VG Wiesbaden - 6 K 361/21.WI
From GDPRhub
| VG Wiesbaden - 6 K 361/21.WI | |
|---|---|
 | |
| Court: | VG Wiesbaden (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 4(7) GDPR Article 5 GDPR Article 6(1)(f) GDPR Article 9(2)(f) GDPR § 1 BRAO § 138(2) ZPO § 138(3) ZPO § 3(1) BRAO |
| Decided: | 19.01.2022 |
| Published: | |
| Parties: | Der Hessische Landesbeauftragte für den Datenschutz und die Informationsfreiheit |
| National Case Number/Name: | 6 K 361/21.WI |
| European Case Law Identifier: | ECLI:DE:VGWIESB:2022:0119.6K361.21.WI.00 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Bürgerservice Hessenrecht (in German) |
| Initial Contributor: | Robert Straub |
The Administrative Court of Wiesbaden ruled that the processing of an employee's health data by the employer in the context of a labour court case does not constitute a breach of the GDPR.
English Summary
Facts
The data subject is a lawyer that is employed by the company A. In August 2018, he suffered a severe stroke due to which he has continuously been on sick leave since then.
In a labour court case against his employer in 2019, the employer hired a lawyer who disclosed information about the data subject's health during the proceedings. The data subject classified this as a violation of the GDPR because it was a special category of personal data (Article 9(1) GDPR) that should not have been processed.
The data subject requested the Hessian data protection authority to intervene against the alleged data protection violations.
The data protection authority refused to take action.
Holding
The Administrative Court of Wiesbaden dismissed the data subject's claim.
It held that, in the context of a labour court dispute, both the employer and the lawyer instructed by it are entitled to name and explain any health data of the employee. This applies all the more if the employee is the plaintiff and has brought the relevant circumstances into the proceedings himself.
First, it clarified that the lawfulness of the data processing of health data in legal proceedings is assessed according to Article 6(1)(f) GDPR and Article 9 GDPR.
Second, lawyers are data controllers within the meaning of Article 4(7) GDPR with regard to their presentation in court proceedings. As independent organs of the administration of justice in their capacity as advisors and representatives, they themselves bear the responsibility for the content of the pleadings in terms of liability and design.
Third, according to the court, in their pleadings, attorneys pursue the legitimate interest of fulfilling their contractual obligation with the client (cf. § 3(3) Federal Lawyer's Act [Bundesrechtsanwaltsordnung - BRAO]). The activity of a lawyer would be impossible if he were not basically allowed to present what the client informs him of. They would even expose themselves to the risk of attorney liability if, contrary to § 138(2), (3) Code of Civil Procedure (Zivilprozessordnung - ZPO), they did not dispute the submissions of the opposing party and presented the facts of the case from the perspective of their client.
Fourth, Article 9(2)(f) GDPR serves to secure the right to justice. If a legal claim can only be enforced by processing health data, these may also be used. The protection of this data should not go so far as to make the legitimate enforcement of rights impossible. Against the background of equality of arms and effective legal protection, the same must also apply to the defense of claims.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Judgment on the question of the admissibility of the lecture regarding health data in the process under data protection law
motto
1. The lawfulness of data processing of health data in court proceedings is assessed in accordance with Article 6 Paragraph 1 UA 1 Clause 1 f) in conjunction with Article 9 GDPR.
2. Lawyers are responsible with regard to their presentation in court proceedings within the meaning of Art. 4 No. 7 DS-GVO. As independent organs of the administration of justice, in their capacity as consultants and representatives, they themselves are responsible for the content of the pleadings with regard to liability and structure.
3. In their presentation, lawyers pursue the legitimate interest of fulfilling the contractual obligation with the client (cf. § 3 Para. 3 BRAO). The activity of a lawyer would be impossible if he were not fundamentally allowed to present what the client tells him. He would even expose himself to the risk of legal liability if, contrary to Section 138 Paragraph 2, Paragraph 3 ZPO, he did not dispute the arguments of the opposing party and presented the facts from the perspective of his client.
