E (the controller) – Court Ruling (Germany, 2025)

The data subject has been an employee of the controller since 1 February 2015. In April 2023, the controller was informed of several allegations against the data subject, claiming that the subject created a toxic work environment. To verify the claims, the controller began an internal investigation from 25 August 2023 until 11 January 2024. The final investigation report contained all allegations and the personal data of witnesses and accusers. The data subject claimed the investigation was biased and not objective, and that the resulting report has been used to justify disciplinary measures, rejections of part time work requests, and an attempted termination, and has been quoted in interviews with the press. To understand what has been said about them and verify how truthful the investigation was and if their data was processed lawfully, the data subject requested a copy of the investigation report, if necessary with redacted personal information, based on Article 15(1) and (3) GDPR. The data subject also argued that disclosure of the compliance report was not barred by the rights of the controller or third parties. They maintained that the defendant had no legitimate confidentiality interest, that economic interests were insufficient, and that the report did not qualify as a trade secret or be protected by whistleblower protections, as any third-party concerns could be addressed through redaction or anonymization. Also, the data subject claimed a statutory right of access to the report as part of her personnel file based on § 83(1) BetrVG and § 26 (2) SprAuG, arguing that secret personnel files are impermissible. Finally, the data subject argued that immediate enforceability should be possible, as no disadvantage would result and any confidentiality interests of other individuals had already been undermined by the controller quoting the report in court proceedings. Following that, the data subject requested to either get a copy of the investigation report, or