ECJ Holds That The Live Streaming Of Video Classes Falls Within The Scope Of The GDPR

• Jurisdiction: European Union
• Law Firm: Ganado Advocates
• Subject Matter: Privacy, Data Protection
• Author: Mr Nigel Micallef
• Published date: 05 May 2023

In Case C-34/21, Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium vs Minister des Hessischen Kultusministeriums, decided on the 30 March 2023, the European Court of Justice (the "Court of Justice") provided a preliminary ruling on a request made by the Administrative Court of Wiesbaden, Germany (the "Referring Court"), wherein it requested the Court of Justice to decide on the lawfulness of a live-streaming system for classes, adopted during the COVID-19 pandemic, without the prior consent of the teachers concerned. This decision was to be made through the interpretation of Article 88 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR") which concerns the processing of data in the context of employment.

Case Background and Preliminary Questions

The Minister for Education and Culture of the Land Hessen (the "Minister for Education") had established a framework during the COVID-19 pandemic whereby students who could not be present in a classroom could attend their classes online. To safeguard students' rights in relation to the protection of personal data, it was decided that such live streaming service would need to be consented to by the students themselves or for younger students, by their parents. However, no provision was made for the consent of the teachers participating in this service. Consequently, the Principal Staff Committee for Teachers (the "Principal Staff Committee") at the Ministry of Education brought an action before the Referring Court, complaining that the live streaming of classes by videoconference was not made conditional on the consent of the teachers concerned.

The Minister for Education maintained that paragraph 23 of the 'Law on data protection and freedom of information of the Land Hessen' (the "HDSIG") and paragraph 86 of the 'Law on the civil service of the Land Hessen' (the "HBG"), which regulate the processing of employees' personal data by public bodies, by relying on 'necessity' as the legal basis for the processing of such data, were in conformity with Article 88(1) of the GDPR. Article 88 of the GDPR concerns the processing of data in the context of employment, whereby Member States are given the discretion to provide for more specific rules regarding the processing of employees' personal data.

However, the Referring Court was not convinced that the relevant articles in the HDSIG and...