Privacy law requirements for ranking lists

Article by Dr. Michael Schmidl, LL.M. Eur. (Rechtsanwalt/Maître en Droit), published by BNA International in World Data Protection Report 06/09, p. 23 - 27.

It could be regarded as a consequence of the current economic crisis that more and more companies intend to introduce mechanisms of measuring the performance of their employees. There is the possibility of counting the hours an employee is present at work, the number of calls made for example by a call centre agent, the number of pieces of work produced by an industry worker or the number of new clients and the turnover produced by a sales employee.

Measuring performance of employees is the basis of comparing them. An increasingly popular method of comparison is based on a so-called “ranking list”. Such lists consist of a table of employees ranked in accordance with the percentage of fulfilment of performance criteria defined by the employer. Creating and publishing a ranking list not only leads to the collection, processing and use of personal data but might also impact on the ambience within a company.

Given the fact that an employee data protection act has not yet been created the Federal Data Protection Act (“FDPA”) has to be applied to the creation and publication of ranking lists containing personal data of employees (I). In the light of its limitations, employee consent cannot serve as justification for the creation and publication of ranking lists, so that statutory permissions have to be applied (II). Subject to respecting a series of criteria and precautions, the employer can legitimately create and publish ranking lists (III).

I. Applicability of FDPA to ranking lists

According to its Sec. 1 (1) it is the FDPA’s purpose to protect the individual against his right to privacy being impaired through the handling of his personal data. It may well be seen differently as to what forms of handling of personal data are apt to harm an individual’s right to privacy. The FDPA chose a rather technical approach and according to its Sec. 1 (2) no. 3 is inter alia applicable to the collection, processing and use of personal data by private bodies in so far as they process or use data by means of data processing systems or collect data for such systems, process or use data in or from non-automated filing systems or collect data for such systems, except where the collection, processing or use of such data is effected solely for personal or family activities. The creation of a ranking list that is based on more than just a few performance indicators requires a substantial amount of data. Such data might either be stored in and retrieved from a separate computer system dedicated to the use for the ranking list or be directly taken from the company’s enterprise resource planning software, such as Oracle or SAP. In both cases the data used as performance indicators are either processed or used by means of a data processing system or at least collected for such systems. The creation and publication of ranking lists therefore falls into the FDPA’s scope of applicability, even if the resulting lists are only available as print-outs to the employees concerned.

According to Sec. 3 (1) FDPA, personal data are defined as any information concerning the personal or material circumstances of an identified or identifiable individual, referred to as the data subject. Ranking lists contain a multitude of personal data. There is at least the name, the relevant key performance indicators and the resulting ranking. In some cases, employers use pseudonyms instead of their employees’ real names. Using a pseudonym instead of a real name might in some companies lead to rendering the employee impossible to identify. This could occur, for example, with a ranking list containing a great number of employees who do not have social contacts, do not work in the same location or due to other circumstances will most likely never learn which pseudonym “belongs” to which employee. In practice employers do frequently prefer using real names in order to establish a concrete competition between “real” employees and not just between “employee_#4711” and “employee_#0815” and the like. Moreover, using pseudonyms does not eliminate privacy laws, since pseudonymised data is not the same as anonymous data. According to Sec. 3 (6) FDPA rendering data anonymous means the modification of personal data so that the information concerning personal or material circumstances can no longer or only with a disproportionate amount of time, expense and labour be attributed to an identified or identifiable individual. Using anonymous data would not fulfil the purpose of a ranking list.

Eventually, according to Sec. 1 (2) no. 3 FDPA it is required for the application of the FDPA that personal data are collected, processed or used. For the creation and publication of a ranking list, personal data needs to be collected or, if pre-existing data is used, retrieved from the company’s enterprise resource planning systems, and filtered in a way as to show the rank of each individual employee according to certain key performance indicators. According to Sec. 3 (3) - (5) FDPA these steps of data handling constitute the collection, processing and use of personal data.

