Data protection, confidentiality and co-determination in corporate health management

Your employer receives no individual health data from us. Not your result, not your findings, not even whether you took part.

That is not a promise but a consequence of how the service is built. This page explains how it is built, with article, paragraph and link, so that your data protection officer, works council and legal department can check it rather than take our word for it.

Four statements this page supports:

1. Under Art. 9(1) GDPR, health data is prohibited in principle. We start from the prohibition, not from consent.
2. We do not base medical processing on Section 26 BDSG, because, following the judgment of the Court of Justice of the European Union of 30 March 2023 (C-34/21), paragraph 1 sentence 1 of that provision is regarded in the specialist literature as contrary to EU law. Our architecture does not depend on it.
3. Even for occupational health checks required by law, your employer learns only that an appointment took place, when, and for what reason. That is what Section 6(3) no. 3 ArbMedVV provides. With our voluntary screening, it does not even learn that.
4. Medical confidentiality is backed by criminal penalties, and Section 203(4) StGB obliges us to bind our non-medical staff formally as well. This obligation must be documented for each person; you can ask for the evidence before the project starts.

No paragraph numbers. The legal derivation follows further down.

What happens to my data?
Your examination results go to the doctor who examines you, and to you. Nobody else sees them. You receive your results in person and discuss them with a doctor.

Who sees my results?
The examining doctor, and the medical assistants where this is necessary to carry out the examination. All of these people are bound by confidentiality, and breaching that duty is a criminal offence in Germany.

Does my employer see my results?
No. Your employer receives no results, no findings, no risk scores and no names from us.

Does my employer find out whether I took part?
No. Registration does not go through the HR department but through us or through your occupational physician. Your employer receives only summarised figures, for example how many appointments were booked at a site. There are no lists of names, and there are no lists of people who did not attend.

What does my employer get, then?
A summarised report on the group, and only if the group is large enough that nobody can be identified from it. The minimum group size is agreed in the contract before the project starts, see section 13.

What happens if I do not take part?
Nothing. Participation is voluntary, and non-participation is not recorded anywhere. The works agreement usually also includes a prohibition of retaliation.

How do I withdraw my consent?
With a message to us, in one step. Withdrawal must be as easy as giving consent; the GDPR requires this. It does not go through your HR department, and you do not have to give a reason. Once you withdraw, we stop processing your data; the processing carried out up to that point remains lawful.

How long is my data stored?
The organisational data is deleted once the measure ends. Medical records are subject to medical retention obligations, which conflict with data minimisation. We explain that conflict in section 14 rather than hide it.

What if something is found?
Then the doctor discusses it with you and, where appropriate, recommends follow-up through standard care. Your employer learns nothing about it.

What you receive: an aggregated report above an agreed minimum group size, process metrics such as reach and slot utilisation, and the documentation you need for the payroll account and for funding from the statutory health insurance fund.

What you never receive: individual results, findings, diagnoses, risk scores, participant lists, lists of people who did not attend, and any analysis from which an individual could be reconstructed.

What you may not demand: individual results. Not even with the employee's consent, where the data falls under medical confidentiality and the processing is based on Art. 9(2)(h) in conjunction with Art. 9(3) GDPR. A provider who reports individual findings to an employer creates liability rather than avoiding it.

What your own obligations are:

Well evidenced

Almost every German corporate health management page begins with 'we obtain consent'. The right starting point is a different one.

Art. 9(1) GDPR, verbatim:

'Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.'
https://dsgvo-gesetz.de/art-9-dsgvo/

Processing is prohibited unless an exception in paragraph 2 applies. The question is therefore not 'do we have consent' but 'which exception do we rely on, and why does it hold'.

4.1 The four exceptions that matter in corporate health management#

4.2 Why we build on point (h) and not on consent#

'Health data is prohibited in principle under Art. 9(1) GDPR. We do not base medical processing on consent, which is notoriously open to challenge in the employment relationship, but on Art. 9(2)(h) in conjunction with Art. 9(3) GDPR: processing for the purpose of preventive care by medical personnel under professional secrecy.'

This is not a legal trick but a description of what actually happens. A medical examination is preventive care, and the data sits with people who are bound by confidentiality.

