Court case 9 AZR 383/19 – Court Ruling (Germany, 2023)

The Works Council Chairman of a subsidiary was appointed as the DPO of the mother company and its German subsidiaries in 2015. With the parallel appointment of the same person as the DPO for the whole group of undertakings, the mother company, the controller, aimed to synchronize the privacy standards in the group. In 2017, the controller asked the DPA of Thüringen whether such an appointment was lawful, due to concerns of conflict of interests and lack of reliability as under [https://dejure.org/gesetze/BDSG_a.F. § 4f(2) of the German Federal Privacy Law (Bundesdatenschutzgesetz - BDSG)]in its old version (a.F.). The DPA communicated in writing on 24 November 2017 that the requirements for a DPO appointment were not fulfilled at that time since the DPO was also the Works Council Chairman, therefore the appointment was null for incompatibility. Hence, the DPA declared that the controller did not have a DPO from 2015 on and that it should appoint a new DPO by 8 January 2018 or it would risk a fine of €50,000. As a consequence, the controller informed the DPO that it would revoke his appointment of 2015 with immediate effect. Upon entry into force of the GDPR, the controller also sent him a separate revocation letter referring to the operational reasons under Article 38(3) GDPR, second sentence. The DPO therefore filed a lawsuit in front of the Labour Court to challenge his revocation. In its submissions, the controller requested that the appeal be dismissed since the incompatibility of offices constitutes an important reason within the meaning of [https://dejure.org/gesetze/BDSG_a.F. § 4f(3) BDSG (a.F.)] and [https://www.gesetze-im-internet.de/bdsg_2018/index.html § 38(2) BDSG, § 6(4) BDSG] in conjunction with [https://www.gesetze-im-internet.de/bgb/ § 626 of the German Civil Code (Bürgerliches Gesetzbuch -BGB)]. In the first instance, the Labor Court of Dresden upheld the claim of the DPO and the Regional Labor Court of Saxony also dismissed the controller's appeal in its judgment of 19 August 2019. The controller, however, continuted to pursue its motion to dismiss the DPO's claim before the German Federal Labour Court (Bundesarbeitsgericht - BAG). In 2021, the BAG suspended proceedings as it referred four questions to the CJEU asking whether German national law was compatible with Article 38(3) GDPR, second sentence. In its judgment C-453/21 X-Fab Dresden GmbH & Co. KG, the CJEU held that Member states may lay down more specific rules on dismissals and that a conflict of interests can be given if the DPO carries out other functions within the company that determine the scope of processing on behalf of the controller. The BAG held that this assessment made by the CJEU regarding a conflict of interest pursuant to Article 38(2) GDPR has not only applied since the amendment of the BDSG after entry into force of the GDPR, but already corresponded to the legal situation within the scope of the [https://dejure.org/gesetze/BDSG_a.F. BDSG (a.F.).] On 6 June 2023, the BAG issued its final judgment on the case. First of all, it held that the initial appointment of the employee as DPO itself was lawful, due to the fact that reliability is not a reason for an appointment to be invalid and null, but lack thereof can be a reason for revoking the appointment of a DPO under [https://dejure.org/gesetze/BDSG_a.F. § 38(5) BDSG (a.F.).] Secondly, the BAG held that the revocation of the appointment of the employee as DPO was justified for good cause in accordance with [https://dejure.org/gesetze/BDSG_a.F. § 4f(3) BDSG (a.F.)] in conjunction with [https://www.gesetze-im-internet.de/bgb/ § 626(1) BGB]. Such reasons exists if DPO's funciton is made impossible or are at risk as for instance if he does not (or no longer) have the necessary expertise or reliability within the meaning of [https://dejure.org/gesetze/BDSG_a.F. § 4f(2) BDSG (a.F.).] Reliability of the DPO could be called into question if there was a risk of conflicts of interest. The BAG held, making reference to the CJEU's preliminary ruling on Article 38(6) GDPR, that such a conflict of interests can be given if the DPO holds a position within the controller's undertaking that would allow him to determine the purposes and means of processing of personal data. In the BAG's view, if the works council chairman also acted as DPO, a concrete risk of a conflict of interest was given which put the independence of the DPO's functions at risk. As a matter of fact, the works council chairman requests access to specific personal data of employees and decides which protective measures to adopt in that regard. At the same time, the DPO is called upon to assess in a neutral and independent way whether the actions taken by the works council are in line with data protection provisions. Due to these structural limitations, the DPO may struggle to ensure both neutrality and independence from the works council's resolutions, as he is the chairsperson thereof. For all these reasons, the BAG held that this conflict compromises the functional independence of the DPO, potentially undermining data protection provisions and as a result, the employer is justified to revoke the appointment of the employee in question as DPO.