The “data protection and the works council need to have a say” objection: how to shorten the review

Why a review by data protection and the works council isn’t a no but a process with its own timeline, four responses that start it early, and which documents shorten it.

It also sounds like this: “Our data protection officer has to check this first.”, “Nothing happens here without the works council.”, “This is subject to the works council’s co-determination here.”

When the objection comes

With anything that processes employee or customer data, especially software that records calls or makes performance visible. Usually just before the decision, and then often brought in too late.

What’s behind it

A fixed process with its own timeline.
How to tell: The person knows the path and names the people involved.
A concern the person has themselves.
How to tell: They ask about storage location, retention period or analysis before mentioning the review.
A delay.
How to tell: There is no date and no contact person, just “that takes a while here”.

How to respond

“Makes sense. Shall we bring both in now rather than wait three weeks at the end?”
Start the review early and you don’t lose weeks at the end. And you hear the questions first-hand.
“What held up a review like this the last time at your company?”
The answer shows which documents to prepare before anyone asks for them.
“Which documents does your data protection officer need? I can send the data processing agreement and the technical measures right away.”
The review starts with documents. Supply them complete and unprompted and you shorten it.
“Do you already have a works agreement for systems like this that we can build on?”
An existing framework agreement can shorten the path considerably instead of starting from scratch.

What not to say

“It’s all GDPR-compliant, you don’t need to check it.”
The review is the customer’s business, not yours. Play it down and you look as if you have something to hide.
Going around the works council.
In Germany, the works council has a say on technical systems that can monitor behaviour or performance (Section 87(1) No. 6 BetrVG). A rollout without it can be stopped.
Waiting for the review without doing anything.
Questions bounce back and forth if nobody bundles them. Offer to answer them all in one go.

If the objection stays

Ask about the process and timeline of the review, send the data processing agreement, the technical and organisational measures and, where it fits, a draft works agreement, and offer a joint meeting with everyone involved.

Frequently asked questions

Does the works council have to approve call analysis software in Germany?

In Germany, the works council has a right of co-determination over technical systems capable of monitoring employees’ behaviour or performance (Section 87(1) No. 6 BetrVG). Software that records and analyses calls usually falls under it. Not legal advice.

Which documents does the data protection officer need?

Usually the data processing agreement, a description of the technical and organisational measures, where the data is stored and the sub-processors used. Send them in advance and you shorten the review.

How long does a review by data protection and the works council take?

It depends on the company, from days to several weeks. Ask about the process and the date of the next works council meeting instead of guessing.

More objections

All objections at a glance, with two responses each →Objection handling techniques: from the clarifying question to pre-empting →