A new time recording system, an order app for field service, vehicle tracking, a report on lead times: as soon as a company with a works council introduces software that produces data about people, it stops being a purely technical matter. The German Works Constitution Act ties codetermination to a condition that is regularly underestimated in practice: what counts is not whether anyone intends to monitor staff, but whether the system would be capable of it. This article sets out which systems in mid-size companies are affected, what is actually negotiated for time recording and vehicle tracking, why early involvement speeds a project up rather than slowing it down, and what ends up in a works agreement. It is not legal advice; assessing a specific case belongs with a lawyer. It does show which documents a company needs anyway — much of it already emerges from a process analysis.
Key takeaways
- Under Section 87(1) no. 6 of the Works Constitution Act the works council has a say on technical devices designed to monitor behaviour or performance; settled case law holds that objective suitability is enough, and no intention has to be shown (Federal Labour Court).
- In mid-size companies this covers almost every project involving personal data: time recording, vehicle tracking, feedback from an order app, handheld scanner postings in the warehouse, and any report that can be filtered down to a single person.
- For working time recording the whether is settled by the employer's statutory duty; the how remains subject to codetermination — recording method, rounding rules, corrections, level of detail in reports, access rights and retention (Federal Labour Court).
- Informing the council during the planning phase under Section 90 of the Works Constitution Act means negotiating over a draft rather than over a system already in use, and avoids the expensive loop of objection, renegotiation and restart.
- The usual outcome is a works agreement setting out purpose, the data types collected, permissible evaluations, retention periods, access roles and a procedure for later extensions of the system.
What the law requires — and why suitability is enough
The decisive sentence sits in Section 87(1) no. 6 of the Works Constitution Act. It gives the works council a right of codetermination on the introduction and use of technical devices designed to monitor the behaviour or performance of employees. Two phrases carry the entire practice. „Introduction and use“ means that not only the purchase but every later change during operation is covered. And „designed to“ is where most misunderstandings begin.
According to settled case law a technical device is already „designed to“ monitor if it is objectively capable of producing statements about the behaviour or performance of individual employees (Federal Labour Court). Suitability alone is enough — whether the employer intends such an evaluation, rejects it, or has switched the function off makes no difference. „But we do not evaluate that at all“ is therefore not an argument against codetermination; at best it is an offer inside the negotiation.
In practice that means: a system that signs people in with a personal account, logs transactions with a timestamp and stores those logs in an evaluable form will as a rule meet the test. Yet those three properties are exactly what is technically necessary — for traceability, for access control, for troubleshooting. Codetermination cannot be designed away without making the system useless. It is more sensible to plan for it.
What counts as a „technical device“
Which systems in mid-size companies are affected
In trades, manufacturing, logistics and administration it is rarely the spectacular cases. A company with 60 employees does not install camera surveillance, but it moves paper timesheets to a terminal, gives fitters an app for feedback and has a monthly report generated on open orders. Each of those three steps touches codetermination, and all three proceed without involvement if nobody thinks of it.
A simple test question before selection helps: does the system produce data that can be attributed to a particular person, and can something about that person's way of working be read from it? If both apply, plan for involvement. The following overview lists the systems that keep turning up in projects and the point at which negotiation usually happens.
| System | Why it triggers codetermination | Typical point of negotiation |
|---|---|---|
| Time recording | Start, end and breaks per person | Rounding, correction path, level of detail |
| Vehicle tracking | Location and time can be linked to the driver | Recording window, precision, who has access |
| Field service order app | Status messages with a timestamp per fitter | Mandatory fields, inferences about work pace |
| Ticket or enquiry system | Handling time per agent becomes visible | Rankings, reporting at team level only |
| Warehouse handheld scanner | Postings carry a user ID and a time | Personal versus shared user IDs |
| Metrics and reports | Reports can be filtered down to a person | Minimum group size, filters disabled in the tool |
| Phone system with call records | Call duration per extension | Retention, grounds for individual analysis |
The list is not exhaustive and does not replace a proper assessment. It does make clear that the question is not whether a project is affected but when involvement is scheduled. In practice that is the difference between one meeting during preparation and a dispute after go-live.