Consent does not disappear as a result, but it gets its proper role: it legitimises participation and everything that goes beyond the core medical processing, and it safeguards voluntariness. It does not carry the whole burden of lawfulness on its own.

4.3 The consequence for responsibility#

For the medical data, the employer is neither controller nor processor. The architecture is a split:

And at the medical level there is deliberately no data processing agreement with the employer. Such an agreement would imply that the employer has the power to give instructions over medical data, and that is exactly what must not exist. A reasoned finding that no processor relationship exists is a stronger position than a carefully worded contract about something that must not exist.

DisputedThis responsibility analysis has not been conclusively settled in law. The opposing view assumes joint controllership under Art. 26 GDPR for the organisational level.

Well evidencedfor the legal texts, disputed as to scope

5.1 What Section 26(2) BDSG says, and it is more favourable to us than often portrayed#

Section 26(2) BDSG requires that, when assessing whether consent was given voluntarily, particular account be taken of the dependence in the employment relationship and the circumstances in which consent was given. And then comes the sentence the market rarely quotes: voluntariness may exist in particular where the employee gains a legal or economic advantage or where employer and employee pursue the same interests. Consent must as a rule be given in writing or electronically, and the employer must inform the employee of the purpose and of the right to withdraw.
https://www.gesetze-im-internet.de/bdsg_2018/__26.html

A free, voluntary preventive examination that the employee would otherwise have to arrange privately comes close to the textbook case of a 'legal or economic advantage'. We say so, and we still do not present consent as unproblematic.

5.2 Recital 43, read correctly#

Recital 43 GDPR, verbatim:

'In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.'
https://dsgvo-gesetz.de/erwaegungsgruende/nr-43/

A precision warning we impose on ourselves: Recital 43 gives a public authority as its example, not an employer. Anyone who cites it as if it said 'consent in the employment relationship is invalid' overstates it. The correct chain is this: Recital 43 (clear imbalance) leads to Section 26(2) BDSG (dependence in the employment relationship), and from there to the consistent position of the supervisory authorities that consent in the employment relationship is possible but fragile.

5.3 Art. 7 GDPR and a verifiable commitment#

Art. 7 GDPR provides for: the controller's duty to demonstrate consent (para. 1); that the request must be made 'in an intelligible and easily accessible form, using clear and plain language' and be clearly distinguishable from other matters (para. 2); that 'the data subject shall have the right to withdraw his or her consent at any time' and that withdrawal must be 'as easy to withdraw as to give consent' (para. 3); and the prohibition on bundling consent (para. 4).
https://dsgvo-gesetz.de/art-7-dsgvo/

From this we derive a concrete, verifiable commitment: with us, withdrawal is one step, via an address printed on the participant information sheet. It does not go through a form in the HR department. That can be checked, which is why it is stated here.

5.4 Why we do not rely on Section 26(1) BDSG#

DisputedRuling well evidenced, scope disputed

On 30 March 2023 the Court of Justice of the European Union held in Case C-34/21 that a national provision which merely repeats the general requirements of the GDPR is not a 'more specific provision' within the meaning of Art. 88(1) GDPR and must therefore be disapplied. The decision concerned Section 23(1) sentence 1 of the Hessian Data Protection and Freedom of Information Act.

Because Section 26(1) sentence 1 BDSG is almost identical in wording, the prevailing view in German practice and among several supervisory authorities is that Section 26(1) sentence 1 BDSG cannot serve as a legal basis either, and that processing must be based directly on Art. 6 and Art. 9 GDPR.

We say two things about this, and both matter:

• The ruling did not concern Section 26 BDSG directly. Extending it to Section 26 BDSG is the prevailing view, but not the unanimous one. Anyone who presents it otherwise is being imprecise.
• That is precisely why our architecture does not depend on it. The medical level rests on Art. 9(2)(h) in conjunction with para. 3 GDPR, the organisational level on the works agreement as a collective agreement under Art. 88(1) GDPR. Whether Section 26(1) BDSG remains applicable changes nothing about that.

