Court case 2 Sa 16/21 – Court Ruling (Germany, 2022)

The case concerned the validity of two ordinary notices of termination issued by the former employer of the plaintiff, and the continuation of the plaintiff's employment with the second defendant. Among various claims in the proceedings, the plaintiff argued that their former employer violated their Article 15 GDPR obligations as a data controller. The plaintiff requested information under Article 15 GDPR from its former employer as a data subject. On 25 January 2021, they received an email response from the data protection officer of the data controller's parent company. The email included a reference to an attachment with the requested information. The plaintiff claimed that this constituted a violation of the GDPR, since they did not receive the information from the data controller, but from the data protection officer of the parent company. Furthermore, they claimed that the reference to the attached appendix in the email was not transparent. The plaintiff sought information from the former employer pursuant to Article 15 GDPR, the provision of copies of the personal data processed, and damages for violations of the GDPR. Concerning the "person responsible" for the provision of information The court held that the information was provided by the "person responsible", even though the sender of the information letter was not the controller itself, but the data protection officer of the parent company. According to Article 12 (1) GDPR, a controller must only take "appropriate measures" so that the notification obligation pursuant to Article 15 GDPR is fulfilled. This can be done by a delegated agent, which the data protection officer in the case at hand is. Concerning the form of the provision of information The court held that the information provided by email was sufficient. Pursuant to Article 12 (1) GDPR, the information must be provided in writing or in another form, if necessary also electronically. No formal requirement applies. Almost all correspondence in the employment relationship between the data subject and the data controller was conducted electronically by email. Therefore, the provision of information by email was appropriate.