AI Employee Monitoring and Works Council Co-Determination

A company completes a DPIA, picks a lawful basis, signs a processor agreement, and finds the deployment blocked anyway. The blocking instrument is not the GDPR. It is a labour statute that predates it by decades and does not care what your lawful basis is.

Two regimes, one rollout

The GDPR governs whether you may process an employee’s personal data. National collective labour law governs whether you may introduce the system that does the processing. These are separate questions decided by separate bodies under separate tests, and satisfying one does not touch the other. Article 88 of the GDPR expressly leaves room for the second: member states may provide more specific rules for employment processing, including by collective agreement.

The second trap is employee consent. Recital 43 treats consent as unlikely to be valid where there is a clear imbalance between the parties, and supervisory authorities have applied that to the employment relationship as a near-presumption. So the reflex of collecting a signed consent form from each employee is usually the weakest available answer under the GDPR, and it is not an answer at all to co-determination — a works council right belongs to the council as a body, and individual employees cannot waive it on the employer’s behalf.

Germany: BetrVG §87(1) no. 6

The provision to read is section 87(1) no. 6 of the Betriebsverfassungsgesetz, published at gesetze-im-internet.de. Where a works council exists, it has a co-determination right in respect of the introduction and use of technical devices designed to monitor the behaviour or performance of employees.

Two features make this far broader than it sounds. The German federal labour court has long read “designed to” as objective suitability rather than employer intention: if the system is capable of producing behaviour or performance data, the right is engaged even where monitoring was never the purpose. Almost any AI tool that logs per-user activity meets that description. And co-determination is not consultation. It is a right of joint decision: without agreement, the matter goes to a conciliation committee whose decision replaces the agreement, and a system introduced without either can be restrained.

The 2021 Works Councils Modernisation Act added AI-specific hooks alongside it. Section 80(3) BetrVG treats the involvement of an expert as necessary where the council has to assess artificial intelligence; section 90(1) no. 3 brings the introduction of AI into the employer’s duty to inform and consult on workplace design; and section 95(2a) applies the selection-guidelines rules where AI is used in personnel decisions. The practical consequence is a budgeted external expert and a longer timeline, not a veto — but a timeline that was not in the project plan.

One further wrinkle on the GDPR side. Germany’s employment provision, section 26 BDSG, was thrown into doubt by the Court of Justice in Case C-34/21, decided on 30 March 2023, which held that a national provision merely reproducing the conditions already in Article 6(1) is not a valid specification under Article 88(2). Since then the relationship between works agreements and the GDPR has been unsettled: a works agreement can supply the more specific rules Article 88 contemplates, but it cannot lower the Regulation’s floor. Do not treat a signed works agreement as curing a lawful-basis problem.

The Netherlands: WOR article 27

The Dutch instrument is the Wet op de ondernemingsraden, published at wetten.overheid.nl. Article 27(1) lists the decisions for which the employer needs the works council’s consent — instemmingsrecht, a genuine approval right rather than a right to be heard. Two entries in that list catch AI monitoring: the entry covering arrangements for the processing and protection of the personal data of persons working in the undertaking, and the entry covering arrangements for facilities aimed at or suitable for observing or monitoring the presence, behaviour or performance of those persons.

“Aimed at or suitable for” is the same objective-capability test as the German one, and it produces the same surprise: a productivity analytics dashboard, a call-quality scoring model or a code-assistant deployment that reports per-developer usage is within scope regardless of the stated purpose. A decision taken without consent, and without substitute approval from the sub-district court, can be declared void on the council’s invocation. That is a nullity remedy, not a fine, and it is the reason Dutch rollouts get reversed rather than penalised.

France: CSE consultation

France uses information and consultation of the comité social et économique rather than co-determination. The Code du travail, published at Légifrance, requires the CSE to be informed and consulted on questions affecting the organisation, management and general running of the undertaking, and specifically before the introduction of new technologies and of any means or technique permitting control of employees’ activity. The obligation is to consult before the decision is implemented, with the information the CSE needs to give a reasoned opinion, and within the statutory or agreed time limits.

The opinion does not bind the employer. What bites is procedure: deploying before the consultation is complete is a recognised route to an interim injunction suspending the system, and in France the failure to consult can also be charged as the offence of délit d’entrave. A monitoring system whose output is used in individual decisions must additionally have been disclosed to the employees concerned, and the French courts have refused to admit evidence gathered by an undisclosed monitoring device in disciplinary proceedings — meaning a procedurally defective rollout can also destroy the usefulness of the data it collected.

The AI Act layer on top

Two provisions of Regulation (EU) 2024/1689 sit on top of all of this and apply on their own timetable rather than the GDPR’s.

Article 5(1)(f) prohibits placing on the market, putting into service or using AI systems to infer emotions of a natural person in the workplace and in education institutions, save for medical or safety reasons. The prohibitions in Article 5 applied from 2 February 2025. That is a ban, not a consultation requirement: no works agreement and no employee consent makes a workplace emotion-recognition deployment lawful. See the emotion recognition ban.

Article 26(7) requires deployers who are employers, before putting a high-risk AI system into service or use at the workplace, to inform workers’ representatives and the affected workers that they will be subject to its use. Annex III includes employment, workers management and access to self-employment, so recruitment, task allocation, monitoring and evaluation systems are in scope; see the Annex III employment category and the deployer obligations. This duty is additive. It does not replace co-determination, and co-determination does not satisfy it.

The sequencing that avoids the worst outcome is unglamorous: engage the council or the CSE before the vendor is selected, not after the contract is signed. Councils have repeatedly used the vendor choice itself as leverage precisely because they were presented with a fait accompli, and the retention settings, the granularity of per-user logging and the availability of an aggregate-only mode are all things a buyer can negotiate before signature and cannot after.