Today we continue our small series on employee data protection. Here we provide a brief overview of current German case law on the subject of employee data protection at irregular intervals.
Case law on Art. 15 GDPR:
- LAG Berlin-Brandenburg (Regional Labor Court Berlin-Brandenburg), judgment of March 30, 2023 (5 Sa 1046/22): Right to information even for motives unrelated to data protection
According to the ruling of the Regional Labor Court Berlin-Brandenburg, requests for information and the provision of a copy of data can also be based on Art. 15 GDPR if they do not serve the purpose of becoming aware of the processing of personal data and being able to verify its lawfulness. In such cases, the request is not an abuse of rights and manifestly unfounded or excessive within the meaning of Art. 12(5)(2) GDPR.
- OLG Nuremberg (Higher Regional Court Nuremberg), judgment of November 6, 2023 (4 U 347/21): No abuse of rights if a data subject (also) uses the right to information for motives unrelated to data protection
The Higher Regional Court of Nuremberg also sets high requirements for an “abuse of rights”. According to the wording and purpose of Art. 12(5)(1), Art. 15 GDPR, there is no abuse if a data subject (also) uses the right of access for motives unrelated to data protection, for example to obtain information for settlement negotiations or to obtain contractual information no longer available to them (e.g. information about accounts, insurance conditions, etc.), as such a restriction to a specific motive is not found in Art. 15 GDPR. This also applies if the information pursuant to Art. 15 GDPR causes a great deal of effort for the controller, as the effort of the controller does not play a role for Art. 15 GDPR.
- LArbG Baden-Württemberg (Regional Labour Court Baden-Württemberg), judgment of July 27, 2023 (3 Sa 33/22): No non-material damage due to delayed provision of information
The mere breach of the provisions of the GDPR is not sufficient to justify a claim for damages pursuant to Art. 82(1) GDPR. Art. 82(1) GDPR does not contain any presumption that the loss of control associated with a breach of the General Data Protection Regulation leads to compensable non-material damage. In addition, the Regional Labor Court Baden-Württemberg ruled that an application pursuant to Art. 15(1) GDPR for the disclosure of “all personal data” does not generally satisfy the requirement of certainty under Section 253(2) No. 2 of the German Code of Civil Procedure (ZPO).
- LAG Düsseldorf (Regional Labour Court Düsseldorf), judgment of 28.11.2023 (3 Sa 285/23): No claim for damages due to delayed or incomplete information
In a very recent decision, the Regional Labour Court Düsseldorf also took the view that late or incomplete information does not justify a claim for damages, as the mere breach of the obligation to provide information does not constitute data processing in breach of the GDPR.
This decision is interesting because in the recent past some labor courts in North Rine-Westphalia had still affirmed such a claim for damages.
- LG Baden-Baden (Regional Court Baden-Baden), judgment of 24.08.2023 (3 S 13/23): A right to information can also extend to the naming of the first and last names of employees of the controller
The data subject has the right to be informed of the first names and surnames of the controller’s employees if their personal data has been disclosed to the employees and processed privately by them. The employees of the controller to whom the data subject’s personal data has been disclosed in order to contact them via the private account of a messenger service are “recipients” within the meaning of Art. 15(1)(c) GDPR.
Case law on Art. 17 GDPR:
Note: What is interesting about the following two judgments is that the Regional Labour Court of Saxony (judgment of 31 March 2023 (4 Sa 117/21)) and the Higher Regional Court of Baden-Württemberg (judgment of 28 July 2023 (9 Sa 73/21)) came to different conclusions in similar cases:
- LAG Saxony (Regional Labour Court Saxony), judgment of March 31, 2023 (4 Sa 117/21): Art. 17(1) GDPR does not establish a right to removal of a warning from the personnel file after termination of the employment relationship
The background to the ruling was the claim of a former employee to have two warnings removed from her personnel file after the termination of her employment relationship. The Regional Labour Court Saxony ruled that such a claim could only be made in exceptional cases if there are objective indications that a warning could harm the employee even after the employment relationship has ended. The right to erasure of personal data regulated in Art. 17(1) GDPR is not applicable to personnel files kept in paper form.
- LArbG Baden-Württemberg (Regional Labour Court Baden-Württemberg), judgment of July 28, 2023 (9 Sa 73/21): According to Art. 17(1) GDPR, an employee can regularly request the deletion of a warning from the personnel file after the end of the employment relationship
However, the Regional Labour Court Baden-Württemberg ruled on July 28, 2023 that employees can regularly request the deletion of a warning from their personnel file after the end of the employment relationship in accordance with Art. 17(1) GDPR. This also applies to paper files, as Art. 2(1) GDPR does not require data to be processed electronically. After the end of the employment relationship, warnings are generally no longer required for the purpose for which they were stored in the personnel file.
Case law on the subject of data protection officers:
- BAG (Federal Labour Court), judgment of June 6, 2023 (9 AZR 383/19): The simultaneous exercise of the works council chairmanship and the role as data protection officer can be a reason for dismissal pursuant to Section 4(f) of the German Federal Data Protection Act (BDSG) old version
In its ruling of June 6, 2023, the Federal Labour Court ruled that the chairmanship of the works council typically precludes the performance of the duties of the data protection officer. As a rule, the employer is entitled to revoke the appointment of the data protection officer in accordance with Section 4(f) BDSG old version. The conflict of interest regularly consists of the fact that the data protection officer holds a position that involves determining the purposes and means of processing personal data through the chairmanship of the works council.
Case law on the subject of video surveillance:
- BAG (Federal Labour Court), judgment of June 29, 2023 (2 AZR 296/22): No prohibition of exploitation with regard to open video surveillance that intentionally proves an employee’s conduct in breach of contract
The Federal Labor Court ruled that there is no prohibition on the use of recordings from open video surveillance in a dismissal protection process in accordance with the GDPR and the German Code of Civil Procedure (ZPO), which are intended to prove intentional breach of contract by an employee. This applies even if the employer’s surveillance measure does not fully comply with the requirements of data protection law.