The authority to impose administrative fines for data protection violations, including those involving employee data, is exclusively granted to national supervisory authorities (Data Protection Authorities or DPAs) under Article 83 of the GDPR. Works councils are employee representative bodies whose powers are focused on information, consultation, and co-determination rights within the company. Their role is to protect employee interests concerning working conditions and the introduction of systems that process personal data, but they do not possess the legal authority to levy punitive monetary fines, which is a function of a state regulatory body.

B. Determining whether to approve or reject certain decisions of the employer that affect employees. This is incorrect because co-determination, the right to approve or reject employer decisions on specific matters, is a primary function of works councils in many EU jurisdictions.
C. Determining whether employees’ personal data can be processed or not. This is incorrect as works councils often have co-determination rights regarding the implementation of technical systems used to monitor employee behavior and performance, effectively giving them a say in how employee data is processed.
D. Determining what changes will affect employee working conditions. This is incorrect because influencing and co-determining changes to working conditions is a fundamental and legally mandated role of a works council.

1. General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679:

Article 83, Paragraph 1: "Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive." This text explicitly assigns the power to fine to the supervisory authority.

2. Kania, K. (2018). The role of works councils in the processing of employee data in the light of the GDPR. Studia z Zakresu Prawa Pracy i Polityki Społecznej, 25(3), 123-134.

Page 129: The article discusses that under national laws like the German Works Constitution Act (BetrVG), works councils have significant co-determination rights regarding the "introduction and use of technical equipment designed to monitor the conduct or performance of employees." This confirms their role in decisions about data processing (Options B, C, D), but notes their power is internal to the company, distinct from the external regulatory power of DPAs.

3. Bygrave, L. A. (2020). Data Privacy Law: An International Perspective. Oxford University Press.

Chapter 7, Section 7.4.2 (Employee Representatives): This chapter details how collective agreements and the involvement of employee representatives (like works councils) are a key part of the framework for processing employee data in Europe. It highlights their role in negotiation and co-determination, contrasting it with the enforcement powers of DPAs discussed elsewhere in the text.