Court case 8 AZR 169/25 – Court Ruling (Germany, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court ruled that a company did not have to share compliance investigation reports with a manager who claimed her rights were violated. The ruling emphasizes the balance between employee rights and company confidentiality in sensitive investigations.
What happened
A court dismissed a manager's request for access to compliance reports related to allegations against her.
Who was affected
The manager involved in the compliance investigation who sought access to the reports.
What the authority found
The court held that the company’s interest in maintaining confidentiality outweighed the manager’s right to access the reports under GDPR.
Why this matters
This ruling highlights the complexities of data access rights and confidentiality, reminding businesses to carefully navigate these issues during investigations.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A company (the controller) commissioned a law firm to conduct a compliance investigation into alleged misconduct of a manager (the data subject) in August 2023. The investigation resulted in two compliance reports containing the allegations against the data subject, the names of whistleblowers and witnesses, and a summary of the findings of the investigation. The data subject claimed that she had the right to receive copies of the final compliance reports pursuant to Articles 15(1) and 15(3) GDPR. She requested access to these documents in order to verify what statements had been made about her, whether those statements were accurate, and how they had been determined. The controller refused to grant the data subject access to copies of the entire documents – it considered that its interest in maintaining the confidentiality of the compliance reports as trade secrets outweighed the plaintiff’s interest in obtaining information. The court of first instance ordered the controller to provide the data subject a copy of the earlier version of the compliance report. The appellate court dismissed the data subject’s claims. Following this, the data subject appealed before the Federal Labour Court and also requested access to an interim report related to the same investigation for the first time. The court dismissed the data subject’s appeal and held that she did not have the right to receive a copy of the final compliance reports under Articles 15(1) and 15(3) GDPR. The court held that requesting access to an interim report constituted an impermissible expansion of the claim in the appeal proceedings. Furthermore, the court held that the final compliance reports did not exclusively contain personal data within the meaning of Article 4(1) GDPR. For instance, the documents also contained legal analysis, which merely constitutes information about how the controller assesses the legal situation. Consequently, the court argued that the data subject did not need copies of the r
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 8 AZR 169/25 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 8 AZR 169/25 - Germany (2026). Retrieved from cookiefines.eu
Last updated: