X-Fab Dresden GmbH & Co. KG – CJEU Judgment (Germany, 2023)

The data subject was an employee of the controller, X-FAB (a semiconductor foundry), and held two functions in the company: he was the chairman of the work council and the DPO of X-Fab and other companies of the same group of undertakings. However, on 1 December 2017, the data subject was dismissed from his duties as a DPO, at the request of the [https://gdprhub.eu/index.php?title=TLfDI_(Thuringia) DPA of Thuringen (TLfDI) (Germany)]. As a precautionary measure, the other undertakings also decided to dismiss him, based on the second sentence of Article 38(3) of the GDPR, which had in the intervening period become applicable. Dissatisfied, the DPO brought action before the a Court in Germany, asking to be reinstated in his position. The controller argued that his positions as a DPO and as the chair of the work council were incompatible as there was a potential conflict of interests between the two functions. In subsequent proceedings, both the courts of first instance and of appeal upheld the data subject’s action. The controller then appealed to the Bundesarbeitsgericht (Federal labour court of Germany). This Federal Court observed that the outcome of this appeal would depend on the interpretation of EU Law. Specifically, the Bundesarbeitsgericht stated that the question arose as to whether the second sentence of Article 38(3) GDPR (He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks) precludes national legislation from making the dismissal of a DPO subject to stricter conditions than those laid down by EU law. If this was the case, the Court wondered whether that provision had a sufficient legal basis. The Court also noted that it would be necessary to determine whether the functions of chair of the works council and of DPO may be performed simultaneously the same person or whether that would give rise to a conflict of interests within the meaning of the second sentence of the aforementioned ar