4. Art. 9 (2) lit. f) GDPR serves to secure the right to justice. If a legal claim can only be enforced by processing health data, these may also be used. The protection of this data should not go so far that the legitimate enforcement of rights is impossible. Against the background of equality of arms and effective legal protection, the same must also apply to defending against claims.
tenor
The charges get dismissed.
The plaintiff has to bear the costs of the proceedings.
The judgment is provisionally enforceable with regard to the costs. The plaintiff may avert enforcement by providing security in the amount of the costs to be determined, unless the defendant provides security in the same amount before enforcement.
facts
The plaintiff requests that the defendant intervene against a lawyer who represents the plaintiff's employer in a labor court case with the latter and who received confidential information from his employer from a conversation that had the subject of the plaintiff's continued employment opportunity and made it public to the labor court proceedings target.
The plaintiff is a qualified lawyer and is employed by A GmbH (hereinafter: employer) in department P. In August 2018, the plaintiff suffered a severe stroke. Against this background, he was awarded a degree of disability of 50. The plaintiff has been on uninterrupted sick leave since August 2018.
In an email dated June 21, 2019, the plaintiff contacted his employer and asked for an interview on operational integration management in accordance with Section 167 SGB IX ("BEM"). The plaintiff then proposed Ms. X, a representative of the works council, a representative of the disabled employees' representative, his superior Mr. Y and his brother Mr. Z as participants as participants. Other people should not come to it.
On August 29, 2019, the plaintiff then had a conversation with his employer regarding future work assignments. It is disputed whether this was a properly carried out BEM. Ms. X (HR business partner and leader of the interview), Mr. N (works council member and data protection officer; it is disputed whether he took part in the interview in the role of data protection officer), Mr. M (superior of the plaintiff), Mr. O ( representative for the severely disabled), the plaintiff's brother and the plaintiff himself. The plaintiff argues that no instruction on data protection law took place. He had been assured of strict confidentiality only verbally. It was therefore not a question of a BEM conversation.
The parties to the employment contract did not subsequently come to an amicable agreement regarding the plaintiff's employment.
With a lawsuit filed on November 20, 2019 at the Labor Court in Hanover (1 Ca.../19), the plaintiff asserted disability-friendly employment and claims for damages against his employer. Legal representative for the employer is law firm K (hereinafter: law firm). Attorney J (hereinafter: Attorney) acted for the employer in the process. In the labor court proceedings, the lawyer argued, among other things, that a possible reintegration of the plaintiff, the resumption of his employment, the medical certificate of September 8th, 2019 and the possibility of setting up a teleworking position had been discussed during the BEM discussion. The plaintiff stated that it would be more practical for him to set up a telework station at his primary residence in Munich. The lawsuit was dismissed by judgment dated March 4, 2020. There is no entitlement to employment suitable for the severely disabled. A prevention procedure according to § 167 paragraph 1 SGB IX was not carried out.
The plaintiff appealed against the judgment of the labor court in Hanover. A decision has not yet been made on this case (12 Sa 723/20), which is pending at the Lower Saxony State Labor Court.
On July 3rd, 2020, the plaintiff contacted the data protection officer of the state of Lower Saxony. He also wrote to the lawyer's office and described what he believed to be data protection violations.
With e-mails dated August 6th, 2020 and August 8th, 2020, the plaintiff sent a complaint to the local defendant. It is about the unauthorized collection, storage and use of highly personal personal data, in particular health and severe disability data.
The lawyer for his employer quoted several times and extensively from the conversation on August 29, 2019, both verbally in the court hearings and in the briefs submitted to the Labor Court in Hanover, without the plaintiff’s consent. His sensitive, private, confidential personal data was knowingly disclosed to the public. The collection of the data by the lawyer is illegal. The lawyer had illegal access to the BEM file. She then illegally viewed and illegally stored this data. The lawyer even quoted verbatim from the BEM interview. It should also be examined to what extent the data protection processes and protective measures of the law firm are sufficient. He asked for the prosecution and punishment of all data protection violations. The repeated, sustained and persistently serious data protection misconduct on the part of the lawyer must be comprehensively clarified and sanctioned. Similar illegal behavior must be prevented in the future.
