The European Union has already adopted regulations to combat terrorism some time ago (Regulation (EC) No. 2580 / 2001 and Regulation (EC) No. 881 / 2002) issued (hereinafter also: regulations). These regulations prohibit, among other things, all companies operating in the European Union from maintaining business contacts with certain people and from making financial resources available to them. As a result, no wages may be paid to employees who are on the terrorist lists (prohibition of provision). Violation of these requirements can be punished with imprisonment or a fine. At first glance, it seems advisable to simply stick to the guidelines. Unfortunately, the so-called terrorist list screening is not unproblematic in terms of data protection. The following article is intended to provide a brief legal overview and concrete recommendations for action in the “Short Articles” series.
1. WHAT IS A COMPANY THREATENED IF FAILURE TO PERFORM TERROR LIST SCREENING?
The mere non-implementation is not critical in itself. There is no legal obligation to carry it out. It only becomes a problem when wages are paid to a person who is on the lists (also: sanctions lists). This can, for example, be the result of a screening not being carried out. The regulations refer to national criminal and fine regulations. If the provisions of the regulations are violated, there is a risk of criminal or regulatory consequences (§§ 17, 18, 19 AWG, §§ 130, 30 OWiG): According to the Foreign Trade Act (AWG), an intentional violation of the ban on provision is punished with a prison sentence of three months to five years; negligent actions can result in fines of up to EUR 500.000,00. This particularly affects the senior employees responsible for payments and authorized representatives of the company. In addition, if the necessary supervisory measures are not taken, there is a risk of fines for business owners, authorized bodies, boards of directors, managing directors and shareholders authorized to represent them, see Sections 130 and 30 OWiG.
2. REQUIREMENTS OF THE GDPR
There should be no doubt about the fundamental right of employers to carry out employee screenings. Companies face serious disadvantages if they do not adhere to the requirements (fines, penalties, etc.).
Pursuing legitimate interests Art. 6 Paragraph 1 Letter f) GDPR ?
A suitable legal basis for screening by companies is Article 6 Paragraph 1 Letter f). GDPR into consideration. In these cases, the employer's legitimate interest is to avoid disadvantages or sanctions. As explained above, this threatens if a screening is not carried out and the resulting provision of compensation to people who are on the sanctions lists. The affected employees must be informed accordingly before implementation Art. 13 GDPR have been informed. It is possible that the screening can also be carried out by another service provider as part of commissioned data processing.
Uncertainty caused by supervisory authorities?
Since the above regulations themselves do not impose an obligation to screen employees, the admissibility of such screenings remains controversial. The supervisory authorities sometimes criticize such employee data comparisons. However, these are also viewed as permissible under data protection law, particularly with regard to customs practice (cf. 32nd activity report of the LfDI BW 2014/2015, p. 146 f.). As a result, the better arguments speak for the permissibility of employee screening under data protection law. However, companies are still well advised if they also comply with the general data protection requirements (information, purpose limitation, data minimization, storage limitation, etc.).
3. LABOR LAW DIMENSION
Do the regulations impact the employment relationship? There are no explicit provisions on labor law consequences in the regulations. However, the above-mentioned ban on provision affects the core area of the employer's obligations: the payment of remuneration. For this reason, there may also be consequences for the employment relationship.
Invalidity of the employment contract
The employer may not pay remuneration to an employee who is on a sanctions list. The employment contract is therefore invalid due to the resulting violation of the Minimum Wage Act (cf. Civil Code § 134 iVm § 3 MiLoG). In the case of an already ongoing employment relationship, the ineffectiveness generally only occurs with effect for the future. As a result, wages that have already been paid do not need to be paid back.
Challenge or termination by the employer?
A person who appears on the sanctions lists will be informed of this fact by the executive branch of the European Union. Therefore, one can generally assume that an employee is aware of this. If this is already the case when the contract is concluded, the employer will challenge it due to fraudulent misrepresentation (cf. § 123 BGB) into consideration. Here too, the legal consequences are basically a termination with effect for the future (as before).
The employer will also regularly be able to issue dismissal for personal reasons. In most cases, such a termination will be socially justified in the sense of § 1 KSchG. Because the employee concerned can no longer receive remuneration due to the ban on provision.
4. RECOMMENDATIONS FOR ACTION
In compliance with the general data protection requirements, companies should carry out employee screenings before concluding an employment contract and also during an ongoing employment relationship.
In the event of a positive data comparison, employers should:
- Do not hire/no longer employ the employee,
- Stop all payments,
- As a precautionary measure, challenge or terminate the employment contract,
- Check whether any remuneration that has already been paid can be reclaimed.