Further reading: Baden-Württemberg State Commissioner for Data Protection, FAQ zu Rechtsgrundlagen bei Beschäftigtendaten (https://www.baden-wuerttemberg.datenschutz.de/faq-rechtsgrundlagen-bei-beschaeftigtendaten/) and Hessian Commissioner for Data Protection and Freedom of Information, Handreichung April 2023 (https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2023-04/handreichung_beschaeftigtendatenschutz_eugh-urteil.pdf).

5.5 The Employee Data Act (Beschäftigtendatengesetz)#

A draft bill from the Federal Ministry of Labour and Social Affairs and the Federal Ministry of the Interior dated 8 October 2024 was meant to replace Section 26 BDSG with a law of its own. No Employee Data Act is in force. We do not write this page as if there were one, and we date it. The fact that the legal basis for processing employee data is in flux is itself an argument for an architecture built on Art. 9(2)(h).

Well evidencedfor the statute text

Section 22(1) no. 1(b) BDSG permits public and non-public bodies to process special categories of data where this is necessary

'for the purpose of preventive care, for the assessment of the working capacity of the employee, for medical diagnosis, the provision of health or social care or treatment or for the management of health or social care systems and services'

and the data is processed 'by medical personnel or by other persons who are subject to a corresponding duty of confidentiality, or under their responsibility'.
https://www.gesetze-im-internet.de/bdsg_2018/__22.html

Section 22(2) BDSG requires 'appropriate and specific measures to safeguard the interests of the data subject' and lists them. In effect, this list is a published checklist of what our technical and organisational documentation must contain. We map it one to one:

This page is not a privacy policy. The specific terms for a project are set out in its data protection notice and contract documents, not here.

A note for procurement: for digital services, the GKV Prevention Guide (Leitfaden Prävention) takes as its benchmark an information security management system based on ISO 27001, with a certificate that must be presented, and ISO 27018 for cloud operation. Your group procurement team will ask for exactly this.

Well evidenced

7.1 The criminal provision#

Section 203(1) StGB makes the unauthorised disclosure of another person's secret a criminal offence where it was entrusted to, or otherwise became known to, a 'doctor, dentist, veterinary surgeon, pharmacist or member of another healthcare profession that requires state-regulated training for the exercise of the profession or the use of the professional title', in that capacity. The penalty is up to one year's imprisonment or a fine, and in aggravated cases (for payment, or with intent to enrich oneself or to harm another) up to two years.
https://www.gesetze-im-internet.de/stgb/__203.html

Section 203(3) StGB permits disclosure to 'assistants working for them professionally' and to persons in training, where necessary.

Section 203(4) StGB is the paragraph that matters most for a provider: it extends criminal liability to persons who contribute to the work, and additionally makes the holder of professional secrecy liable if they fail to ensure that these persons are bound to secrecy.

What this means for us, and it can be verified: our non-medical employees are formally bound to confidentiality under Section 203(4) StGB, the obligation is documented for each person, and we provide the declaration of commitment on request.

A note on accuracy: we deliberately avoid the dramatic talk of penalties that is popular in provider copy. One year, or two in aggravated cases, is the position under German law.

7.2 The professional code of conduct#

Section 9 of the Model Professional Code for Physicians Practising in Germany reads, in paragraph 1:

'Doctors must maintain silence about what has been entrusted to them or has become known to them in their capacity as doctors, even beyond the death of the patient. This also includes written communications from the patient, records about patients, X-ray images and other examination findings.'

Paragraph 2 permits disclosure where the duty of confidentiality has been waived or to protect a legal interest of higher rank. Paragraph 3 permits access by employees and trainees, requires that they be instructed on the statutory duty, and prescribes that this be recorded in writing.

A point of accuracy we care about: the Model Professional Code is a model. What is binding is the professional code of the competent regional medical association, and these differ from one another. Anyone who cites 'the MBO-Ä' as if it were law is being imprecise.
https://www.bundesaerztekammer.de/themen/recht/berufsrecht

7.3 And the independence of the occupational physician's role#

Section 8 ASiG states that occupational physicians and occupational safety specialists are 'not bound by instructions in the application of their expertise', that they must not be disadvantaged for performing their duties, that occupational physicians are 'subject only to their medical conscience' and must observe the rules of medical confidentiality.
https://www.gesetze-im-internet.de/asig/

This freedom from instructions is the reason why an external provider cannot replace occupational medical care but can only work alongside it.

