On May 8, 2025, the Federal Labor Court Bundesarbeitsgericht issued a significant ruling concerning an employee’s claims for damages due to unlawful data transfers within a corporate group. The BAG ruled that works council agreements alone cannot legitimize data processing unless they fully comply with EU GDPR standards. Companies must ensure that any data processing is necessary and justified through a documented balance of interests or can be based on other legal justifications, even when a works council agreement is in place. The court also emphasized the importance of assessing whether data transfers are truly needed or if the goal can be achieved through less intrusive methods.
