The Hamburg Commissioner for Data Protection and Freedom of Information ('HmbBfDI') issued, on 3 April 2023, a press release following the Court of Justice of the European Union ('CJEU') preliminary ruling in case C-34/21 Principal Staff Committee for Teachers at the Hessian Ministry of Education v Hessian Ministry of Education. In particular, the HmbBfDI explained that the CJEU found that Section 23 of the Hessian Data Protection and Freedom of Information Act ('HDSIG') of 3 May 2018 does not constitute a 'more specific rule' within the meaning of Article 88(1) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), where it does not satisfy the conditions laid down in Article 88(2) of the GDPR.

Further to the above, the HmbBfDI highlighted that the preliminary ruling has far-reaching consequences in Hamburg as well, explaining that Section 26 of the Federal Data Protection Act of 30 June 2017 (implementing the GDPR) (as amended) is likely to be considered inapplicable. In light of this, the HmbBfDI noted that businesses will now have to base their processing of employee data on Article 6(1) of the GDPR, specifically relying on contractual necessity and compliance with a legal obligation.

Moreover, the HmbBfDI outlined that the ongoing endeavours to create a new federal employment data protection act has now garnered favourable momentum, highlighting that the German Data Protection Conference ('DSK') called for the enactment of such an employment-specific act in 2022. In addition, the HmbBfDI called upon the Hamburg legislature to review Section 10 of the Hamburg Data Protection Act ('HmbDSG') of 18 May 2018 and, if necessary, to significantly expand it.

You can read the press release, only available in German, here.