MK v K GmbH (C-65/23): No loophole for employees’ data protection under Article 88 of the GDPR

Abstract

This paper analyses the CJEU judgment of MK v K GmbH (C-65/23) on the interpretation of Article 88 of the GDPR, which governs data processing in the context of employment. This ruling has clarified the interplay between Article 88 and the general principles of the GDPR, reaffirming that national laws and collective agreements providing “more specific rules” for the purposes of Article 88 must still comply with the general principles, namely Articles 5, 6, and 9 of the GDPR. Firstly, and most notably, it is the first time that the Court has evaluated a collective agreement under Article 88 of the GDPR, clarifying that they cannot be used to shorten employees’ data protection but they must, like national rules, meet all the requirements set in the GDPR. Moreover, the Court established that national courts must carry out a full judicial review in determining whether the processing of personal data provided by collective agreements is necessary. By affirming that the general principles of the GDPR are mandatory under all circumstances, this judgment strengthens employees’ data protection and prevents collective agreements or national laws from lowering EU data protection standards. A further side effect of this ruling is promoting consistency and fairness in workplace data processing. Overall, MK v K GmbH confirms that employee data protection must remain fully aligned with the GDPR's overarching goals.