Court case 9 AZR 383/19 – Court Ruling (Germany, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a company's appointment of its Works Council Chairman as Data Protection Officer (DPO) was invalid due to a conflict of interest. The company had to revoke the appointment and find a new DPO. This case highlights the importance of avoiding conflicts of interest when appointing a DPO.
What happened
A company appointed its Works Council Chairman as the Data Protection Officer, which was found to be a conflict of interest.
Who was affected
The company and its subsidiaries that relied on the invalid DPO appointment.
What the authority found
The court ruled that the appointment was invalid due to a conflict of interest, requiring the company to appoint a new DPO.
Why this matters
This case emphasizes the need for companies to ensure their DPOs are free from conflicts of interest. Businesses should carefully review their DPO appointments to comply with privacy laws.
GDPR Articles Cited
National Law Articles
The Works Council Chairman of a subsidiary was appointed as the DPO of the mother company and its German subsidiaries in 2015. With the parallel appointment of the same person as the DPO for the whole group of undertakings, the mother company, the controller, aimed to synchronize the privacy standards in the group. In 2017, the controller asked the DPA of Thüringen whether such an appointment was lawful, due to concerns of conflict of interests and lack of reliability as under [https://dejure.org/gesetze/BDSG_a.F. § 4f(2) of the German Federal Privacy Law (Bundesdatenschutzgesetz - BDSG)]in its old version (a.F.). The DPA communicated in writing on 24 November 2017 that the requirements for a DPO appointment were not fulfilled at that time since the DPO was also the Works Council Chairman, therefore the appointment was null for incompatibility. Hence, the DPA declared that the controller did not have a DPO from 2015 on and that it should appoint a new DPO by 8 January 2018 or it would risk a fine of €50,000. As a consequence, the controller informed the DPO that it would revoke his appointment of 2015 with immediate effect. Upon entry into force of the GDPR, the controller also sent him a separate revocation letter referring to the operational reasons under Article 38(3) GDPR, second sentence. The DPO therefore filed a lawsuit in front of the Labour Court to challenge his revocation. In its submissions, the controller requested that the appeal be dismissed since the incompatibility of offices constitutes an important reason within the meaning of [https://dejure.org/gesetze/BDSG_a.F. § 4f(3) BDSG (a.F.)] and [https://www.gesetze-im-internet.de/bdsg_2018/index.html § 38(2) BDSG, § 6(4) BDSG] in conjunction with [https://www.gesetze-im-internet.de/bgb/ § 626 of the German Civil Code (Bürgerliches Gesetzbuch -BGB)]. In the first instance, the Labor Court of Dresden upheld the claim of the DPO and the Regional Labor Court of Saxony also dismissed the controller's
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 9 AZR 383/19 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 9 AZR 383/19 - Germany (2023). Retrieved from cookiefines.eu
Last updated: