Before deploying invasive employee monitoring, HR skips Works Council consultation in a Member State that requires it. Why does that matter for CIPP/E-level compliance judgment?
Select an answer to reveal the explanation.
Short Explanation
In some EU countries, big monitoring rollouts are not a solo HR project—you talk to the Works Council first. Skipping that local gate can sink an otherwise “GDPR-looking” plan. National employment rules sit beside the GDPR here.
Full Explanation
Before deploying invasive employee monitoring, skipping Works Council consultation in a Member State that requires it matters because worker representation and Works Council procedures can be part of the lawful employment-compliance landscape for monitoring rollouts. Local co-determination is a civic workplace safeguard that sits beside the GDPR floor, not optional HR colour commentary. Saying Works Councils only advise on cafeteria menus fails by trivialising their role where law grants consultation rights on monitoring systems. Claiming the GDPR alone always replaces national co-determination rules for employment monitoring fails—Union data-protection law does not automatically erase national labour procedure. Asserting that skipping consultation is fine if the DPO later signs a one-line email approval fails: DPO sign-off cannot cure missing statutory consultation. Exam caveat: requirements vary by Member State; CIPP/E expects recognition that employment monitoring often needs both GDPR analysis and national labour/co-determination steps. Operational check: map whether Works Council or equivalent consultation is mandatory, pause invasive tooling until consultation completes, document outcomes in the monitoring policy, and align DPIA findings with agreed operational limits.