Well evidenced

This is the most useful section of the page for an HR buyer, because German law spells out the answer in a single sentence.

Section 6(3) ArbMedVV obliges the doctor

'1. to record the result and the findings of the occupational health check in writing and to advise the employee on them,
2. to make the result available to the employee at their request, and
3. to issue the employee and the employer with a certificate confirming that, when and for what reason an occupational health check appointment took place; the certificate also states when a further occupational health check is indicated from a medical point of view.'
https://www.gesetze-im-internet.de/arbmedvv/__6.html

Read that carefully. Even for occupational medicine that is required by law and initiated by the employer, the employer learns only that the appointment took place, when and for what reason, and when the next one is due. No result. No findings. No fitness assessment.

The strongest sentence on this page:
'Even for occupational health checks required by law, under Section 6(3) no. 3 ArbMedVV your employer may learn only that an appointment took place, when and for what reason, no result and no findings. With our voluntary screening, it does not even learn that.'

Further provisions of the same ordinance:

• Section 6(1) sentence 6 ArbMedVV: 'The doctor must observe medical confidentiality.' And: examinations may not be carried out against the employee's will.
• Section 6(4) ArbMedVV: If the doctor considers the occupational safety measures inadequate, the doctor informs the employer and proposes measures. Where a change of job is necessary solely for reasons relating to the employee personally, this notification to the employer requires the employee's consent.
• Section 3(3) ArbMedVV: Occupational health checks should not be carried out together with examinations that serve to establish fitness for work, unless operational reasons require it; in that case the doctor must make the different purposes clear. Operational consequence for us: a voluntary screening is kept visibly and organisationally separate from every fitness-for-work examination, and where possible from mandatory check appointments too. Same day, same room is a compliance risk and a trust risk.

The comparison:

And an important clarification: a voluntary commercial screening is not an occupational health check and must never be presented as a substitute for one. It complements it.

Well evidenced

Section 5(1) ArbSchG:

'By assessing the hazards associated with employees' work, the employer must determine which occupational health and safety measures are necessary.'

Section 5(3) no. 6 ArbSchG expressly names 'mental stress at work'. Section 6 ArbSchG requires documentation.
https://www.gesetze-im-internet.de/arbschg/__5.html

Under data protection law, two things need to be kept apart:

1. The risk assessment assesses workplaces, not people. Its subject is conditions. It is not an instrument for collecting individual health data and must not be turned into one.
2. Survey data from a risk assessment of mental stress must be analysed so that no person and no very small unit can be identified. The minimum group size under section 13 applies here in exactly the same way.

What is not permissible: using the results of a voluntary screening as a data source for a risk assessment unless this is made transparent, set out in the works agreement and covered by the minimum group size. Once results are fed back by workplace, the co-determination position changes too (section 11).

Well evidenced

Section 167(2) SGB IX obliges the employer, where an employee has been unfit for work for more than six weeks within a year, whether continuously or repeatedly, to clarify the options for overcoming the incapacity for work, namely 'with the consent and participation of the person concerned', involving the employee representatives, where applicable the representative body for severely disabled employees, at the employee's request a person of trust of their own choosing and, where necessary, the company or occupational physician, with prior information about the data collected and the aims of the procedure.
https://www.gesetze-im-internet.de/sgb_9_2018/__167.html

Why this appears here even though we do not offer BEM:

1. It is the one German health data procedure that every HR department already knows. It supplies the mental model.
2. It is the sharpest available contrast. BEM is triggered by the employer, is name-based, is documented in the HR process and, in addition to consent to the procedure, needs its own data protection consent under Art. 9(2)(a) GDPR. A voluntary screening is none of those things.
3. Confusing the two is a real risk. A works council that reads a screening service as a covert substitute for BEM, or an employer that tries to steer BEM cases through a health day, creates a serious legal problem and a trust problem.
4. The six-week threshold in Section 167(2) SGB IX is the same as the limit on continued payment of wages in Section 3(1) EntgFG. That is the bridge to our page on the business case.

BEM_SCOPE We state explicitly whether we offer any BEM services. If not, this page says so in one sentence.

