Court case 12 Sa 186/19 – Court Ruling (Germany, 2020)

The defendant offers a medical service, in which - as in the case of the plaintiff - social data in the form of health data can be processed on the basis of the request from his/her health insurance company. Since the plaintiff´s colleagues and the plaintiff are working for the IT department, his colleagues received knowledge of the plaintiff´s health data. Whether the defendant has taken appropriate and specific measures in accordance with the German Federal Data Protection Law and Art. 9 GDPR to protect health data from unauthorized access from employees. The court emphasized that the physical examination of an employee represents a significantly more serious intervention in the personality sphere of the employee than an assessment based on the file. This differentiation meets the requirements of Section 22 (2) of the German Federal Data Protection Law (“BDSG”). In the context of Art. 9 Para. 2, 3 GDPR in conjunction with Section 22 Para. 2 BDSG, there are appropriate and specific measures required. One is that only professional personnel who are subject to professional secrecy may process the health data. This is the case here due to medical and social secrecy. This is not sufficient within the meaning of Section 22 (2) BDSG, but this must be included in the assessment, whether the defendant has taken appropriate and specific measures. The access within the defendant is restricted through technical and organizational measures (Section 22 (2) No. 5 BDSG). The personal data is only accessible to people who need it to perform their tasks. The access rights are determined by assigning rights and roles related to the occupational groups. The access authorization is again divided according to the occupational group-specific role for the 36 employees of the area the plaintiff is belonging to. The court decided that the IT department is uniform and indisputable for the responsibility for the entire protected area. Further protection is granted since the access and processing history of data is logged with the information who and what action is performed on the personal data. The defendant made it further clear by internal guidelines to its employees that he/she should not simply access the plaintiff’s health data outside of the remit. The court decided that this must also have been clear for the IT department. The measures in total were sufficiently to convince the court that appropriate technical and organisational measures were taken to protect the data from the plaintiff.