The defendant contacted the plaintiff on September 9th, 2020, October 30th, 2020 and December 10th, 2020 with interim messages. The Lower Saxony State Commissioner for Data Protection is responsible for the question of whether the plaintiff was informed correctly in terms of data protection before the interview on August 29, 2019. With regard to further content, reference is made to the interim messages.
The plaintiff then stated that he had never given his consent for his data to be passed on to the lawyer. The actions of the lawyer are extremely serious within the meaning of Art. 82 DS-GVO. In particular, she acted with the intention of harming him. This negative "culmination" of the whole thing is now very topical, that the lawyer in the brief to the Lower Saxony State Labor Court of September 17th, 2020 refers to her first instance presentation.
The plaintiff's employer made a statement to the state commissioner for data protection of the state of Lower Saxony in a letter dated October 9th, 2020. The plaintiff himself made the contents of the conversation of August 29, 2019 the subject of the dispute in the labor court proceedings and introduced the relevant facts himself. Contrary to the claim of the plaintiff, the lawyer did not have access to the BEM file. Ms. X summarized the content of the conversation verbally and generally in a conversation with the lawyer so that she could verify and examine the facts described by the plaintiff in his statement of claim. The BEM discussion was also not discussed separately in the quality and chamber meeting. The employer described in detail the modalities of BEM talks that were carried out on the basis of a group works agreement.
The lawyer explained to the defendant in a statement dated January 14, 2021 that she had been mandated in December 2019 to handle the employment law dispute. She had not looked into the plaintiff's BEM file. The content of the BEM conversation was summarized orally so that she could verify and examine the plaintiff's presentation. When the plaintiff stated at the conciliation appointment that it had not been a BEM interview because the company doctor had not attended, the letter of invitation and a copy of the plaintiff's reply were sent to her. This examination revealed that the plaintiff had been offered the participation of the company doctor, but had declined this offer. Only the information brought into the process by the plaintiff was presented from the perspective of the employer. No information about any illnesses suffered by the plaintiff was used in the litigation that he had not previously introduced himself. In the appeal proceedings, too, the plaintiff made full reference to his submissions in the first instance, so that she did the same in defense of the employer. The data processing was carried out on the basis of Section 26 (3) BDSG in conjunction with Article 9 (2) b) and f) GDPR.
The plaintiff then made a statement to the defendant again. For further details, reference is made to the brief of February 20, 2021.
With the decision at issue dated March 1, 2021, the defendant informed the plaintiff that the processing of personal data by the lawyer was not objectionable from a data protection perspective.
A separation of the personal health data into "usable" and "not usable" was impossible for a person not involved in the conversation on August 29, 2019 and could therefore not be requested. There are also no indications that the lawyer deliberately processed personal data that she was not allowed to process. Since no instruction on data protection law took place before the conversation on August 29, 2019, the personal data collected there are not particularly protected per se.
It is the subject matter of the labor court proceedings to be considered. The plaintiff took this as far as possible with the "search for working conditions suitable for the severely disabled" in the reply of February 20, 2021 on page 3. It was not apparent that the lawyer had completely removed herself from this subject of the dispute or had otherwise processed the plaintiff's personal data in an inadmissible and excessive manner.
The processing of personal data need not necessarily be based on the consent of the data subject. The aim of data protection should not be that the administration of justice comes to a standstill. The legal basis can be seen in Art. 9 Para. 2 b) and f) GDPR. According to Section 22 (1) No. 1b BDSG, the processing of health data for the assessment of an employee's ability to work is also permissible. In this case, even a change of purpose for the assertion, exercise or defense of civil law claims is permissible, Section 24 (2) in conjunction with Section 24 (1) No. 2 BDSG.
The plaintiff himself introduced relevant personal data into the labor court process, against which the employer had to defend herself. This justifies the need to process specific health data, as otherwise the risk of losing the process increases significantly. By filing an action, an independent legal relationship was established, which justifies the processing and establishes a basis of trust in relation to the lawyer. It contradicts the principle of provision if certain information in the form of personal data is excluded from the outset as factual information. The 23 verbatim quotes from the lawyer all have a specific connection to the subject of the dispute. It is clear that the quotations relate to the plaintiff's submissions. In terms of content, too, these only revolved around general living conditions and spatial conditions and did not concern any really sensitive health data.