Well evidencedfor the statutory texts

The full account and its practical consequences are on our page Introducing a health programme. Here is the short version for data protection.

Section 87(1) of the Works Constitution Act (BetrVG) begins: 'Where no statutory or collective-agreement provision exists, the works council has a right of co-determination in the following matters'.

• No. 1: 'Matters relating to the operation of the establishment and the conduct of employees in the establishment'
• No. 6: 'The introduction and use of technical devices designed to monitor the conduct or performance of employees'
• No. 7: 'Regulations on the prevention of industrial accidents and occupational diseases and on the protection of health within the framework of statutory provisions or accident prevention regulations'

https://www.gesetze-im-internet.de/betrvg/__87.html

The point most often overlooked in corporate health management: under the Federal Labour Court's settled case law, what matters under no. 6 is not whether the employer intends to monitor, but whether the technical system is objectively capable of collecting and recording information on behaviour or performance. A sign-up portal that records who has booked an appointment is therefore subject to co-determination, even if participation is entirely voluntary and nobody intends to monitor anyone.

And the counter-intuitive rule: the weaker the statutory requirement, the stronger the co-determination. Sections 3 and 5 of the Occupational Safety and Health Act (ArbSchG) are framework provisions that need to be filled in. Where the employer has room to decide how, the works council has a say in that decision.

Section 88 no. 1 BetrVG expressly provides for voluntary works agreements on 'measures to prevent occupational accidents and damage to health'. This works agreement is also the collective agreement within the meaning of Art. 88(1) GDPR, and therefore a core element of the data protection architecture. Note Section 77(6) BetrVG: by law, an agreement continues to apply after expiry only for its mandatory parts; for the voluntary parts, this must be expressly agreed.

Section 80(2) BetrVG gives the works council rights to information and documents even where there is no co-determination. Section 80(3) sentence 2 BetrVG provides that, where artificial intelligence is involved, calling in an expert is deemed 'necessary to that extent', at the employer's expense.

In the public sector, the Federal Staff Representation Act (BPersVG) and the sixteen state staff representation acts apply. Section 80 BPersVG (2021) lists health management and reintegration management among the matters subject to co-determination. The state laws differ; check the law that applies to you.

We deliberately cite no case numbers on this page. The doctrine is set out here in clear language; the references are in our internal legal memo and are handed over on request. A wrong case number on a page whose value lies in its diligence would be an own goal.

Well evidencedfor the statutory texts

We explain this legal position because it marks the point at which German law is particularly strict. This page describes no pharmacogenetic service.

Section 19 of the Genetic Diagnostics Act (GenDG), verbatim:

'The employer may not, either before or after the employment relationship is established,
1. require genetic examinations or analyses to be carried out or
2. require the disclosure of results of genetic examinations or analyses already carried out, or accept or use such results.'
https://www.gesetze-im-internet.de/gendg/

Read the verbs. Employers are forbidden not only to demand genetic results but also to accept or use them. Employee consent changes nothing.

• Section 20 GenDG prohibits genetic examinations as part of occupational health checks, with a narrow exception for diagnostic genetic analyses relating to a serious illness that can be triggered at the workplace. [The precise exception and its conditions must be verified before any public statement.]
• Section 21 GenDG (prohibition of discrimination in employment): 'In any agreement or measure, in particular when establishing the employment relationship, in career advancement, in giving instructions or on termination of the employment relationship, the employer may not discriminate against employees on the basis of their own genetic characteristics or those of a genetically related person.'
• Section 22 GenDG extends the part to public-law service relationships.

How enforcement works, and it is counter-intuitive:

In addition to Part 5, the general GenDG regime applies to every genetic examination for medical purposes: the reservation to physicians (a diagnostic genetic examination may be carried out only by a physician, a predictive one only by a specialist in human genetics or an appropriately qualified physician), the requirement of informed written consent and the duty to provide genetic counselling for predictive examinations.

DisputedEach of these elements needs legal review case by case, in particular against Sections 7 to 11 GenDG.

What employers should take from this: if a provider offers you genetic or pharmacogenetic analyses as part of a workplace programme, check very carefully where your company could come into contact with the results. Section 19 GenDG prohibits you even from accepting them.

