Court case 2 Sa 16/21 – Court Ruling (Germany, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a former employee's request for personal data was properly handled by their ex-employer, even though the response came from the parent company's data protection officer. The court found that the employer met GDPR requirements by providing the information via email. This decision clarifies that companies can delegate data requests to qualified agents.
What happened
A former employee claimed their ex-employer violated GDPR by not directly providing requested personal data.
Who was affected
The former employee who requested their personal data from their previous employer.
What the authority found
The court decided that the employer fulfilled GDPR obligations by having the data protection officer of the parent company provide the information.
Why this matters
This ruling shows that companies can delegate data request responses to qualified agents, as long as the information is provided appropriately. Businesses should ensure their data protection officers are equipped to handle such requests efficiently.
GDPR Articles Cited
The case concerned the validity of two ordinary notices of termination issued by the former employer of the plaintiff, and the continuation of the plaintiff's employment with the second defendant. Among various claims in the proceedings, the plaintiff argued that their former employer violated their Article 15 GDPR obligations as a data controller. The plaintiff requested information under Article 15 GDPR from its former employer as a data subject. On 25 January 2021, they received an email response from the data protection officer of the data controller's parent company. The email included a reference to an attachment with the requested information. The plaintiff claimed that this constituted a violation of the GDPR, since they did not receive the information from the data controller, but from the data protection officer of the parent company. Furthermore, they claimed that the reference to the attached appendix in the email was not transparent. The plaintiff sought information from the former employer pursuant to Article 15 GDPR, the provision of copies of the personal data processed, and damages for violations of the GDPR. Concerning the "person responsible" for the provision of information The court held that the information was provided by the "person responsible", even though the sender of the information letter was not the controller itself, but the data protection officer of the parent company. According to Article 12 (1) GDPR, a controller must only take "appropriate measures" so that the notification obligation pursuant to Article 15 GDPR is fulfilled. This can be done by a delegated agent, which the data protection officer in the case at hand is. Concerning the form of the provision of information The court held that the information provided by email was sufficient. Pursuant to Article 12 (1) GDPR, the information must be provided in writing or in another form, if necessary also electronically. No formal requirement applies. Almost all correspo
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 2 Sa 16/21 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 2 Sa 16/21 - Germany (2022). Retrieved from cookiefines.eu
Last updated: