LAG Baden-Württemberg - Sa 11/18
| LAG Baden-Württemberg - Sa 11/18 | |
|---|---|
 | |
| Court: | LAG Baden-Württemberg (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15 GDPR Article 23 GDPR |
| Decided: | 20.12.2018 |
| Published: | |
| Parties: | anonymous |
| National Case Number/Name: | Sa 11/18 |
| European Case Law Identifier: | |
| Appeal from: | ArbG Stuttgart (Germany) |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Landesrechtsprechung Baden-Württember (in German) |
| Initial Contributor: | n/a |
The regional labour court of the Land Baden-Württemberg issued its decision on 20.12.2018, and present interesting developments regarding the right of access pursuant to Article 15 GDPR.
English Summary
Facts
The plaintiff was employed by an international group as head of the “Legal Mergers & Acquisitions”. A longstanding labour dispute began between the plaintiff and his employer. As a result, the plaintiff was assigned to various positions having a lower hierarchy and lower wage level. During the conflict, the plaintiff received several warnings from its employer for improperly fulfilling his work and was finally dismissed.
In the context of this dispute, the plaintiff requested access to personal data under Article 15 GDPR. The right to access relates, among other things, to any correspondence about the plaintiff in parallel with the personnel file, and the inclusion of the plaintiff in internal 'negative lists'. This is of importance because a Business Practices Office (BPO) proceeding against the plaintiff was initiated in 2014 - it equals a whistle blower system. In an email from the head of HR to the plaintiff on March 8, 2017, the plaintiff was informed that a compliance check was planned for all (job) appointments in the legal area, which would also check whether a BPO Proceedings result in a violation of the rules. However, the first instance rejected the right of the plaintiff to claim information about the personal performance and the behavioural data processed by the employer, which was not stored in the personnel file. The employer refused to communicate this information because of third-parties interests, namely business secrets.
Holding
The Land court confirmed that Article 15 GDPR also exists in an employment law relationship, and a Member State is authorized to issue specific national regulations on employee data within certain limits. According to the GDPR, personal data is all information that relates to an identified or identifiable natural person ('data subject'), and, in an employment relationship, the employer inevitably processes personal data of its employees.
It has been judged that the plaintiff is entitled to information about personal performance and behavioural data. Those personal data is considered as a special category of personal data (sensitive personal data).
Furthermore, the claims for information and disclosure of personal performance and behavioural data are not limited in the present case by legitimate interests of third parties. Of course, the national does not give the data subject the right to information in accordance with Article 15 GDPR, insofar as the information would reveal confidential information about third-parties. However, even the existence of a corresponding ground for confidentiality does not mean that the data controller is entitled to refuse to provide the information. In fact, a weighing of interests must be carried out by the data controller, i.e. a balancing test between the right to information and the interest of confidentiality. But, the assessment must be done in each individual case and the Court cannot rule in general or in advance which legitimate interest prevails upon the other. The Court recognized that an overriding interest may exist if the employer guarantees anonymity to whistle blowers for the purpose of clarifying internal misconduct, because certain types of rule violations within a hierarchical structure can be detected more effectively through anonymous reporting procedures.
In such a case, the data subject's interest is likely to prevail due to an increased need for protection. The employer raised that the need for protection by whistle blowers requires unconditional protection. Otherwise, employees will in future refrain from notifying the employer of any misconduct by fear of retaliation. However, according to the Court, these considerations are too general for a restriction of the plaintiff's right. The restriction of the right to information due to the predominant interest of third parties fails, because it remains unclear which concrete interests are threatened.
Comment
Share your comment here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the original. Please refer to the German original for more details.
[...]
90 The plaintiff now bases the amended claims on Article 15 (1) and (3) GDPR. The right to information is available to any natural person without any preconditions, without having to first present or prove specific facts. The party entitled to information only has the possibility to specify the right to information, in particular to explain to which information or which processing operations the request for information should relate.
91 The defendant requests,
92 dismiss the cross-appeal.
93 Even after the amendment of the request, the appeal pursued with item 3 remains too vague and thus inadmissible.
94 Within the period for filing the grounds of cross-appeal, the plaintiff had not dealt with the decision challenged by the plaintiff. The plaintiff had confined itself to mere statements of law. The now announced request also did not merely concretize the appeal request, but the requested information now refers to personal performance and behavioural data, the purposes of the data processing, recipients, storage period, origin and the existence of automated decision-making. The defendant does not consent to this amendment to the complaint.
95 The terms contained in the application, such as "performance" and "conduct," are not legally defined in the GDPR and are therefore too vague. There was a concern of further disputes about the content of the information sought by the plaintiff. Furthermore, the plaintiff had not asserted his request for information himself, but through his legal representative. The plaintiff had not provided proof of his authorization at the time of the request for information.
96 The claim for information was also unfounded. The plaintiff was not entitled to information on "performance and conduct data". The right to information pursuant to Article 15 (1) of the GDPR relates to "personal data relating to an individual" pursuant to Article 4 No. 1 of the GDPR. In addition, the claim does not exist without restrictions. According to Art. 15 (4) GDPR, in particular, the rights and freedoms of other persons may not be impaired. It is unclear to what extent the defendant can be obliged to provide information in view of legitimate interests of third parties protected by fundamental rights. In any event, the plaintiff was obliged in good faith and in accordance with the principle of procedural economy to specify its request for information in accordance with recital 63 of the GDPR.
97 The cross-appeal is also inadmissible with regard to appeal request No. 4 (surrender of a copy of the data). An inadmissible cross-appeal also leads to the inadmissibility of the extension of the action sought by the plaintiff with appeal request number 4.
[...]
196 The plaintiff has a claim under Article 15 (1) of the GDPR to be provided with the information asserted in the cross-appeal. The GDPR applies directly (1) and is applicable to the employment relationship of the parties (2). The Defendant processes personal data about the Plaintiff (3), which is why the Plaintiff is entitled to both the extended information (4) pursuant to Article 15 (1), second half-sentence, of the GDPR and a claim for the surrender of a copy (5) of the data pursuant to Article 15 (3), first sentence, of the GDPR. In the present case, these claims are also not restricted by the legitimate interests of third parties (6).
197 (1) Pursuant to Article 99(2) of the GDPR, the GDPR has been applicable since 25 May 2018 and is directly applicable. Pursuant to Art. 288 TFEU, the GDPR applies directly in every member state of the Union without the need for further implementation by national law.
198 (2) The right to information under Art. 15 GDPR also exists in an employment relationship. The general provisions of the EU GDPR contain a full regulation, including on employee data protection (Düwell/Brink, NZA 2016, 665). However, pursuant to Art. 88 of the GDPR, the member states are authorized to enact specific national provisions on employee data protection within certain limits.
199 (3) The defendant processes personal data of the plaintiff.
200 a) According to Art. 4 No. 1 GDPR, personal data is any information relating to an identified or identifiable natural person ("data subject"). According to Art. 4 No. 2 GDPR, processing also includes, in particular, collection, recording, organization, classification, storage and use. In an employment relationship, the employer inevitably processes personal data of the workers employed by him.
201 b) The fact that the defendant processes personal data of the plaintiff is already evident from the large number of official e-mails submitted by the parties as printouts in this legal dispute, which the plaintiff wrote, sent and received within the scope of his employment relationship. Every single e-mail written, sent and received by the plaintiff already contains personal data, namely information relating to the plaintiff. In this respect, the defendant's objection that it does not keep any negative lists or the like about the plaintiff outside the personnel file is irrelevant
202 (4) The plaintiff is entitled to be provided with information on personal performance and conduct data. Personal performance and conduct data is a specific category of personal data within the meaning of Art. 15 (1) (2) (b) GDPR in conjunction with Art 4 No. 1 GDPR. According to recital 63 p. 7 to the GDPR, the party entitled to information is entitled to declare to which information or to which processing operations the request for information relates. The plaintiff made use of this right and limited his initially comprehensive right to information to personal performance and behavioural data.
203 (5) The right to be provided with a copy of the data results from Art. 15 (3) sentence 1 GDPR
204 (6) The claims to information and surrender of the personal performance and behavioural data are not limited by the legitimate interests of third parties in the present case.
205 a) Pursuant to Section 34 (1) in conjunction with. § Section 29 (1) sentence 2 BDSG, the right to information of the data subject pursuant to Article 15 of Regulation (EU) 2016/679 (GDPR) does not exist insofar as the information would disclose information that must be kept secret pursuant to a legal provision or by its nature, in particular due to the overriding legitimate interests of a third party. The provisions in Section 34 (1) in conjunction with. § Section 29 (1) and (2) of the BDSG are based on the opening clause of Article 23 (1) (i) of the GDPR, according to which information and notification obligations of the controller or the right of access of data subjects may be limited in order to protect the data subject or the rights and freedoms of other persons (BeckOK; DatenschutzR/Uwer, 26th ed. 1.8.2018, BDSG Section 29 Rn. 1).