II. Available statutory permissions

According to Sec. 4 (1) FDPA the collection, processing and use of personal data shall be admissible only if permitted or prescribed by the FDPA or any other legal provision or if the data subject has consented. Although expressly mentioned, employee consent cannot be recommended as the basis of creating and publishing ranking lists. Employee consent is normally not given voluntarily and therefore void according to Sec. 4a (1) 1st sentence FDPA. Furthermore it can be revoked at any time and thus is no reliable basis for a ranking list. Statutory permissions are therefore the better choice. Possible statutory permissions for creating and publishing ranking lists are Sec. 28 (1) 1st sentence no. 1 FDPA (i.e. if creating and publishing the ranking list is in accordance with the purpose of the employment contract) and Sec. 28 (1) 1st sentence no. 2 FDPA (i.e. if creating and publishing the ranking list is a legitimate means of reaching a justified interest of the employer).

The admissibility based on Sec. 28 (1) 1st sentence no. 1 FDPA would require that creating and publishing ranking lists is in accordance with the purpose of a contract or fiduciary relationship between the employer and the employee, i.e. in accordance with the employment contract. Sec. 28 (1) 1st sentence no. 1 FDPA requires a direct connection between intended use of the data and the concrete purpose of the contract. The purpose must either result directly from the contract or be the outcome of an analysis of the entire content of the contractual relationship between the parties. What counts in other words is the objectively defined purpose of the contract, which all contractual parties agree with. On the basis of this definition of the purpose of the contract, it is not possible to unilaterally enlarge the scope of a contract, even in cases where one party has legitimate (but still unilateral) interests. This restrictive approach is even more important in the light of the few criteria otherwise required by Sec. 28 (1) 1st sentence no. 1 FDPA. As a rule this understanding of Sec. 28 (1) 1st sentence no. 1 FDPA does not cover the creation and publication of ranking lists; the “normal” employee will not perceive the continuous comparative analysis as the purpose of his employment contract. This evaluation might change in cases where the (initial or amended) employment contract is tailored to enable the continuous and comparative analysis of employees. Subject to additional admissibility criteria (see below) and employment law specifics, such purpose of an employment contract could for example be reached by explicitly mentioning ranking lists and by offering regular feedback meetings and incentives for reaching certain goals. Given the fact that ranking lists lead to making performance related information known within a group of employees the employment contract should also mention a certain form of competition as one of its purposes, since the mere analysis of employee performance could also occur without publishing the comparative performance information.

Creating and publishing a ranking list can be admissible according to Sec. 28 (1) 1st sentence no. 2 FDPA in so far as this is necessary to safeguard justified interests of the controller of the filing system (i.e. the employer) and there is no reason to assume that the data subject has an overriding legitimate interest in his data being excluded from processing or use in the framework of a ranking list:

  • Justified interest: The FDPA is not overly strict when it comes to acknowledging a justified interest. Economic or idealistic interests suffice. Normally the employer will have the justified interest to increase his employees’ will to perform, their motivation and thus eventually the economic success of the company.
  • Necessary: The planned measure, i.e. the ranking list, furthermore needs to be necessary to safeguard the justified interests. Strictly speaking the term “necessary” implies that there must not be any other means by which the justified interests could be reached but which would be less invasive as regards the employees’ right to privacy. For a measure to be “necessary” in the sense of Sec. 28 (1) 1st sentence no. 2 FDPA the prevailing opinion in Germany, however, only requires that it would not make sense for the controller (i.e. the employer) from an economic point of view if the controller (i.e. the employer) refrained from implementing it. As regards ranking lists, it is already questionable whether there would be any other means by which the justified interests could be reached but which would be less invasive as regards the employees’ right to privacy. At least, however, it is perceivable that an employee may justifiably argue from his point of view that in light of the motivational potential of a ranking list it would economically not make sense to refrain from implementing it.
  • No overriding legitimate interest: The words “and there is no reason to assume that the data subject has an overriding legitimate interest in his data being excluded from processing or use” require a weighing of interests between the employer’s justified interest on the one side and the employees’ legitimate interests on the other. Such weighing of interests must not be limited to juxtaposing the employer’s and the employees’ interests. It is required to weight each side’s interests and to especially take into account the degree of exposure for the respective legally protected positions:
    • It is the employer’s interest to increase the employees’ motivation to perform and thus the company’s economic success.
    • It could be the interests of the employees not to make a (passing or permanent) performance weakness known within the respective sales department. Employees having a bad ranking or not showing in the listing scope (e.g. only a certain percentage of the employees are listed) of the ranking list at all could face discriminatory or depreciatory remarks from their peers. The concerned employees’ interest to be protected against such effects has special importance if there is the possibility that an underperformance attributable to them leads to disadvantages for the entire (sales) department. Such scenario is perceivable, if the (sales) department becomes the subject of restructuring considerations as a consequence of such underperformance.
    • It would also be possible that certain particularly successful employees are not willing to tell the team about their success or that they face sarcasm and mockery should they lose a once-achieved top ranking.

In view of these possible collisions of interests, the weighing of interests usually leads to the inadmissibility of creating and publishing ranking lists unless the employer provides for compensatory measures.

III. Criteria for the admissibility of creating and publishing ranking lists

The creation and publication of ranking lists can nevertheless be admissible according to Sec. 28 (1) 1st sentence no. 2 FDPA if the employer respects certain criteria and adopts certain measures in order to influence the outcome of the weighing of interests. The following list of criteria and measures can render the creation and publication of a ranking list admissible from a privacy law point of view:

  • Choose objectively justified and comparable evaluation criteria: The criteria on the basis of which the ranking list is established must be objective and understandable. The correct selection of evaluation criteria certainly requires a case-by-case decision. It is for example important that some of the ranked employees are not burdened with additional (i.e. more than the others) tasks, the execution of which are not taken into account for determining their rank in the list.
  • Choose objectively comparable sales regions or sets of tasks: The sales regions or set of tasks of the respective employees must form a just and objectively comparable basis for fulfilling the evaluation criteria, which are decisive for the position in the ranking list. It might be required to provide for multiples for achievements, with a smaller absolute value, but which have been reached under extraordinarily difficult circumstances. Two turnover values might therefore have to be counted equally, if the lower one was obtained in a tremendously difficult and the higher one in a relatively favourable environment.
  • Neutralise factors, which cannot be influenced: Factors, which cannot be influenced by the ranked employees (e.g. part-time work) must not be taken into account or must be neutralised for the process of placing the employees in the ranking list.
  • Limiting the percentage of employees listed: The ranking list should be limited to the best third (i.e. 33.3 percent of the sales force eligible for a place in the ranking list) of the analysed employees. This number was mentioned by the Bavarian data protection authority when consulted with regard to the criteria for a permissible setup of a ranking list.
  • Publication only within the sales force concerned: The ranking list must not be made accessible to the entire company or to employees from other group companies. The publication must be limited to those employees who are to be placed in direct comparison with each other by means of the ranking list. Additionally the respective employees must receive the binding order not to distribute the ranking list outside the concerned group of employees.
  • Grant the right to object to being put on the ranking list: Employees must participate voluntarily (please note: the initial participation is decided by the employer but the decision to stay in the process must be a voluntary one) in the comparative evaluation of their performance. They should be granted the right to object at any time, without giving reasons and with effect for the future to the initial inclusion in the ranking list and to the future listing.
  • An objection should not be questioned: The respective superiors should receive the binding instruction not to question the employees for the reason for the objection. Should there be a practice of scrutinising the employees’ decision to object to the initial inclusion in the ranking list and to the future listing, their remaining in the ranking list could hardly be regarded as voluntary. The employees concerned should be informed about this binding instruction to their superiors, in order to underline that taking part (to be understood as the decision to stay part of the process) in the ranking list scheme is entirely voluntary.
  • An objection should not be sanctioned: The respective superiors should receive the binding instruction not to treat the objecting employee any differently from other employees. The employee who decided to object to the initial inclusion in the ranking list and to the future listing must not be sanctioned. The employees concerned should also be informed about this binding instruction, in order to underline that taking part (to be understood as the decision to stay part of the process) in the ranking list scheme is entirely voluntary.
  • Transparent information: Prior to the first creation and publication of a ranking list, the employees concerned have to be informed in a transparent manner about the planned measure, to implement a ranking list, by means of which the employees enter into a voluntary competition with one another. Such information should at least comprise the following:
    • Name and explanation of the evaluation criteria
    • Name and explanation of the sales regions or sets of tasks
    • Explanation on how factors are treated, which the employee cannot influence (e.g. part-time work)
    • Explanation of the limitation of the ranking list to the best third of the employees concerned while mentioning that as a consequence of objections employees might appear in the ranking list who do not objectively form part of the best third
    • Binding instruction to employees not to distribute or otherwise make accessible the ranking list outside the group of employees concerned by the ranking list
    • Clear information regarding:
  • the right to object,
  • how to object and the effect of an objection,
  • the binding instruction to the superiors not to question the reasons for an objection,
  • the binding instruction to the superiors not to treat the objecting employee any differently from other employees and not to sanction such employee.
  • Shop agreement with the works council: The creation and publication of a ranking list will most likely be based on technical installations according to Sec. 87 (1) no. 6 Works Council Constitution Act, which are apt to monitor the employees’ behaviour and performance so that the works council (if any) has a co-determination right. It is recommended to try and make positive use of the shop agreement’s function as “other legal provision” according to Sec. 4 (1) FDPA in order to render the creation and publication of ranking lists admissible or to at least create a favourable framework for the ranking lists.

