Why can employee representatives (works councils) have a say in an IAM system, and why does it depend on the country?

Because an IAM system records who logs in where and when, it can be used to monitor employees; in some countries, notably Germany, works councils have a statutory co-determination right over introducing such technical systems. How strong that right is depends on national law.

An IAM system is not neutral from the employees' point of view. It stores data about every employee and logs their logins and access, and these logs could be evaluated to monitor behaviour or performance: who works when, how long, from where.

Labour law in several countries reacts to exactly that:

• In Germany, the Works Constitution Act (Betriebsverfassungsgesetz, BetrVG) § 87(1) no. 6 gives the works council a right of co-determination (Mitbestimmungsrecht, "MitBestR") over the introduction and use of technical systems designed to monitor employees' behaviour or performance. In practice, IAM and logging systems usually fall under it, so an IAM rollout needs a works agreement first.
• In Switzerland, employee participation rights are much weaker, but employers must respect data protection, and labour law (Art. 26 of Ordinance 3 to the Labour Act, ArGV 3) forbids systems whose purpose is to monitor employees' behaviour; systems needed for other reasons, such as security, must be designed so that they do not become behaviour monitoring.

For a multinational company, this means the same IAM project may need formal approval of employee representatives in one country and only information in another. Involving them early, with clear rules about which data are logged and who may evaluate them, avoids a late veto.

Go deeper:

• BetrVG § 87: co-determination rights — the German statute, item 6 covers technical monitoring systems (in German).
• Codetermination in Germany (Wikipedia) — background on works councils and their rights.