Virtual site visits save time and money for national and particularly international companies and investors. Due in no small part to the coronavirus pandemic, travel and border crossings have become a burden in corporate labor practice, even within the European Union. As a result, virtual site visits are a welcome alternative to in-person meetings for many companies. But in an age of progressive digitization, this development also involves a wide range of challenges, particularly from the viewpoint of data protection law.
Challenges in data protection law in connection with virtual site visits
Virtual tours of production sites also typically involve the processing of personal data (only in German), so that the General Data Protection Regulation (GDPR) applies. Employee data may be processed during virtual tours e.g. if employees are filmed in the background performing their work. Even if the processing of employee data is not the focus of the virtual site visit, a legal basis is required from the viewpoint of data protection law. One challenge in this regard that, under Germany’s Federal Data Protection Act, employee data may only be processed if such processing is necessary for conduct of the employment relationship (§ 26(1) of the Federal Data Protection Act) (only in German). That is typically not the case when processing the personal data of employees who are not participating in the virtual site visit. The only option which remains, in most cases, is for the employer to obtain the consent of the affected employees. The lawfulness of this consent depends heavily on the circumstances of the individual case, so that a detailed legal analysis must be performed in advance in each case. On the other hand, the processing of data for employees who actively participate in the virtual site visit should be easier to justify in this analysis.
Since virtual site visits are frequently international in character, the questions as to the lawfulness of third-country data transfers may also be raised, in the context of the ECJ’s “Schrems II” decision. Transfers to the US in particular may create challenges, so that immediate action is urgently advised. The issue of third-country data transfers may be raised even if the software used for the virtual tour is from an American video conferencing provider. It should also be kept in mind in this regard that the recent questionnaires sent out by German data protection authorities specifically address the exchange of employee data within corporate groups as well.
Challenges posed by the Trade Secrets Act
As attractive as virtual site visits may be for those involved, companies should take special precautions in advance to ensure the protection of company information in accordance with the Trade Secrets Act (only in German). Trade secrets may be violated e.g. if whiteboards are visible in the background which contain internal information or information about the products of other business partners. Therefore, virtual tours require careful preparation and extensive analysis of actual conditions at the locations where the filming will be taking place, as well as changes to the measures taken by the company for the protection of confidential information, if necessary.
Outlook and future developments
Particularly during the coronavirus pandemic, virtual site visits offer companies a good way to view sites quickly and without complications. Whether this trend will continue in the coming years remains to be seen given that the associated legal requirements should not be underestimated, similar to the case for the trend of employees working from home. In any case, companies which offer virtual site visits should perform a detailed analysis of the potential legal risks and actual conditions in order to ensure that they stay on the safe side with regard to data protection and the protection of trade secrets.
back