Court case 8 AZR 169/25 – Court Ruling (Germany, 2026)

A company (the controller) commissioned a law firm to conduct a compliance investigation into alleged misconduct of a manager (the data subject) in August 2023. The investigation resulted in two compliance reports containing the allegations against the data subject, the names of whistleblowers and witnesses, and a summary of the findings of the investigation. The data subject claimed that she had the right to receive copies of the final compliance reports pursuant to Articles 15(1) and 15(3) GDPR. She requested access to these documents in order to verify what statements had been made about her, whether those statements were accurate, and how they had been determined. The controller refused to grant the data subject access to copies of the entire documents – it considered that its interest in maintaining the confidentiality of the compliance reports as trade secrets outweighed the plaintiff’s interest in obtaining information. The court of first instance ordered the controller to provide the data subject a copy of the earlier version of the compliance report. The appellate court dismissed the data subject’s claims. Following this, the data subject appealed before the Federal Labour Court and also requested access to an interim report related to the same investigation for the first time. The court dismissed the data subject’s appeal and held that she did not have the right to receive a copy of the final compliance reports under Articles 15(1) and 15(3) GDPR. The court held that requesting access to an interim report constituted an impermissible expansion of the claim in the appeal proceedings. Furthermore, the court held that the final compliance reports did not exclusively contain personal data within the meaning of Article 4(1) GDPR. For instance, the documents also contained legal analysis, which merely constitutes information about how the controller assesses the legal situation. Consequently, the court argued that the data subject did not need copies of the reports in their entirety in order to verify the accuracy of the personal data and the lawfulness of the processing.