph 2, subparagraph 3, ArbVG does not apply to BF, since, as the manager of a small team of no more than 5 people, she did not have a significant influence on the management of the business within a corporate group with 2,600 employees and therefore cannot be considered a senior executive within the meaning of ArbVG. An employee to be regarded as a senior executive within the meaning of paragraph 2, clause 3, an employee is to be regarded as such above all if, due to his or her position alongside the employer and the exercise of employer functions, he or she may find himself or herself in a conflict of interest with the other employees (Mayr, Labor Law Section 36, ArbVG (as of August 1, 2024, rdb.at). According to the established case law of the Supreme Court (OGH), the decisive factor in assessing whether an employee is a managerial employee within the meaning of the ArbVG is the influence over the establishment and termination of employment relationships. These criteria are met if the employee independently hires the necessary workforce and is authorized to terminate their employment relationships just as independently. Furthermore, the exception to the definition of an employee under § 36(2)(3) of the ArbVG cannot be applied to every manager who, by virtue of their position, schedules work or working hours, orders overtime, or even influences salary matters (Supreme Court decision of October 21, 1998, 9 ObA 109/98i and 9 ObA 8/24b of February 14, 2024, or 9 ObA 69/21v of June 26, 2021).According to the established case law of the Supreme Court, the primary consideration in assessing whether an employee is a managerial employee within the meaning of the ArbVG is the influence over the establishment and termination of employment relationships. These criteria are met if the employee independently hires the necessary staff and is authorized to terminate their employment relationships just as independently. The exception to the definition of “employee” under Section 36, Paragraph 2, Item 3, ArbVG cannot, moreover, be applied to every manager who, by virtue of their position, schedules work or working hours, orders overtime, or even influences salary matters (Supreme Court decision of October 21, 1998, 9 ObA 109/98i and 9 ObA 8/24b of February 14, 2024, or 9 ObA 69/21v of June 26, 2021). Likewise, the OGH has ruled that not even an employee’s authority to issue a notice of termination is sufficient to qualify them as a managerial employee if their other duties and responsibilities clearly differ from the profile of a managerial employee (Supreme Court decision of May 17, 2000, 9 ObA 73/00a). From the case law cited above and the general protective nature inherent in labor law—due to the economic inferiority of employees and the resulting imbalance of bargaining power between employer and employee (see Kietaibl, Labor Law I, 2015, 9th edition, p. 4), it necessarily follows that exceptions to the scope of protection under labor law must be interpreted restrictively.It follows inevitably from the case law cited above and the general protective nature inherent in labor law due to the economic inferiority of employees and the resulting imbalance of bargaining power between employers and employees—see Kietaibl, Roman Labor Law I, 2015, 9th edition, p. 4), it necessarily follows that exceptions to the scope of protection under labor law must be interpreted restrictively. Since no evidence has come to light in the current proceedings suggesting that BF held a position as a senior executive within the meaning of § 36(para 4) 2(3) of the ArbVG, nor has this been asserted by the BG, the DPA therefore concludes, after evaluating the evidence, that the BF is not a managerial employee within the meaning of the above-cited provision and is thus subject to the scope of protection of the ArbVG.Since no evidence has come to light in the ongoing proceedings to suggest that BF held a position as a managerial employee within the meaning of Section 36, paragraph 2, item 3, ArbVG, nor has this been asserted by the BG, the DPA therefore concludes, based on an assessment of the evidence, that the BF is not a managerial employee within the meaning of the above-cited provision and is thus subject to the scope of protection of the ArbVG. Moreover, the opposite assumption would be unrealistic, as it would necessarily imply that an enterprise such as BG’s, with approximately 2,600 employees, would have to have several hundred executive employees within the meaning of § 36(2)(3) of the ArbVG with powers similar to those of an employer, if an employee such as BF—who was responsible for managing a small team of no more than 5 employees—were already considered such a managerial employee.The opposite assumption would also be unrealistic, as it would necessarily imply that an enterprise such as BG’s, with approximately 2,600 employees, would have to have