On 19 December 2024,
the Court of Justice of the European Union (CJEU) delivered its judgment in
Case C-65/23, MK v. K GmbH, addressing the processing of employees’ personal
data. The decision focuses on the interpretation of Article 88 of the General
Data Protection Regulation (GDPR), which allows Member States to adopt ‘more
specific rules’ for employment-related data processing, and its interaction
with the general principles and requirements of the GDPR, including those in
Articles 5, 6, and 9. The judgment clarifies that any national rules or
collective agreements adopted under Article 88 must comply not only with the
safeguards outlined in Article 88(2) but also with the broader GDPR framework,
particularly the principles of necessity, transparency, and proportionality.
The CJEU further ruled that while parties to collective agreements may have a
margin of discretion in determining the necessity of data processing, this
discretion is subject to full judicial review to ensure compliance with GDPR
standards. The judgment underscores the importance of maintaining a high level
of protection for employees’ personal data and reaffirms the primacy of GDPR
principles over national or sector-specific rules.