206 The right to receive a copy is limited by rights and freedoms of other persons according to Art. 15 (4) GDPR (Gola GDPR/Franck, 2nd ed. 2018, GDPR Art. 15 Rn. 33, 34). It is argued that this restriction is not only limited to the right to receive a copy regulated in Art. 15(4) GDPR, but also covers the right to information under Art. 15(1) GDPR (so Paal/Pauly/Paal, 2nd ed. 2018, GDPR, Art. 15 para. 41 - direct application; BeckOK DatenschutR/Schmidt-Wudy, 25th ed. as of 01.08.2018, Art. 15 GDPR para. 97 - analogous application).
207 b) In any case, the existence of a reason for secrecy does not necessarily lead to the right to refuse the requested information. The right to information is restricted pursuant to Section 34 (1) in conjunction with Section 29 (1) sentence 2 BDSG. § Section 29 (1) sentence 2 BDSG, the right to information is only restricted "insofar as" the information would disclose information that must be kept secret according to a legal provision or by its nature, in particular because of the overriding legitimate interests of a third party. Thus, a balancing of interests between the interest in secrecy on the one hand and the interest in information on the other hand is required, taking into account the principle of proportionality. In each individual case, the specific interest of the employee in providing the information must be determined and weighed against the employer's operational interest in not providing the information or the legitimate interests of third parties. It is not excluded from the outset that legitimate interests of the employer or legitimate interests of other employees are affected by providing information. It may constitute a legitimate interest in the confidentiality of a source of information if the employer assures whistleblowers of anonymity for the purpose of clarifying internal misconduct. Certain types of breaches of rules within a hierarchical structure can be uncovered more effectively through anonymous reporting procedures. However, even if the interest in secrecy is in principle justifiable - for reasons of whistleblower protection - constellations are conceivable in which the interest in secrecy must take a back seat to the employee's interest in information. This may concern cases in which an informant has given incorrect information to the employer against his better knowledge or recklessly. In such a case, the interest of the person concerned in receiving the information is likely to have a predominant weight due to a then increased need for protection.
208 c) In the present case, the defendant may not refuse the right to information that exists in principle pursuant to Art. 15 GDPR in application of Sec. 34 (1) BDSG in conjunction with Sec. § Section 29 (1) sentence 2 BDSG. Only "insofar" as there were interests of third parties worthy of protection and these were to be classified as more important than the right to information in the required individual case assessment, would a restriction of the right to information be assumed. However, the facts relevant for this individual case assessment, which could lead to a restriction of the right to information, have not been presented by the defendant. The defendant makes a general reference to the need for protection of whistleblowers. The defendant states that it is dependent on the unconditional protection of the anonymity of employees who provide information. Otherwise, it is to be feared that in the future employees will refrain from informing the employer, even in the case of serious misconduct, for fear of discrimination and reprisals.
209 These considerations are too general to restrict the plaintiff's right to information either entirely or to a certain extent. It would require the naming of a concrete set of facts on the basis of which it could be examined whether the rights and freedoms of other persons would actually be restricted by the provision of information. The restriction of the right to information due to overriding interests of third parties that are worthy of protection already fails due to the fact that, according to the defendant's submission, it remains unclear to which personal data of the plaintiff the alleged interests of third parties that are worthy of protection are supposed to relate. Insofar as the defendant denies the right to information by referring to the interests of third parties that are worthy of protection, it has the burden of proof for the relevant circumstances. By virtue of its proximity to the facts, it would have been in a position to state which specific personal data could not be disclosed without affecting the interests of third parties worthy of protection. It would not have been necessary to disclose the personal data as such in order to provide this information. It would have been sufficient, but also necessary, to explain to which precise information (facts/incident/subject in temporal and local limitation together with the persons acting) the overriding legitimate interest in secrecy should relate. Only then would the necessary weighing of individual cases have been possible for the Board. If, in this case, the legitimate interests of third parties had outweighed the plaintiff's interest in information, only then would it have been possible to restrict the subject matter in the operative part in a second step.
210 Finally, insofar as the defendant objects that the plaintiff is asserting his request for information through his legal representative and that the plaintiff has not provided any proof of his authorization, the plaintiff, who was present at the appeal hearing, at any rate legitimized his legal representative accordingly at the time the request was made.
Translated with www.DeepL.com/Translator (free version)