For these reasons, no further action will be taken in the matter and the process will be closed. In the instruction on legal remedies, a complaint to the administrative court in Wiesbaden is pointed out within one month.
With a brief dated March 19, 2021, received by the court on March 22, 2021, the plaintiff brought the present action.
The plaintiff repeats and deepens his arguments from the administrative procedure and adds that during the conversation on August 29, 2019 he was verbally promised that there would be maximum confidentiality and that no word spoken in the room would leave the room.
The present action is admissible as a general action for performance. His application is not aimed at a specific administrative act by the defendant, but at a general supervisory intervention. In this respect, the instruction on legal remedies in the letter dated March 1, 2021 is incorrect.
Nor is his complaint simply a petition.
He has a right to supervisory action and even to the imposition of a fine due to a reduction in discretion to zero. The lawyer seriously and persistently violated the existing data protection rights of the plaintiff and still violates them today.
The defendant also assumes that the personal data that are the subject of the complaint are not personal data. Art. 4 GDPR applies here. The GDPR also does not distinguish between "health data" and "really sensitive health data". In addition, the lawyer had newly introduced into the labor court proceedings, independently of the plaintiff's submission, that the plaintiff was "100% fit for work again after the end of his sick leave and without reintegration", that the plaintiff was taking medical care at his primary residence and that it was the During the conversation, the plaintiff obviously found it difficult to talk about what he had experienced and the illness and that he didn't seem very open overall in the conversation. The defendant may not make a general assessment based on a general "overall feeling" without applying the law.
The defendant unlawfully extended the subject matter of the plaintiff's complaint to other personal data from the plaintiff's court briefs from the labor court proceedings before the Hanover Labor Court. He is only concerned with the illegal processing of his personal data from the conversation on August 29, 2019 by the lawyer. Nor did he lodge any further complaints.
The defendant also refuses to apply the GDPR by relying on aspects of proportionality that override the obligation to apply law and order.
There would also be errors of discretion within the framework of Art. 58 DS-GVO. There would be a loss of discretion, since the defendant does not even see that the scope for discretion of Art. 58 DS-GVO is also open to the exercise of rights and obligations under labor law. The automatism assumed by the defendant, that there are extensive possibilities of use and exploitation if there are court proceedings in the field of labor law, is comprehensively misguided and incorrect in law. Even in the event of court proceedings, the data protection legislator assumes that a comprehensive weighing of interests and legal interests is necessary. The defendant does not even see the plaintiff's basic right to informational self-determination. In addition, there is a misuse of discretion due to the incorrect interpretation of Art. 9b) and f) GDPR. The defendant does not differentiate between data within the meaning of Art. 6 and Art. 9 GDPR. There is also a misuse of discretion due to the lack of any proper exercise of discretion in the form of the necessary careful weighing of interests and legal interests. In addition, the defendant misunderstood the prohibition on the use of unlawfully obtained personal data. It cannot be that those affected enjoy less protection in the absence of data protection instructions than if they had been properly instructed before the interview. Even personal data lawfully collected in the BEM procedure may not be used in court proceedings (prohibition of change of purpose).
If the plaintiff wants to fight for his right, this does not entail any permission for the defendant to use his personal data. The civil procedural law also does not justify violations of the fundamental right of a person concerned to informational self-determination. Section 24 BDSG and Section 26 (3) BDSG (in conjunction with Article 9 (2) b) and f) GDPR) could also not apply. These norms are both exceptions to be handled restrictively. Section 22 (1) no. 1 b) BDSG is not relevant at all.
In addition, the "final notification" of March 1, 2021 is not proportionate. The "final notification" is also based on the legal errors pointed out by the plaintiff. The plaintiff's fundamental right to informational self-determination leads to a duty of protection on the part of the defendant through a reduction in discretion to zero. Regulatory intervention can only consist of imposing an appropriate fine on the lawyer. Among other things, the seriousness of the violations of data protection law committed by the lawyer had to be taken into account.