several hundred managerial employees within the meaning of paragraph 36(2)(3) of the ArbVG with powers similar to those of an employer, if an employee such as BF, who was responsible for managing a small team of no more than 5 employees, were already considered such a managerial employee. As a preliminary conclusion, it can therefore be stated that BF was not a senior executive within the meaning of Para 36(2)(3) of the ArbVG.As an interim conclusion, it can therefore be stated that the BF was not a senior executive within the meaning of paragraph 3 of Section 36 of the ArbVG. Regarding the Processing of the BF’s Personal Data in the Context of 360-Degree Feedback As noted in Section C. 5, the BG processed the BF’s personal data in the context of a 360-degree feedback process. As also explained, this involves a systematic and standardized collection of personal data from managers regarding their leadership behavior and its alignment with the values of the BG Group. It can therefore be assumed at this point that such data processing falls under the definition of § 96(1)(2) of the ArbVG (“personnel questionnaires, provided that these do not merely contain general personal information and details regarding the professional qualifications required for the employee’s intended position”) (see Knyrim in DaKo 3/2025, p. 53) and thus, within the meaning of the cited provision, requires the mandatory consent of the works council.As noted in Section C. 5, BG processed the BF’s personal data as part of a 360-degree feedback process. As also explained, this involves the systematic and standardized collection of personal data from managers regarding their leadership behavior and its alignment with the values of the BG Group. It can therefore be assumed at this point that such data processing falls under the definition of Section 96, paragraph 1, item 2, of the ArbVG (“personnel questionnaires, provided that these do not merely contain general personal information and details regarding the professional qualifications required for the employee’s intended position”)—see Knyrim in DaKo 3 from 2025, p. 53) and thus, within the meaning of the cited provision, requires the mandatory consent of the works council. However, it is also conceivable to classify this under item 3 of the cited provision, according to which “monitoring measures […] insofar as they affect human dignity” also require the consent of the works council. As the Berlin Commissioner for Data Protection and Freedom of Information has noted, the implementation of 360-degree feedback in an enterprise can trigger constant pressure from surveillance and stress, since a data subject must always expect—even during encounters with other employees—that their behavior will have an impact on the next evaluation. (See the Annual Report of the Berlin Commissioner for Data Protection and Freedom of Information as of December 31, 2020, p. 123 et seq.). In its decision of November 27, 2019 (6 Ob 150/19 et seq.) that the pressure of Surveillance felt by a person who has the impression that they may be monitored at any time constitutes a serious infringement of privacy and the right to personal integrity under § 16 of the Austrian Civil Code (ABGB). In this context, it should also be noted that the Berlin Commissioner for Data Protection proposed specific measures in this case to better protect the rights and freedoms of data subjects. For example, the number of feedback providers was reduced to three, and the data subjects were also granted the right to make suggestions or exercise a veto regarding the selection of feedback providers. However, in the present case, the works council did not take any comparable measures. It is also conceivable that this situation falls under paragraph 3, leg. cit., according to which “control measures […] insofar as they affect human dignity” also require the consent of the works council. As the Berlin Commissioner for Data Protection and Freedom of Information has noted, the implementation of 360-degree feedback in an enterprise can trigger constant pressure from surveillance and stress, since a data subject must always expect—even during encounters with other employees—that their behavior will have an impact on the next evaluation. See the Annual Report of the Berlin Commissioner for Data Protection and Freedom of Information as of December 31, 2020, p. 123 et seq. In its decision of November 27, 2019 (6 Ob 150/19f) that the pressure of Surveillance felt by a person who has the impression that they may be monitored at any time constitutes a serious infringement of privacy and the right to personal integrity under Section 16 of the Austrian Civil Code (ABGB). In this context, it should also be noted that the Berlin Commissioner for Data Protection proposed specific measures in this case to better protect the rights and freedoms of data subjects. For example, the