Time recording: the whether is settled, the how is not
Working time recording is the most frequent trigger — and the most thoroughly misunderstood. The Federal Labour Court has held that employers are obliged under the Occupational Safety Act to introduce a system for recording working time (Federal Labour Court). Where a statutory duty exists there is nothing to codetermine: the whether is fixed, and the works council can neither block the introduction nor force it on its own initiative.
Codetermination does not end there, it shifts. The council negotiates the how, not the whether. And the how is extensive: which technology records, where recording happens, how forgotten postings are handled, which evaluations are produced and who may see them. These are precisely the questions that a rollout has to settle anyway — involvement merely gives them structure.
Working through the points before the first meeting shortens the negotiation considerably. The list below covers what works agreements on time recording tend to regulate.
- Recording method and location: terminal at the entrance, application on the workstation, handheld device or mobile capture — and whether recording happens away from company premises.
- Rounding and capping: whether times are rounded, in which direction, and how presence before the official start of work is treated.
- Correction procedure: who may change a posting, whether the original posting stays visible, and how the person concerned learns about the change.
- Reports: which reports exist, at what level of aggregation, on what cycle and who may retrieve them.
- Individual analysis on cause: under what conditions a person-level analysis is permitted, who is involved and how it is documented.
- Retention: how long raw data is kept, when it is condensed into monthly figures and when it is deleted.
- Outages: what applies if the system fails, how times are recorded afterwards and who approves that entry.
Vehicle tracking: fleet data is personal data
Tracking systems in vehicles have solid operational reasons: dispatching at short notice, proving arrival times to clients, recovering stolen vehicles, analysing empty runs. What matters legally is not the purpose but attributability. As long as it can be reconstructed who drove a vehicle at a given time — and the tour plan makes that possible almost throughout — location data is behavioural data.
So the negotiation is less about the system than about its limits: recording only during working hours, switch-off during approved private use, a sampling interval instead of a seamless movement profile, retention of raw data, a narrow circle of access in dispatch, and an explicit ban on using movement data for performance assessments or warnings. Many systems allow such limits to be set technically — which is more robust than a promise in the text of the agreement.
Alongside codetermination, employee data protection applies. Purpose limitation, necessity and transparency are independent requirements and are not satisfied simply because the works council agreed. Conversely, a data protection assessment does not replace involvement. The two run in parallel, and both belong in the same project plan.
Two points that fleets frequently overlook
Reporting: when process data turns into performance data
Metrics are where well-intentioned digitisation most easily tips over. Lead time per order, share of returns, handling time in the service process: professionally these are statements about a workflow. As soon as the underlying report allows a filter on the person handling the case, it becomes a statement about people. That line runs not through the purpose of the report but through its operability — which is why it belongs in the design of metrics and reporting.
A team-level report is not automatically harmless. In a team of three, the team figure becomes an individual figure once two values are known. Nor does a promise not to use the filter help: what matters is what the tool makes possible. The four building blocks below have proved themselves in agreements because they can be verified technically rather than merely promised.
Set a minimum group size
Reports only display once a group contains an agreed number of people; below that the figure stays empty. This prevents back-calculation in small teams and can be configured in the reporting tool.
Remove filters technically
The person filter is taken out of the report or blocked for the roles concerned, not merely forbidden. What cannot be selected does not have to be policed later.
Condense raw data
After an agreed period individual postings are aggregated into weekly or monthly figures and the raw data is deleted. For steering the workflow the condensed view is usually sufficient.
Tie access to roles
Every report gets a named set of roles allowed to retrieve it, and retrievals are logged. The works council is given a right to inspect those logs.