Well evidencedas a negative finding

German law has no statutory minimum group size for aggregated health reports. We claim nothing else, and we advise you to be wary of any provider that quotes a statutory figure.

What actually applies: Art. 9 GDPR and the principle of data minimisation give rise to a duty to anonymise. The operational test is the risk of re-identification through combined characteristics, not a fixed number. An analysis by location, age group, gender and health topic can make a person identifiable even at n = 30.

Our commitment:

We label this expressly as a contractual commitment, not a statutory minimum. A provider who says 'the law names no figure, so we name one and bind ourselves to it' can be checked. A provider who invents a statutory obligation cannot be.

A note on the health reports of the health insurance funds, because the point is often confused: the funds, too, apply their own minimum figures before producing a workplace health report. These thresholds differ from fund to fund, are mostly unpublished and are fund practice, not law. And a report drawn from a single fund's data is a non-random subsample of your workforce, skewed by occupational structure, and never 'the company's sickness absence rate'.

Every commitment in this table follows from the sections above. None rests on trust alone.

14.1 The conflict over deletion, explained openly#

Two obligations pull in different directions. Data minimisation and the duty to delete under Art. 5(1)(e) and Art. 17 GDPR require us not to keep data longer than necessary. The physician's duty to document requires the opposite: treatment records must be kept for years.

We do not resolve this by concealing one of the two obligations. We use a tiered deletion plan instead: the organisational data collected to run the programme is deleted once the measure ends. Medical documentation is subject to the physician's retention duty and stays within the medical sphere, out of the employer's reach. The specific periods and their legal basis will be agreed before the project starts and documented in the project's data protection notice.

Your data protection officer and your works council should have these documents before the project starts. Ask every provider for them, including us:

1. Data protection concept with the allocation of responsibilities under Section 4.3
2. Participant information under Art. 13 GDPR, in plain language, with instructions on how to withdraw
3. Consent form, kept separate from other declarations, under Art. 7(2) GDPR
4. Confidentiality undertaking under Section 203(4) StGB, documented for each person
5. Documentation of technical and organisational measures (TOM), structured as a one-to-one mapping of the list in Section 22(2) BDSG
6. Deletion plan, separated by purpose
7. Anonymised sample report with the documented minimum group size
8. Record of processing activities for our own area of responsibility
9. Input to your data protection impact assessment, as far as we can provide it

And the documents you need to produce yourself: works agreement, your own record of processing activities (even with fewer than 250 employees, see Section 3), a data protection impact assessment where applicable, appointment of the data protection officer, and your own deletion plan.

Twelve questions, each with its source reference. The results are calculated in your browser, and nothing is transmitted.

'This check is a guide, not a legal assessment of your individual case.'

'This is GDPR-compliant.'
Compliance belongs to a specific processing operation in a specific company, not to a product. We describe the architecture and explain why it stands up. Your data protection officer makes the assessment, not us.

'The works council does not need to be involved because participation is voluntary.'
This claim circulates in the German market and is wrong often enough to be dangerous. It is the most common reason a rollout in Germany fails.

Does my employer really get nothing at all?
It receives an aggregated report above the agreed minimum group size, plus process metrics on utilisation. It receives no names, no results and no participation information on individuals.

What if my employer demands it anyway?
We do not supply it. For the medical level, processing is lawful because it stays within medical confidentiality (Art. 9(3) GDPR). Passing it on would remove that basis and engage Section 203 StGB.

And if I, as an employee, consent myself?
Your results belong to you, and you can of course pass them on yourself. We do not. The difference matters: in an employment relationship, consent given to one's own employer is structurally open to challenge as not freely given, so we build our architecture to stop this question arising in the first place.

Why do you need consent at all if you rely on Art. 9(2)(h)?
Consent legitimises participation and everything that goes beyond the core medical processing. It cannot make the processing lawful on its own, however, because consent in an employment relationship is fragile.

Does the works council really have to be involved, even though everything is voluntary?
Yes, in practically any real-world set-up. As soon as a booking tool is involved, Section 87(1) no. 6 BetrVG applies regardless of whether participation is voluntary.

