Can a German employer force employees to submit personal data to a contractor?
<p>A German higher-education institution recently introduced a new measure to facilitate Covid-19 contact tracing: next to each door (i.e. entrances to the building, the lecture rooms, the labs and some other places), there is a QR code that must be scanned using an app by a company. The goal is to track who was in a specific room at a specific time. The rule applies to employees, students and visitors.</p>
<p>People who don't have a smartphone, should visit a specific URL on the contractor's website and enter their data manually. People who do not wish to provide these data should not enter the building at all.</p>
<p>The higher-education institution claims that this is all perfectly legal because it conforms to the local Corona Law (i.e. <a href="https://www.baden-wuerttemberg.de/de/service/aktuelle-infos-zu-corona/aktuelle-corona-verordnung-des-landes-baden-wuerttemberg/" rel="nofollow noreferrer">Baden-Wüttemberg's Corona law, in force since 30 September 2020</a>, which is also available in English) and because the contractor's treatment of the data conforms to the GDPR. However, I am not totally convinced that the reference to these two pieces of legislation is sufficient:</p>
<ul>
<li>§6 of Baden-Wüttemberg's Corona law <em>allows</em> organisations to collect certain data about attendees, participants etc. but does not state that these persons can be forced to submit their data to a third party (i.e. a contractor to the organisation they are visiting).</li>
<li>The GDPR is relevant when people willingly submit their data but does not seem to be a legal basis for forcing people to submit data to a third party.</li>
</ul>
<p>Note that this contractor is not mentioned in employee contracts as a company with which the higher-education institution might share data.</p>
<p>So my question is whether an employer can force employees and students to submit data to a contractor without violating the principle of <a href="https://en.wikipedia.org/wiki/Informational_self-determination" rel="nofollow noreferrer">informational self-determination</a>.</p>

<p>The university has a legal obligation to collect certain data from attendees, including employees an visitors. It has decided to keep these records in digital form, and offers a smartphone app as a convenience.</p>
<p>The university has outsourced the data processing activity to a third party. This is perfectly legal under the GDPR, <em>if</em> that third party is contractually bound to only process the data as instructed, and not for their own purposes. Whereas the university acts as a data controller (Verantwortlicher), the third party would be a data processor (Auftragsverarbeiter).</p>
<p>I have some doubts though whether an app or a website is indeed the solution that offers the best data protection, especially taking into account the GDPR's data minimization principle. Requiring updates when entering or leaving any room is potentially excessive. Given the sensitivity of the data, the university should have performed a data protection impact assessment to weigh the consequences of this measure. At least for employees, the measure would likely have to be approved by the union (Personalrat) as well.</p>

<p>You misinterpret §6: It states &quot;Zum zweck X dürfen erboben werden&quot; - &quot;is allowed to take data for reason X&quot;. This does alter other law that otherwise would preclude taking these data. The more relevant sentence is the first one, which defines the reason X as data that is required by this ordinance. And the ordinance does in fact demand that this at is gathered, and then stored for 4 weeks under §6 for all the groups that are listed in §14.</p>
<p>Not providing the data means that the company that is obligated to gather the §6 data under §14 may not provide service.</p>
<p>GDPR does not apply, as the submission is not voluntary and bound to the rules of the §6 only. Use for anything BUT the §6 is forbidden.</p>

gdpr germany data-protection