Eventually it is important to consult the company’s data protection officer since the creation and publication of a ranking list is subject to the data protection officer’s prior control according to Sec. 4d (5) 2nd sentence no. 2 FDPA. According to Sec. 4d (5) 1st sentence FDPA in so far as automated processing operations involve special risks for the rights and liberties of the data subject, they are subject to examination prior to the beginning of processing (prior checking). According to Sec. 4d (5) 2nd sentence no. 2 FDPA prior checking is to be carried out in particular when sensitive data according to Sec. 3 (9) FDPA are to be processed or the processing of personal data is intended to appraise the data subject’s personality, including his abilities, performance (which is the explicit purpose of a ranking list) or conduct. Prior control is not required if a statutory obligation applies, the data subject’s consent has been obtained or the collection, processing or use serves the purposes of a contract or a quasi contractual fiduciary relationship with the data subject. These exceptions usually do not apply. Prior control is not necessary, however, in a company where the creation and publication of a ranking list has been made a contract purpose (see above), since then the collection, processing or use of personal data required for the ranking list would serve the purposes of a contract.

Summary

The creation and publication of a ranking list requires the collection, processing and use of personal data. As a consequence of Sec. 4 (1), Sec. 1 (2) no. 3, Sec. 3 (3)–(5) FDPA a privacy-law related permission is required. Furthermore the evaluation of the employees’ performance by means of a ranking list, as a rule, requires the execution of a prior control in accordance with Sec. 4d (5) 2nd sentence no. 2 FDPA by the company’s data protection officer.

Employee consent (Sec. 4, 4a FDPA) is not an option in employment relationships since according to the prevailing opinion it is not given voluntarily and would therefore be void. Ranking lists do not serve the purpose of the employment contracts as required by the statutory permission contained in Sec. 28 (1) 1st sentence no. 1 FDPA, at least as a rule, unless they are specifically tailored to enable continuous comparative analyses including the publication of comparative information in the respective peer groups. Also by means of interpreting the employment contracts’ content it is usually impossible to argue that the comparison of employees organised and published by the employer corresponds with the expectation the employees had when entering into the contracts.

Creating and publishing a ranking list can nevertheless be possible based on a justified interest of the employer (increasing economic success) and the taking into consideration of the contrary interests of the employees (avoiding discrimination and making underperformance known by peers) by means of a weighing of interests according to Sec. 28 (1) 1st sentence no. 2 FDPA, provided the employer adopts certain mitigating measures, such as by (i) choosing objectively justified and comparable evaluation criteria, (ii) objectively comparable sales regions or sets of tasks, (iii) neutralising factors, which cannot be influenced by the employees, (iv) limiting the percentage of employees listed in the ranking list, (v) publishing the ranking list only within the sales force concerned, (vi) granting the employees the right to object to being put on the ranking list, (vii) instructing superiors not to question objections and not to sanction employees who have objected to the initial inclusion in the ranking list and/or to the future listing and (viii) providing transparent information about all relevant factors and mitigating measures.

The creation and publication of a ranking list will most likely be based on technical installations according to Sec. 87 (1) no. 6 Works Council Constitution Act, which are apt to monitor the employees’ behaviour and performance so that the works council (if any) has a co-determination right. It is recommended to try and make positive use of the shop agreement’s function as “other legal provision” according to Sec. 4 (1) FDPA in order to render the creation and publication of ranking lists admissible or to at least create a favourable framework for the ranking lists.

Get advice now

Call-back service

 

Arrange a consultation