ECJ Ruling on Illicit Data Use Reignites German Workplace Privacy Debate as ePA Access Looms
03.07.2026 - 00:22:02 | boerse-global.de
A June 2026 decision from the European Court of Justice has injected fresh uncertainty into German employment law: the court declared that the General Data Protection Regulation does not outright prohibit civil courts from admitting illegally obtained data as evidence. The ruling came in a case where an employer searched a former employee’s private email account. Whether such evidence is ultimately usable depends on national law, with judges required to uphold the principle of data minimisation.
That judgment lands as German companies face a separate, fixed deadline. Under the country’s Contribution Procedure Ordinance (Beitragsverfahrensverordnung), all pay-related records must be stored electronically in a machine-readable format by 2027. The shift promises instant access, audit-proof archiving and lower storage costs. Human-resources departments stand to save time hunting for documents and reduce physical archive expenses. Yet the switch demands GDPR-compliant permission structures. Many firms outsource the conversion to specialised vendors bound by strict data-processing agreements, while paper originals must be shredded under DIN 66399 certification.
What Employees Can Demand – and What They Cannot
The right of access under Article 15 of the GDPR continues to crystallise. Berlin-based attorney Jan Wilking noted in early July that workers are now entitled not only to view the contents of their personnel file but, in certain circumstances, to request a log of who accessed it and when. That same right does not extend to blocking lawfully collected documents.
Case law has been pushing the boundaries. In 2018 the Higher Labour Court of Baden-WĂĽrttemberg ordered a company to hand over copies of all performance and behavioural data. But the ECJ itself ruled in March 2026 that a first access request can be deemed excessive if it serves an abusive, advantage-seeking purpose. Compensation under Article 82 further requires an actual loss; a mere fear of harm does not justify a payout.
Occupational Doctors and the Electronic Patient Record
The most contentious front involves occupational health. A draft bill from the Federal Ministry of Health – part of the GeDIG legislation – would allow company doctors to consult the electronic patient record (ePA) without obtaining explicit consent from the employee. An opt-out principle applies: insured individuals can block access via an app or hide individual documents.
Psychologists’ associations have condemned the plan as a severe breach of data protection, warning it will erode trust between employees and medical staff. The German Society for Occupational and Environmental Medicine pushes back, pointing to doctors’ duty of confidentiality and emphasising the preventive value for workplace health protection.
Tighter Liability on Tracking and Credit Reporting
Meanwhile, liability for third-party tracking tools has hardened. The Stuttgart Higher Regional Court awarded a user €500 in damages for loss of control caused by vendor services. In parallel, Germany’s Federal Court of Justice has raised the bar for reporting disputed debts to credit agencies such as Schufa: companies and collection firms must verify contested claims before forwarding them, or face deletion demands and damages – with no fixed materiality threshold for non-material harm.
