DSB (Austria) - 2025-0.960.016
Austrian DPA rules 360-degree employee feedback unlawful without works council agreement.
The Austrian Data Protection Authority (DSB) ruled that a 360-degree employee feedback process was unlawful because it lacked the required works council agreement under the Austrian Labour Constitution Act. The employer's reliance on legitimate interests or contract performance under GDPR was insufficient to override this labor law requirement.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DSB?
Get an email when a new story names DSB, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn Austrian employer implemented a 360-degree employee feedback system without obtaining the mandatory works council agreement required under the Austrian Labour Constitution Act (ArbVG), rendering the entire data processing activity unlawful. Attempting to justify the processing under GDPR's legitimate interests (Art. 6(1)(f)) or contract performance (Art. 6(1)(b)) does not override national labor law co-determination rights. This case highlights that GDPR compliance alone is insufficient — organizations must also satisfy sector-specific and national statutory requirements before processing employee data. The ruling underscores the layered nature of data protection obligations in EU member states, where local labor laws frequently impose additional constraints on workplace data processing.