number of feedback providers was reduced to three, and the data subjects were also granted the right to make suggestions or exercise a veto regarding the selection of feedback providers. However, the BG did not take any comparable measures in the present case. In light of the considerations set forth above, it must therefore be noted at this point that the data processing at issue in this proceeding, carried out as part of a 360-degree feedback process, falls under Section 96(1)(2) and (3) of the ArbVG.In light of the considerations set forth above, it should therefore be noted at this point that the data processing at issue in this proceeding, carried out as part of a 360-degree feedback process, falls under Section 96(1)(2) and (3) of the ArbVG. As noted in Section C.4, the BG’s works agreement for the “Log*HR”—in which data processing in the Human Resources department is carried out—contains no reference whatsoever to 360-degree feedback or to the categories of data typically collected in such a process or, in the specific case of the BG, actually collected by the BG. Even a comparison with the results of the evaluation of the BF’s 360-degree feedback reveals no correspondence with the categories of data agreed upon in the works agreement. As an interim conclusion, it can therefore be stated that the data processing at issue in this proceeding cannot be based on a works agreement within the meaning of Art. 88(1) GDPR in conjunction with § 96 ArbVG, since no such agreement exists.As an interim conclusion, it can therefore be stated that the data processing at issue in this proceeding cannot be based on a works agreement within the meaning of Article 88(1) of the GDPR in conjunction with paragraph 96 of the ArbVG, since no such agreement exists. In this context, the following objection can be raised to the BG’s argument that the absence of a works agreement does not necessarily indicate the unlawfulness of the data processing and that, in this case, the data processing could still be based on the legitimate interests of a controller pursuant to Art. 6(1)(f) of the GDPR, must be countered as follows: This may be the case in situations where the conclusion of a works agreement is not a mandatory legal requirement, but it is irrelevant to the present case, since here, specifically pursuant to para 96(1)(2) and (3) of the ArbVG, the works council’s consent must be obtained for the measure to be legally valid. The importance that the national legislature attaches to employee participation in the context of such data processing can be gauged by the fact that consent to the measures listed in § 96 of the ArbVG cannot even be enforced by the Courts (in other words: without the works council’s consent in the form of a valid works agreement, a measure pursuant to para. 1, items 2 or 3 of the aforementioned provision cannot be implemented in compliance with the law).In this context, the BG’s argument that the absence of a works agreement does not necessarily indicate the unlawfulness of the data processing—and that, in such a case, the data processing could still be based on the legitimate interests of a controller pursuant to article 6, paragraph 1, subparagraph f, GDPR, can be countered as follows: While this may be true in situations where the conclusion of a works agreement is not a mandatory legal requirement, it is irrelevant to the present case, since here, specifically pursuant to Section 96, paragraph 1, items 2 and 3, ArbVG, the works council’s consent must be obtained for the measure to be legally effective. The importance that the national legislature attaches to employee co-determination in the context of such data processing can be gauged by the fact that the measures listed in Section 96, ArbVG cannot even be enforced by the Courts (in other words: without the works council’s consent in the form of a valid works agreement, a measure pursuant to paragraph 1, subparagraphs 2 or 3, leg. cit., cannot be implemented in compliance with the law). This legal view, as outlined above, is also supported by a judgement of the German Federal Labor Court, which found that a controller had violated the GDPR by processing personal data not covered by a works agreement (see the judgement of the Federal Labor Court dated May 8, May 2025, 8 AZR 209/21). Thus, by analogy, a violation of the GDPR is all the more likely to exist if there is no works agreement at all rather than an insufficient one.This legal view is also supported by a judgement of the German Federal Labor Court, which found that a controller had violated the GDPR by processing personal data not covered by a privacy policy; see the judgement of the Federal Labor Court dated May 8, May 2025, 8 AZR 209/21). Thus, by analogy, a violation of the GDPR must be deemed to exist all the more so if there is no privacy policy at all rather than an inadequate one. Insofar as