Why early involvement speeds the project up
The common worry is that involvement costs months. That impression arises because involvement usually starts too late — once the system has been selected, paid for and partly rolled out. In that situation the works council is not negotiating over a draft but over accomplished facts, and the only remaining leverage is a halt. Precisely that makes the process slow and expensive.
The law provides for the earlier moment explicitly. Under Section 90 of the Works Constitution Act the works council must be informed in good time about the planning of technical installations, work procedures and workflows, and the measures must be discussed with it — in good time meaning early enough for its suggestions still to be taken into account. Under Section 80(2) it may request the documents needed for that. Scheduling this briefing before vendor selection costs nothing, because it is owed anyway.
Early involvement is the faster route. It also changes the role of the body: instead of an authority that approves or blocks at the end, it becomes a place where requirements are shaped — which fields should be mandatory, which reports should not be activated at all. Both are requirements on the vendor, and requirements are cheaper before selection than after it.
Step 1: describe the project
Before vendor selection: set out purpose, the areas affected, the planned data types and the reports you have in mind, on a few pages. Without that description there is nothing to discuss.
Step 2: inform the works council
Information and consultation under Section 90 of the Works Constitution Act. Hand over documents, collect questions, fix dates for the next steps. The result is a shared list of questions, not an approval.
Step 3: assess vendors together
The list of questions becomes part of the request to vendors: which data types occur, which reports ship as standard, which functions can be switched off, how does the role model work, what is logged?
Step 4: draft alongside the technical design
The draft works agreement is written in parallel with the technical concept, not after it. What is limited technically no longer has to be forbidden contractually, and the other way round.
Step 5: cover the pilot
If the full agreement is not ready in time, a fixed-term interim agreement enables a pilot: limited area, limited duration, inspection rights for the council, no person-level evaluation.
Step 6: sign and roll out
Sign the agreement, inform the workforce, run training and rollout on real cases, then move to regular operation with a review date a few months later.
Before vendor selection: set out purpose, the areas affected, the planned data types and the reports you have in mind, on a few pages. Without that description there is nothing to discuss.
Information and consultation under Section 90 of the Works Constitution Act. Hand over documents, collect questions, fix dates for the next steps. The result is a shared list of questions, not an approval.
The list of questions becomes part of the request to vendors: which data types occur, which reports ship as standard, which functions can be switched off, how does the role model work, what is logged?
The draft works agreement is written in parallel with the technical concept, not after it. What is limited technically no longer has to be forbidden contractually, and the other way round.
If the full agreement is not ready in time, a fixed-term interim agreement enables a pilot: limited area, limited duration, inspection rights for the council, no person-level evaluation.
Sign the agreement, inform the workforce, run training and rollout on real cases, then move to regular operation with a review date a few months later.
The works agreement: what belongs in it
The works agreement is the outcome, not a formality at the end. It carries a practical advantage for the company that is often overlooked: it ends case-by-case debate. As long as nothing is settled, every new report, every change of rights and every question from the workforce has to be negotiated afresh. Once the agreement exists, the framework is clear for years and only extensions require a new decision.
Agreements work well when they carry technical annexes instead of describing everything in prose. A field list and a rights matrix as annexes are easier to maintain than a clause that has to be reworded with every system change. The information needed for that arises anyway when a project is documented properly — see process documentation.
1 Scope
Site and departments, group of people covered, term
2 Subject and purpose
Name of the system, its role in the workflow
Purposes expressly excluded
3 Data collected
Data types per function, mandatory and optional fields
Annex 1: field list with description and origin
4 Evaluations
Permitted reports and their level of aggregation
Minimum group size, person filters disabled
Procedure for individual analysis on cause
5 Access and roles
Role model, granting of rights, logging of retrievals
Annex 2: role and rights matrix
6 Retention and deletion
Periods per data type, aggregation, proof of deletion
7 Rights of employees
Information, correction of wrong postings, contact point
8 Changes to the system
Duty to report new functions or reports
Procedure before an add-on module is activated
9 Outages and failure
Fallback procedure, later entry, handling of data gaps
10 Final provisions
Entry into force, termination, after-effect, disputesThe section on changes to the system is the most important in practice and the one most often forgotten. Without it, every extension, every additional report and every new module reopens the debate from first principles. With it there is an agreed procedure: notification, short assessment, activation or consultation. That keeps a system maintainable for years without renegotiating the framework each time.
