In an establishment with a works council, an inspection robot with a camera may not be put into operation without a works agreement. Works council co-determination under Section 87(1) no. 6 BetrVG (German Works Constitution Act) is already triggered by the objective suitability for monitoring of conduct and performance – a corresponding intention is not required. Under data protection law, a data protection impact assessment under Art. 35 GDPR must regularly be carried out. Both belong at the start of the project, not just before acceptance.
Why two areas of law at once
Data protection and works council co-determination are often treated as the same topic. They are not.
Data protection protects the data subject and their data. It applies regardless of whether a works council exists, and it is enforced by supervisory authorities.
Works council co-determination protects the collective interest of the workforce in controlling technical means of monitoring. It is enforced by the works council – and the works council can actually prevent commissioning.
In practice, the second hurdle is the higher one. A supervisory authority usually examines only upon a complaint. A works council that has not been involved stops the project immediately.
When does Section 87(1) no. 6 BetrVG apply?
The provision covers the introduction and use of technical equipment designed to monitor the conduct or performance of employees.
The wording sounds narrower than the way the provision is applied. According to established labour court case law, objective suitability is sufficient. A corresponding intention on the part of the employer is not required.
For a camera-equipped robot, this practically settles the question in advance: a system that moves through the establishment and records images is objectively suitable – even if it is only meant to inspect plant and nobody intends to monitor employees.
Works council co-determination is enforceable. If no agreement is reached, the conciliation committee decides.
What happens without a works agreement?
The works council can prohibit the introduction and demand that it be discontinued. Data already collected may be subject to a prohibition on use.
For a project in which the device, charging infrastructure and set-up have already been paid for, this is the most expensive moment imaginable for this realisation.
What belongs in a works agreement?
The more specific, the more robust. General assurances do not resolve the workforce's concerns and create no legal certainty.
Purpose and scope
- Description of the system and its functions
- Purpose of use, expressly delimited
- Spatially defined areas
- Time windows
Data
- Which types of data are recorded – image, thermal image, sound, position
- Retention period per type of data
- Storage location
- Persons with access, by name or by function
- Logging of access
Exclusions
- Express exclusion of monitoring of performance and conduct
- No biometric analysis and no facial recognition
- No permanent sound recording
- Prohibition on use for personal data recorded incidentally
Procedure
- Information and instruction of employees
- Procedure in the event of breaches
- Rights of the works council when the system is changed
- Evaluation after a set period
The last point is underestimated: an agreement with an evaluation clause is easier for the works council to sign, because it remains revisable.
The right moment
Before the procurement decision, not after it.
This is not a legal recommendation but a practical one. A works council that is presented with a decision already made has only one instrument – refusal. A works council that accompanies the selection can contribute requirements and becomes an advocate.
The same applies to the occupational safety specialist and the data protection officer.
On which legal basis?
As a rule, on legitimate interest under Art. 6(1)(f) GDPR – with a documented balancing of interests.
In the employment context, Section 26 BDSG (German Federal Data Protection Act) is often relied on in addition. Its viability is, however, disputed: the Court of Justice of the European Union has ruled that national provisions on employee data protection must contain specific safeguards of their own and may not merely repeat the requirements of the Regulation. Since then, the view has been widely held that the central permission provision of Section 26 BDSG does not meet these requirements.
Practical consequence: the balancing under Art. 6(1)(f) GDPR should be viable in its own right and should not rest on national law alone.
Consent is, as a rule, not a workable route in an employment relationship – because of the relationship of dependence, it is doubtful whether it is given freely, and it could be withdrawn at any time.
When is a data protection impact assessment required?
When the processing is likely to result in a high risk to the rights and freedoms of data subjects.
Art. 35(3) GDPR expressly names the systematic monitoring of publicly accessible areas on a large scale. In addition, the supervisory authorities keep lists of processing operations for which an impact assessment must always be carried out.
For a system with changing recording areas, regular repetition and a combination of several types of sensor data, an impact assessment is indicated. The quickest way to clarify the matter is a look at the list of the supervisory authority competent for you.
The content to be worked through: a systematic description of the processing, an assessment of necessity and proportionality, a risk assessment and the planned remedial measures.
The special feature of mobile systems
The authoritative basis for interpreting camera systems is the European Data Protection Board's Guidelines 3/2019 on video surveillance. They are tailored to stationary installations – and this is precisely where the practical questions arise.
