Works Council Veto and the Global People-Analytics Pilot
Nordwind Logistics, headquartered in Hamburg with 12,000 employees (5,000 in Germany, 2,000 in Brazil, 1,500 in California, and the remainder across eight countries), plans a six-month pilot of a vendor-hosted people-analytics tool called TalentSignal. The tool scores each employee’s attrition risk using HRIS fields, engagement-survey responses, badge-swipe timestamps, and email metadata such as sender, recipient, and subject line-not message content. Scores are shown to line managers with a suggested retention action, but managers make the final call.
The German works council has invoked its co-determination rights and refuses to approve the pilot, citing employee monitoring. Brazil’s legal team proposes legitimate interest but the local union has demanded consultation. California HR wants to launch immediately and says employee notice is covered by the existing privacy policy. TalentSignal hosts data in the United States under standard contractual clauses; a transfer impact assessment was completed last year. No DPIA has been done. Nordwind’s CPO must decide whether to launch in all three jurisdictions on the same date.
1. Assess the lawful-basis and consultation obstacles in Germany, Brazil, and California, and recommend a launch sequence. Explain what would make the difference between a defensible pilot and an indefensible one.
Read the worked answer
Framing. The pilot is systematic employee monitoring and a new high-risk processing operation. The first question is not “which basis is most convenient” but “which jurisdiction can lawfully start, and on what conditions.” A single global launch date is the wrong control.
Germany. GDPR Art. 6(1)(f) may be available, but Art. 88 GDPR plus §26 BDSG and the BetrVG §87(1)6 co-determination right make works-council agreement a precondition for monitoring. The works council is not a stakeholder to be managed; its agreement is a legal gate. Launching over its objection invites injunctive relief, invalidity, and supervisory-authority scrutiny. The defensible path is a negotiated works agreement covering purpose, data categories, retention, access, and human review, or a genuinely anonymized/aggregated pilot that falls outside co-determination.
Brazil. LGPD Art. 7(IX) legitimate interest requires a documented legitimate-interest assessment, necessity and balancing tests, transparency, and respect for employee vulnerability. The union has no statutory veto comparable to the works council, but consultation and a clear communication plan matter evidentially. Badge and email-metadata collection needs a specific necessity justification; email metadata is especially hard to defend if less intrusive measures exist.
California. CPRA covers employees. Nordwind must give a notice at collection stating categories, purposes, retention, and rights; purpose limitation applies; “sale/share” opt-out only if the tool constitutes a sale or sharing (unlikely on these facts, but the vendor must not use data for its own purposes). Human review and no automated adverse action reduce Art. 22-type risk but do not remove transparency duties.
Sequencing. Start California only after notice, DPIA, vendor controls, and a narrow data set. Start Brazil only after the LIA and union engagement. Do not start Germany until the works agreement is signed. A DPIA covering all three should precede any live processing because the pilot involves systematic monitoring, new technology, and employee data. Defensible = documented necessity, minimization, works-council agreement, human review, retention, and vendor controls. Indefensible = consent in Germany, full metadata, no DPIA, and a simultaneous launch.
2. The CPO suggests obtaining written employee consent in Germany to bypass the works council. Evaluate that proposal under GDPR and German employment law.
Read the worked answer
Consent is the weakest available basis here. GDPR Art. 4(11) requires a freely given, specific, informed, and unambiguous indication; Recital 43 and EDPB guidance recognize that employees are in a relationship of subordination, so consent is presumptively not freely given where refusal could affect them. German law is stricter: §26 BDSG permits consent in employment only in limited circumstances, and the works council’s co-determination right cannot be waived by individual employees. A consent form signed under a launch deadline is exactly the kind of pressured, bundled consent regulators reject.
There is also a sequencing error: consent does not remove the monitoring character of the processing or the works-council gate. If Nordwind relies on consent, it risks (a) invalid consent, (b) a works-council dispute, and (c) an argument that the processing lacked a valid basis from day one. The better route is a works agreement with genuine alternatives, or an aggregated/anonymized pilot. If consent is used at all, it should be granular, revocable, not tied to employment consequences, and accompanied by the works agreement-not used as a substitute.
3. List the conditions that should be imposed on the vendor and the model before any pilot data is processed, and explain why each condition matters.
Read the worked answer
- DPIA signed off covering necessity, proportionality, employee impact, bias, and mitigations. Why: systematic monitoring and new analytics trigger Art. 35 and are the foundation for any legitimate-interest balancing.
- Data minimization-drop email metadata entirely unless a documented necessity test survives; reduce badge data to coarse attendance or exclude it; use HRIS and survey data first. Why: metadata is intrusive and hard to justify when less invasive predictors exist.
- Purpose limitation and no secondary use-the vendor may not train its own models, benchmark, or reuse data. Why: otherwise the vendor becomes a controller or the processing exceeds the notice.
- Retention and deletion-raw data retained no longer than 30–90 days; scores retained no longer than the pilot; deletion certification. Why: retention is a core accountability test.
- Human review and adverse-action guardrails-scores are advisory, managers cannot take adverse action solely on the score, and employees can contest. Why: reduces automated-decision and fairness risk.
- Vendor controls-DPA, updated SCCs and TIA, subprocessor list, security (encryption, MFA, logging), audit, breach notification, return/deletion. Why: the vendor is a processor and the transfer must be assessed.
- Transparency and rights-employee notice, access/rectification, works-council/union information. Why: notice is a legal requirement and a trust condition.
- Bias and validation-test for disparate impact by gender, age, disability, and part-time status before launch. Why: employment scoring can produce unlawful discrimination.
- Access controls and logging-least privilege for managers, no bulk export, audit trails. Why: insider misuse is a realistic risk.