When no agreement is reached
If employer and works council cannot agree on a matter subject to codetermination, Section 87(2) of the Works Constitution Act provides for a conciliation board. It is staffed with assessors from both sides and an impartial chair; its award replaces agreement between the parties. That is neither exotic nor a sign of a broken relationship — it is the route the law provides. It does cost time and money, because the chair and external assessors have to be paid.
Conversely, a rollout without involvement has consequences of its own. The works council can demand that use of the system stop until the participation procedure has been made up. Whether and how data collected without involvement may be used in employment disputes is a separate question that cannot be answered in the abstract and needs professional assessment in the individual case. For project planning the practical insight is enough: a halted system helps nobody.
What actually happens without involvement
Companies without a works council — and what still applies
Many mid-size companies have no elected body. In that case there is no codetermination under the Works Constitution Act and a works agreement is not available as an instrument. That does not mean there are no rules: employee data protection applies regardless of workplace representation, as do the duties to inform the people concerned. What a company with a council writes into an agreement belongs, without a council, into a written usage policy.
A works council may be elected in companies with at least five permanent employees eligible to vote (Works Constitution Act); the election needs no particular occasion and can be initiated at any point. For an IT project that means: whoever documents purpose, data types and evaluation limits from the outset already has the paperwork ready when it is needed. That documentation is useful in any case — for data protection, for onboarding new staff and for replacing the system some years later.
- Put the purpose of the system, and the purposes expressly excluded, in writing — plainly and in a single paragraph.
- List the data types per function, noting which field is mandatory and which is filled in voluntarily.
- Name the reports that are to exist and those that will not be activated, together with the reason.
- Define access roles and record for each role who grants it and who withdraws it.
- Set retention periods per data type and fix a date on which deletion is checked.
- Inform employees before go-live, with a named contact point for questions and corrections.
Typical mistakes during a project
The patterns repeat across sectors. They rarely arise from intent but from schedules in which involvement simply does not appear. The six points below are the ones that cost the most time in projects.
- Involvement after selection: the contract is signed, the requirements are fixed, and only then does the council enter. Changes are then possible only at extra cost.
- Only the main system considered: time recording is negotiated carefully, the reporting tool next to it is not — although that is where the real capacity to evaluate sits.
- Promises instead of settings: the text says there will be no person-level analysis, but the filter is still in the system. What remains technically possible gets used eventually.
- Extensions without a procedure: an update brings new reports, nobody reports it, and the next discussion starts from scratch.
- The workforce hears last: a system that appears without announcement creates mistrust that no agreement can recover afterwards. Information belongs before go-live.
- No responsibility named: without a named contact point for corrections and questions, every case lands with management and the agreement becomes paperwork.
Involvement costs time where it is made up after the fact. Planned in, it is one meeting during preparation.
For companies about to start a project this yields a simple sequence: first describe what the system is meant to do and which data it will produce, then inform, then select. That order is not only cleaner legally, it also produces better requirements for the vendor — because the questions a works council asks tend to be the right ones anyway.
Related Articles
Digital time tracking 2026: meeting the mandate cleanly
Recording working time is mandatory; the electronic form arrives in 2026. Implement it digitally: mobile capture, automatic rules, clean handover to payroll.
Verification of payee in payment runs: handling mismatches
Since October 2025, banks check name and IBAN before every credit transfer. How supplier master data, payment blocks and call-backs handle the bank's responses.
Interim Payments and Variations on Building Sites
How a stage of completion becomes an interim invoice, why a variation is a case with a deadline of its own, and how that produces a final account that can be checked without rework.