Duty to inform. With permanently installed cameras, information is given in two stages: a sign at the entrance to the area covered, with detailed information easily accessible. With a mobile system there is no defined area that could be signposted.
Practicable solutions: marking on the device itself, signs at the entrances to the areas travelled through, a notice with the plan of the inspection rounds, information via the company's channels. The procedure should be laid down in the works agreement.
Necessity. It must be assessed separately for each area. An inspection round that also passes through social, break or changing areas cannot be justified across the board – such areas should be excluded from the plan.
Retention period. For inspection data, long retention can be justified on technical grounds; for incidentally recorded images of persons, it cannot. Where the two cannot be separated, the shorter period applies – or a technical separation is needed.
Transfers to third countries
If the system transmits telemetry, diagnostic or image data to servers outside the EU, the requirements of Chapter V of the GDPR apply.
For countries without an adequacy decision, the effort is considerable: standard contractual clauses, an assessment of the legal situation in the destination country and, where necessary, supplementary safeguards. What matters is not only the server location, but also which law the provider is subject to and who has administrative access.
The most common answer from providers – an assurance about the server location – is not sufficient for this check.
Technical design as the solution
Art. 25 GDPR requires data protection by design. For inspection robotics, this means a considerable part of the problem can be solved technically instead of being managed contractually.
Timing. Inspection rounds at unstaffed times reduce the recording of personal data to a minimum. The most effective and simplest lever.
Spatial limitation. No-go zones in the navigation map for areas that are not to be travelled through.
Blurring. Automatic pixelation of persons on the device itself, before data is transmitted.
Data minimisation. No sound if it is not needed. No video recording where individual images at defined measuring points are sufficient.
Operation without an external connection. Data kept in your own network, no cloud connection, no telemetry. Eliminates transfers to third countries completely.
These measures are at the same time the most convincing arguments towards the works council – because they can be verified and do not rest on trust.
The right order in the project
- Inform the data protection officer and the works council before the procurement is decided
- Draft the plan of the inspection rounds and define the areas to be excluded
- Include the requirements for data processing in the requirements specification
- Obtain information from providers on data flows and operation without an external connection
- Carry out the data protection impact assessment
- Negotiate the works agreement
- Inform employees
- Commissioning
- Evaluation after the agreed period
Steps 1 to 6 run in parallel with the technical preparation. Anyone who works through them one after the other loses months.
Austria and Switzerland
Austria. Under the Arbeitsverfassungsgesetz (Austrian Labour Constitution Act), control measures and technical systems that affect human dignity require the consent of the works council. The system differs from German law, but the result is comparable: it cannot be done without involving the employee representatives. Under data protection law, the GDPR applies unchanged.
Switzerland. Ordinance 3 to the Employment Act prohibits systems intended to monitor the conduct of employees at the workplace. Where systems are required for other reasons, they must be designed so that health and freedom of movement are not impaired. Under data protection law, the revised Federal Act on Data Protection applies, not the GDPR – with partly different requirements for the register of processing activities and the impact assessment.
Before commissioning
- Works council informed before the procurement decision
- Data protection officer involved
- Plan of the inspection rounds with excluded areas available
- Necessity documented for each area
- Legal basis determined, balancing of interests documented
- Need for an impact assessment checked against the supervisory authority's list
- System's data flows confirmed in writing by the provider
- Operation without an external connection checked and demonstrated in the acceptance test
- Retention periods defined per type of data
- Information concept for employees in place
- Works agreement concluded
- Record of processing activities updated
This checklist will be offered as a download once the template exists.
Sources
- Regulation (EU) 2016/679 (General Data Protection Regulation) European Union accessed 15 August 2026
- Bundesdatenschutzgesetz Bundesministerium der Justiz accessed 15 August 2026
- Betriebsverfassungsgesetz Bundesministerium der Justiz accessed 15 August 2026
- Guidelines 3/2019 on processing of personal data through video devices European Data Protection Board accessed 15 August 2026
- Listen der Verarbeitungsvorgänge mit Pflicht zur Datenschutz-Folgenabschätzung Data protection supervisory authorities of the German federal states accessed 15 August 2026
- Arbeitsverfassungsgesetz Rechtsinformationssystem des Bundes (Austria) accessed 15 August 2026
- Verordnung 3 zum Arbeitsgesetz Fedlex (Switzerland) accessed 15 August 2026
Change log (1)
- 5 October 2026 Initial publication First publication of the English version.