the BG attempts to base the data processing in question on its legitimate interests pursuant to Art. 6(1)(f) of the GDPR, the following must also be noted: According to the case law of the CJEU, processing on the legal basis of “legitimate interests” is permissible under three cumulative conditions: i) the pursuit of a legitimate interest by the controller or the third party or parties to whom the data is disclosed, ii) the processing of personal data must be necessary to achieve the legitimate interest; and iii) the fundamental rights and freedoms of the data subject do not override the legitimate interest pursued (see, with regard to Directive 95/46/EC, the judgement of the CJEU of December 11, 2019, C-708/18 [TK], para. 40, with further references). Insofar as the BG attempts to base the data processing in question on its legitimate interests pursuant to Article 6(1)(f) of the GDPR, the following must also be noted: According to the case law of the CJEU, processing on the legal basis of “legitimate interests” is permissible only if three cumulative conditions are met: (i) the pursuit of a legitimate interest by the controller or the third party or parties to whom the data is disclosed, (ii) the processing of personal data must be necessary to achieve the legitimate interest; and iii) the fundamental rights and freedoms of the data subject do not override the legitimate interest pursued; see, with regard to Directive 95/46/EC, the judgement of the CJEU of December 11, 2019, C-708/18 [TK], para. 40, with further references). In the present case, however, the BG’s reliance on Article 6(1)(f) of the GDPR fails to meet even the first criterion—namely, the protection of a legitimate interest.In the present case, however, the BG’s reliance on Article 6(1)(f) of the GDPR fails already at the first criterion, namely the protection of a legitimate interest. Although the issues of personnel management and improving the performance of an enterprise’s employees may be considered legitimate interests on a general level, this is not the case in the specific circumstances of the present case, since the European Data Protection Board’s Directives on legitimate interests expressly state that the interests must be “lawful, i.e., not contrary to EU or Member State law” (in the original English: “the interest is lawful, i.e., not contrary to EU or Member State law,” see EDBP Guidelines No. 1/2024, para. 17). Thus, processing that violates applicable law can never constitute a legitimate interest within the meaning of Art. 6(1)(f) of the GDPR. As noted above, the data processing at issue in this proceeding would have required the consent of the works council, which, however, was never obtained. For the sake of completeness, it should be noted here that the assessment of the second criterion—namely, the necessity of the data processing—would also have failed to meet the legality requirement, since data processing that violates applicable law cannot conceivably be described as “necessary.” A balancing of the legitimate interests of the employer with the fundamental rights of the employee was therefore no longer necessary at this point, but would likewise not have led to a different result, since the fundamental right to data protection pursuant to § 1(1) of the DSG would at all times have taken precedence over processing that does not comply with applicable national laws.Although the issues of personnel management and improving the performance of an enterprise’s employees may be regarded as legitimate interests on a general level, this is not the case in the specific circumstances of the present case, since the European Data Protection Board’s Directives on legitimate interests expressly state that the interests must be “lawful, i.e., not contrary to Union law or the law of the Member States” (in the original English: “the interest is lawful, i.e., not contrary to EU or Member State law,” see EDBP Guidelines No. 1 of 2024, para. 17). Thus, processing that violates applicable law can never constitute a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. As noted above, the data processing at issue in this proceeding would have required the consent of the works council, which, however, was never obtained. For the sake of completeness, it should be noted here that the assessment of the second criterion—namely, the necessity of the data processing—would also have failed to meet the legality requirement, since data processing that violates applicable law cannot conceivably be described as “necessary.” A balancing of the legitimate interests of the employer with the fundamental rights of the employee was therefore no longer necessary at this point, but would likewise not have led to a different result, since the fundamental right to data protection pursuant to Section 1, paragraph 1, of the DSG would at all times have taken precedence over