Published in eulawlive.com, 9.03.2023
25th May 2023 will mark the 5th anniversary of the application of the General Data Protection Regulation (GDPR) . During these five years, in daily business as well as judicial practice, several open questions occurred related to it’s application. The requirements for dismissing the corporations’ Data Protection Officers (DPO) was one of these questions as well. Particularly in Germany, the Labour Courts decided numerous cases and several requests have been appealed to the Court of Justice of the European Union (Court of Justice) within the preliminary ruling procedure according to Article 267 of the Treaty on the Functioning of the European Union (TFEU). In this respect, on 9 February 2023, the Court of Justice again issued a decision contouring the protection of DPOs against dismissal (FC v X-FAB Dresden GmbH & Co. KG (C‑453/21)).
Taking this occasion, this Op-Ed briefly summarises the facts of the case and points out the requirements to be met by corporations in case of any dismissal of the internal or external DPO. It will moreover point out that – regardless of the present case – even in case of misconduct, the current level of protection against dismissal causes major difficulties in practice as well.
I. Facts of the case
The employee, FC, is working for X-FAB Dresden GmbH & Co.KG as from 1 November 1993. He is also a member of the works council in that corporation and, on that basis, is released from some of his work obligations. With effect from 1 June 2015, FC was moreover appointed as the DPO within the corporation of X-FAB. In this respect, each subsidiary separately appointed FC as its DPO aiming to ensure a uniform level of data protection throughout the corporation.
In 2017, X-FAB and its subsidiaries dismissed FC with immediate effect from his duties as DPO. FC filed a lawsuit against this dismissal arguing that it was unlawful due to a lack of good cause according to German Labour and Data Protection Laws. He stated that, according to §§ 38 (2) 6 (4) 1 of the German Federal Data Protection Act (Bundesdatenschutzgesetz (BDSG)), dismissing the DPO is only lawful if the requirements of an extraordinary termination according to analogous application of § 626 of the German Civil Law Code (Bürgerliches Gesetzbuch (BGB)) are met.
Based on this case, the German Federal Labour Court (Bundesarbeitsgericht) requested whether Article 38(3) sentence 2 GDPR must be interpreted as enabling national legislation to stipulate a higher level of protection even if dismissal is not related to the performance of the DPO’s tasks. The Court moreover requested whether the membership in the works council and being appointed as a DPO amounts to a conflict of interests within the meaning of the second sentence of Article 38(6) of the GDPR.
Answering these questions, the Court of Justice now decided that the GDPR enables Member State Laws to stipulate a higher level of protection in this respect. It moreover defined that a ‘conflict of interests’ according to Article 38(6) GDPR only exists in case a DPO is entrusted with other tasks or duties causing the DPO to determine objectives and methods of processing personal data. Whether this is the case or not, according to the decision of the Court, depends on the organisational structure of the corporation and the applicable rules, including any policies.
II. Distinction between the DPOs’ dismissing and terminating his employment relationship
Transferring this decision into German legal practice, the applicability of the §§ 38(2), 6(4) 1 BDSG causes confusion particularly for corporations whose holding is located outside Germany. The confusion mainly results out of the fact that the German provisions differentiate between dismissing the DPO and terminating his employment relationship are two separately assessed subjects.
In Germany, especially in smaller corporations, the situation occurs that a DPO performs his or her duties only on a part-time basis. In this respect, the parties mutually reduce the tasks of the employment relationship by 50% and appoint the employee as DPO for the remaining 50%. Alternatively, if the DPO performs 100% of his work as a DPO, it is common practice in Germany to only suspend – and thus not terminate – the duties underlying the employment relationship. The advantage in these cases is that the employee, if not interested in being the DPO anymore, is obliged to work in his former position retaining the employee to the employer. These are nonetheless also the cases in which employees argue that the underlying employment relationship is not terminated with the act of dismissal from his or her duties as DPO.
As the Court of Justice in its Leistritz AG-Decision from 22 June 2022 (C-534/20) already stated, Article 38(3) sentence 2 GDPR covers both a protection against terminating a DPO’s employment contract and dismissing him from the function as DPO the protection according to Article 38(3) GDPR necessarily contains a protection against dismissal.
To this extent, however, German Labour Courts nonetheless differentiate between dismissing the DPO and terminating the employment contract. Hence, misconduct of the DPO solely related to the duties can only be sanctioned under Labour Law if the specific violation of duties correlates with misconduct within the employment relationship as well (ArbG Heilbronn, judgment of 29 September 2022 – 8 Ca 135/22). Employers are thus obliged to analyse both the requirements for dismissal from duty as a DPO as well as for termination of the employment contract.
III. Requirements for dismissing the DPO
Transferring the decision into practice, dismissing the DPO is only possible for good cause. Applying the commonly known case law of the German Federal Labour Court concerning § 626 BGB, employers are hence obliged to:
- analyse whether facts occurring may abstractly be considered to justify dismissal for good cause; and
- comprehensively consider the circumstances of the individual case as well as the interests of both contracting parties analysing whether the dismissing party cannot be expected to continue the ongoing appointment as DPO.
Grounds for dismissing the DPO are particularly those connected with the function and activity of the DPO making it impossible to continue to perform his activity or at least significantly jeopardise it. As previously stated, the grounds for dismissing the DPO do not necessarily correlate with grounds to terminate the employment contract.
Whether simultaneously being DPO and a Member of the Works Counsel results in a conflict of interest being a good cause for dismissal, is nonetheless questionable relying on this decision. As, in Germany, § 79a sentence 2 of the German Works Constitution Act (BetrVG) stipulates that employers – who are determining the purposes and means of the processing within the means of Art. 4(7) GDPR – remain controllers insofar as the works council processes personal data in order to fulfil the tasks within its competence. From this author’s perspective, due to the specific position and tasks of the works counsel a conflict of interest may arguably occur anyways in these cases.
IV. Conclusion
From a current perspective, both dismissing the DPO from his or her position as well as terminating the employment contract is only lawful if based on good cause. It is moreover indifferent, whether the DPO is an employee or externally appointed and whether the reasons for dismissal are based on a performance in duty or on other reasons is irrelevant as well. In other words, the DPO’s protection against dismissal is applicable regardless of the circumstances in the specific case.
Separating the dismissal of the DPO as well as the termination of the employment contract seems nonetheless contrived. This is particularly so for employers based outside Germany. It is nonetheless consistent if the German BDSG is applied accurately.
Nevertheless, it creates major difficulties for employers to justify both acts simultaneously. This makes it considerably more difficult to terminate the employment relationship in case of misconduct solely related to the duty of the DPO. From the employer’s perspective, this situation is irritating. Nonetheless employers cannot omit to carefully analyse the individual case. Considering the possibility that German Courts will not see a conflict of interest with a member of the works counsel being appointed as DPO, it is highly recommended for employers not to appoint one of these members as DPO. Moreover, it is recommended to agree on a fixed term appointment of the DPO.
The good news, however, if employers are not mandatorily obliged to appoint a DPO under European or German laws, is that an ordinary termination is still lawful. § 38(2) BDSG exclusively refers to § 6(4) sentences 1 and 2 BDSG for bodies obliged to appoint a data protection officer.