Is a screening the same as occupational health checks?
No, and it does not replace them. Occupational health checks are regulated by law and arranged by the employer on the basis of the risk assessment. A voluntary screening is an additional service. The two are kept visibly and organisationally separate (Section 3(3) ArbMedVV).

Where are the data held?
The storage location and the service providers used will be agreed before the project starts and documented in the project's data protection notice. This page is not a privacy policy and commits to nothing on this.

European law

1. Art. 5, 6, 7, 9, 13, 17, 26, 28, 30, 32, 35, 37, 88 GDPR: https://dsgvo-gesetz.de/
2. Recital 43 GDPR: https://dsgvo-gesetz.de/erwaegungsgruende/nr-43/
3. Court of Justice of the European Union, judgment of 30 March 2023, C-34/21 (Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium)

German law

4. Section 22 BDSG (special categories, list of measures in subsection (2)): https://www.gesetze-im-internet.de/bdsg_2018/__22.html
5. Section 26 BDSG (processing of employee data, consent, collective agreement): https://www.gesetze-im-internet.de/bdsg_2018/__26.html
6. Section 38 BDSG (data protection officers of non-public bodies): https://www.gesetze-im-internet.de/bdsg_2018/__38.html
7. Section 203 StGB (breach of private secrets, in particular subsections (3) and (4)): https://www.gesetze-im-internet.de/stgb/__203.html
8. Sections 3 and 6 ArbMedVV: https://www.gesetze-im-internet.de/arbmedvv/__3.html · https://www.gesetze-im-internet.de/arbmedvv/__6.html
9. Sections 5 and 6 ArbSchG: https://www.gesetze-im-internet.de/arbschg/__5.html · https://www.gesetze-im-internet.de/arbschg/__6.html
10. Section 87, Section 77(6), Section 80, Section 88 no. 1 BetrVG: https://www.gesetze-im-internet.de/betrvg/__87.html · https://www.gesetze-im-internet.de/betrvg/
11. Section 167(2) SGB IX (BEM): https://www.gesetze-im-internet.de/sgb_9_2018/__167.html
12. Sections 19, 20, 21, 22, 25 and 26 GenDG: https://www.gesetze-im-internet.de/gendg/
13. Section 8 ASiG (freedom from instructions and duty of confidentiality): https://www.gesetze-im-internet.de/asig/
14. Section 612a BGB (prohibition of victimisation): https://www.gesetze-im-internet.de/bgb/__612a.html
15. Section 3(1) EntgFG (six-week limit, as a reference to Section 167(2) SGB IX): https://www.gesetze-im-internet.de/entgfg/__3.html
16. Section 9 of the Model Professional Code for physicians practising in Germany. The professional code of the competent state medical association is binding: https://www.bundesaerztekammer.de/themen/recht/berufsrecht

Supervisory authorities

17. State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, FAQ on legal bases for employee data: https://www.baden-wuerttemberg.datenschutz.de/faq-rechtsgrundlagen-bei-beschaeftigtendaten/
18. Hessian Commissioner for Data Protection and Freedom of Information, guidance on the CJEU judgment, April 2023: https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2023-04/handreichung_beschaeftigtendatenschutz_eugh-urteil.pdf

Specialist literature and practice

19. Kiesche, E.: Betriebliches Gesundheitsmanagement. Betriebs- und Dienstvereinbarungen. Analyse und Handlungsempfehlungen, Hans-Böckler-Stiftung und Bund-Verlag, Frankfurt am Main 2013, ISBN 978-3-7663-6274-2. 125 agreements analysed; the analysis predates the GDPR
20. GKV-Spitzenverband: Leitfaden Prävention, version of 17 December 2025, in particular on the requirements for digital services: https://www.gkv-spitzenverband.de/media/dokumente/krankenversicherung_1/praevention__selbsthilfe__beratung/praevention/praevention_leitfaden/20251218_Leitfaden_Pravention_2025_barrierefrei.pdf

This page explains the legal position. It is not legal advice, and it does not replace a review of your individual case by your data protection officer, your legal department or a lawyer. What binds you is the statutory text, to which we link throughout, together with the interpretation of the competent supervisory authority and the courts.

As at September 2026. Next review: March 2027, or immediately if Section 26 BDSG is amended or an employee data act enters into force.