The entrepreneur needs the consent of the works council for every proposed decision to adopt, amend or withdraw an arrangement on the processing and protection of the personal data of the persons working in the undertaking (for example a staff privacy regulation, retention periods, access to HR data, sharing with processors), insofar as it concerns all or a group of the persons working in the undertaking. The proposal is submitted in writing with reasons and expected consequences, consent follows at least one consultation meeting, and the entrepreneur states in writing which decision he took and from when he will implement it (27(2)); without consent or the cantonal court's permission the decision is void if the council invokes nullity in writing within one month (27(4) and (5)). The Autoriteit Persoonsgegevens explains the route in its 'OR-privacyboekje' (the works council's role in privacy at work): an arrangement is any set of rules on processing staff data, including a privacy regulation. Art. 33(3) UAVG adds that criminal-offence data about staff may be processed only under rules adopted through this WOR procedure.
This control maps to 3 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.