processing that does not comply with applicable national laws. For the reasons stated above and the arguments regarding the lack of necessity, the processing cannot be justified by the performance of a contract pursuant to Article 6(1)(b) of the GDPR. Apart from the fact already mentioned that a measure that violates applicable national law cannot be considered “necessary,” it is also not apparent to what extent the employment contract between the parties to the proceedings could not be fulfilled without conducting a 360-degree feedback assessment. This is evident simply from the fact that such a measure is not carried out for all BG employees and must therefore be regarded as optional but by no means necessary. For the reasons stated above and the arguments regarding the lack of necessity, the processing cannot be justified on the grounds of contract performance pursuant to article 6(1)(b) of the GDPR. Apart from the fact already mentioned that a measure that violates applicable national law cannot be considered “necessary,” it is also not apparent to what extent the employment contract between the parties to the proceedings could not be fulfilled without conducting a 360-degree feedback assessment. This is evident simply from the fact that such a measure is not carried out for all employees of BG and must therefore be regarded as optional but by no means necessary. In summary, it should therefore be noted at this point that the data processing at issue in these proceedings cannot be based on a valid works agreement within the meaning of § 96 of the ArbVG nor on Article 6(1)(b) or (f) of the GDPR, and is therefore unlawful.In summary, it must therefore be noted at this point that the data processing at issue in these proceedings cannot be based on a valid works agreement within the meaning of Section 96, ArbVG nor on Article 6(1)(b) or (f) of the GDPR, and is therefore unlawful. The complaint was therefore upheld on this point in accordance with the ruling. D.2. Regarding Ruling Point 2 The mandate is based on Article 58(2)(f) of the GDPR, pursuant to which a supervisory authority has the power to impose a temporary or permanent restriction on processing, including a prohibition.The mandate is based on article 58(2)(f) of the GDPR, pursuant to which a supervisory authority has the power to impose a temporary or definitive restriction on processing, including a prohibition. In its judgement of March 14, 2024, the CJEU held that it is for the supervisory authority to choose the appropriate means to fulfill, with all due diligence, its task, which consists of ensuring full compliance with the GDPR and, in situations where the GDPR is violated, restoring the processing to compliance with Union law through its intervention (CJEU, March 14, 2024, C-46/23, paras. 34 and 40). Since the processing of the personal data of BF and other employees who are not considered executives within the meaning of § 36(1)(3) ArbVG [Editor’s note: presumably § 36(2)(3) ArbVG is intended.] (since they do not have a decisive influence on the management of the enterprise) has been found to be contrary to Union law, as set forth above, the restriction of the processing was to be ordered until a valid works agreement was concluded.Since the processing of the personal data of the BF and other employees who are not considered executives within the meaning of Section 36, paragraph 1, item 3, of the ArbVG [Editor’s note: this presumably refers to Section 36, paragraph 2, item 3, of the ArbVG] (since they have no decisive influence on the management of the enterprise) was found to be in violation of EU law, as explained above, it was necessary to order the restriction of processing until a valid works agreement was concluded. However, the employees mentioned above who, pursuant to Para 36(1)(3) of the ArbVG [Editor’s note: this presumably refers to Para 36(2)(3) of the ArbVG], are to be regarded as executive employees with significant influence over the management of the company, as they are not covered by the definition of “employee” in the ArbVG.However, the employees mentioned above were to be excluded from the performance mandate if, pursuant to Section 36, paragraph 1, item 3, of the ArbVG [Editor’s note: this likely refers to Section 36, paragraph 2, item 3, of the ArbVG.], are to be regarded as executive employees with significant influence on the management of the enterprise, as they are not covered by the term “employee” as defined in the ArbVG. In this regard, the measure also proves to be proportionate, as the BG has the authority to initiate negotiations on this matter with the relevant employee representative bodies at any time and to reach a mutually acceptable conclusion, or to refrain from the data processing at issue in the proceedings in the future. D.3. Conclusion Overall, the decision was therefore rendered in accordance with the ruling.