Works council and GDPR rules for employee surveys

In Germany, yes: if you run an employee survey or interview through software, the works council (Betriebsrat) usually has a right of co-determination over the tool, so agree it with them before launch. In Denmark there is normally no formal approval step, but you should take it to the cooperation committee (samarbejdsudvalg, SU) early. In both countries you also need a lawful basis under the GDPR, a clear account of what data is collected and who processes it, and a decision on whether a data protection impact assessment is needed.

This article is general information, not legal advice. Labour law and data protection depend on your sector, your collective agreements and the details of your project, so check with your own legal adviser or data protection officer.

Do we need to involve the works council before an employee survey in Germany?

In most cases, yes, and it is better to assume so from the start.

The main rule is § 87(1) no. 6 of the Works Constitution Act (BetrVG). It gives the works council a right of co-determination over introducing and using technical devices that are designed to monitor employees’ behaviour or performance.

“Designed to monitor” is read broadly. The Federal Labour Court (Bundesarbeitsgericht) has held that a device counts if it is objectively capable of collecting behaviour or performance data about employees. What the employer intends doesn’t matter. It also doesn’t matter that the data is typed in by people instead of captured automatically.

In a 2018 case about a group-wide online employee survey, BAG, 11 December 2018, 1 ABR 13/17, the court treated the IT system used to run the survey as such a technical device (para. 25). In that case the system had already been agreed with the group works council. The court then held that changing individual questions did not change the agreed system, so it did not trigger co-determination again (paras. 26 to 28).

Two practical lessons follow. First, the tool itself is what usually needs agreement, and a survey platform or an AI interview platform is very likely to qualify. Second, if you agree the tool well, including what it collects, who sees what and the reporting thresholds, you don’t need to renegotiate every time you change a question.

What about § 94 and personnel questionnaires?

§ 94(1) BetrVG says personnel questionnaires need the works council’s consent. In the same 2018 decision the court found that § 94(1) did not apply to the employees surveyed, because taking part was voluntary (para. 36). So keep participation genuinely voluntary and say so in the invitation. That helps on the labour law side and on the GDPR side.

What does the works council usually ask?

1. What data does the tool collect about each person, and what does it not collect?
2. Who can see results, and at what level of detail?
3. What is the minimum group size for reports, and can anyone lower it?
4. Can any result be traced back to an individual employee?
5. Will results be used for performance assessment of individuals or managers?
6. Where is the data stored, and which companies process it?
7. How long is the data kept, and how is it deleted?

The answers often end up in a works agreement (Betriebsvereinbarung). A works council that has seen these answers in writing is far more likely to support the project, and to tell colleagues it is safe to take part.

Do we need the cooperation committee’s approval in Denmark?

Usually not formally. Danish workplaces don’t have a German-style co-determination right over survey software. What many workplaces do have is a cooperation committee (SU), set up under a cooperation agreement between the employer side and the unions, and that committee expects to be involved.

The state cooperation agreement is a good example. Under § 3(2), management must inform the SU early enough, and with enough content, for a proper discussion before decisions are made, according to the Samarbejdssekretariatet’s guidance on information and discussion. The SU’s tasks include trust, cooperation and wellbeing, and § 5 of the same agreement says that employees’ satisfaction and wellbeing must be measured at least every three years, which can be linked to the workplace assessment.

That workplace assessment (arbejdspladsvurdering, APV) is required of every employer under the Danish working environment rules. The Danish Working Environment Authority says employers must cover all working environment conditions at least every three years, and that the APV covers both the physical and the psychological working environment. Where there is a working environment organisation (AMO), it takes part in the whole process.

In practice: bring the plan to the SU before launch, show what will be asked and who will see what, and agree how results will be shared back. If the work feeds into your APV or wellbeing measurement, involve the AMO as well.

What is the lawful basis for employee surveys under the GDPR?

For most employee surveys and interviews, the lawful basis is legitimate interest: the employer has a genuine interest in understanding working conditions, and it must weigh that against employees’ rights and expectations. Public employers may instead rely on a public task.

Consent is a weak basis at work. The EDPB’s guidelines on consent say that, because of the imbalance of power between employer and employee, employees can only give free consent in exceptional circumstances (para. 21 and 22). That doesn’t mean participation should be compulsory. It means you should make taking part voluntary as a matter of fairness, while relying on a different lawful basis for the processing itself.

Do we need a DPIA for employee interviews?

Often it is wise to do one. A data protection impact assessment is required where processing is likely to result in a high risk to people’s rights. Employees are in a dependent position, open answers can contain sensitive details such as health or union membership, and AI is involved in the analysis. Several of those factors together point towards a DPIA. Even if you conclude one isn’t required, write down why.

A useful DPIA for an interview project covers:

• Purpose: what decision the results will inform, and that they won’t be used to assess individuals.
• Data minimisation: which personal data is truly needed, such as department for reporting, and which isn’t.
• Reporting rules: the minimum group size and how names and details are removed from quotes. Our post on the five-person anonymity threshold goes through these.
• Retention: how long answers and transcripts are kept, and when they are deleted.
• Processors and transfers: every company that handles the data, where it is, and the transfer mechanism for anything outside the EU.

Where is the data stored, and what does EU data residency cover?

EU data residency means the vendor stores your data in data centres inside the EU. It is a promise about where data sits, and it usually covers the main database. It doesn’t automatically cover every service that touches the data on the way, and it isn’t a GDPR requirement in itself: the GDPR allows transfers outside the EU when a valid mechanism such as an adequacy decision or Standard Contractual Clauses is in place.

So ask every vendor for a sub-processor list, and check it against what the sales deck says. “EU hosted” often covers the database but not email delivery, transcription or voice services. Questions worth putting in writing:

1. In which country is the main database, and are backups in the same region?
2. Where does the AI that reads or summarises answers run?
3. Which sub-processors are outside the EU, what data do they receive, and under which transfer mechanism?
4. Can support staff outside the EU access the data, and when?
5. How will you tell us before adding a new sub-processor?

For Spradley, the database is in Frankfurt and the AI that runs the interviews and analysis is in Google Cloud’s EU regions. A few services are US-based, such as email delivery and the voice used in voice interviews, and are covered by the EU’s Standard Contractual Clauses. Each one is listed on our sub-processors page, and our data policy explains how data is handled. Reports show nothing for any group of fewer than five people. Those two documents usually answer most of what a works council or SU asks.

If you are weighing interviews against a survey in the first place, our comparison of AI-moderated interviews and surveys sets out what each is for, and our HR and people page shows how Spradley fits into a listening programme.

Frequently asked questions

Key terms

works council (Betriebsrat)

An elected body representing employees in a German workplace. It has a right of co-determination over technical devices that can monitor behaviour or performance, which usually includes survey software.

works agreement (Betriebsvereinbarung)

A written agreement between employer and works council in Germany, often used to settle how a survey or interview tool is introduced and used.

cooperation committee (SU)

A Danish samarbejdsudvalg, set up under a cooperation agreement between employer and unions. It expects to be informed early and to discuss plans such as an employee survey before decisions are made.

APV

Arbejdspladsvurdering, the Danish workplace assessment every employer must carry out at least every three years, covering the physical and psychological working environment.

DPIA

Data protection impact assessment. Required under the GDPR where processing is likely to result in a high risk to people’s rights, it sets out purpose, data, reporting rules, retention and processors.

legitimate interest

A GDPR lawful basis where an organisation has a genuine interest in processing data and weighs it against people’s rights. It is the usual basis for employee surveys.