The plaintiff requests
1) annul the defendant's final notification of March 1, 2021,
2) order the defendant to use supervisory means against the data protection violations committed by the person to be summoned, Ms J, at the expense of the plaintiff,
3) order the defendant to impose an appropriate fine against the data protection violations committed by the person to be summoned, Ms. J, at the expense of the plaintiff,
4) alternatively, in the event of defeat under lines 1-3,
to oblige the defendant to make a new decision on the plaintiff's complaint of August 6, 2020, taking into account the legal opinion of the court, while repealing the defendant's final notification of March 1, 2021.
The defendant requests
reject the complaint.
The defendant refers to the statements in the decision of March 1st, 2021 and deepens them. A distinction should be made between the legal review of the treatment of personal data in the BEM interview and the data that the lawyer used in the labor court process. Reference is made to Section 29 (3) BDSG and the restriction of investigative powers under Article 58 (1) e) and f) GDPR. As far as possible, the defendant exercised his investigative powers under Article 58 (1) GDPR and fulfilled his duties under Article 57 (1) (a) GDPR.
With a decision dated November 3rd, 2021, the court rejected the claim for bias brought by the plaintiff against the presiding judge at the VG S. and with a decision dated December 15th, 2021 rejected the objection to a hearing.
The oral hearing took place on January 19, 2022. Reference is made to the minutes of the meeting. The plaintiff did not appear at the hearing. Insofar as the plaintiff has again applied for a postponement, reference is made to the decision of January 19, 2022, with which this application was rejected.
With regard to further details, reference is made to the mutual briefs and attachments as well as the content of the court files and the defendant's official files consulted (1 folder) together with excerpts from the files of the ArbG Hanover, 1 Ca .../19 and the LAG Lower Saxony, 12 Sa .../20 , referenced.
Reasons for decision
Despite the plaintiff's absence, the court was able to negotiate and decide on the matter, since the parties involved were properly summoned and informed of this possibility in the summons (Section 102 (2) VwGO). In particular, the plaintiff's application to postpone the oral hearing on January 19, 2022 was rejected by resolution. Please refer to the minutes of the meeting for the justification.
The lawsuit is already partially inadmissible.
Within the scope of admissibility, the plaintiff's applications must first be interpreted, § 88 VwGO. A general action for performance (“to be imposed”), as requested by the plaintiff, is not an admissible type of action, but an action for obligation according to § 42 Para. 1 Alt. 2 VwGO. Both the decision at issue (referred to by the plaintiff as a final notification) and the intervention of the defendant requested by the plaintiff are administrative acts within the meaning of § 35 S. 1 HVwVfG (aA VG Ansbach, judgment of 16.3.2020 - AN 14 K 19.00464 – juris para. 15 without further justification). In this context, claims 1) and 2), as well as 1) and 3) should be seen in context, since this is the only way to make clear the cassatory element of the action for obligation.
However, there is no need for legal protection for claim number 2, since this does not meet the requirement for certainty. Pursuant to Section 42 (1) alternative 2 VwGO, the conviction to issue a rejected or omitted administrative act can be requested. The content of the administrative act must be described in detail (Wysk, 3rd edition 2020, VwGO § 42 marginal number 57). In the case of inaccuracies, the enforceability of a judgment made according to the application is lacking. That's how it is here. The plaintiff does not indicate how the defendant should intervene. According to the catalog of Art. 58 Para. 2 DS-GVO, the defendant as the supervisory authority has several powers, in particular the issuing of a warning or warning, an instruction or the imposition of a ban on processing. A further specification of the application by the court is out of the question, since it runs the risk of going beyond the plaintiff's request, contrary to § 88 VwGO. Incidentally, the plaintiff is a qualified lawyer who can be expected to submit an enforceable application.
Otherwise - with regard to the main requests 1) and 3) - the action is admissible.
As a possible person affected by a violation of data protection law, the plaintiff is entitled to sue within the meaning of Section 42 (2) VwGO, because being affected could result in a claim for the defendant to intervene in the form of a fine in accordance with Article 58 (2) (i) GDPR (cf . Also VG Ansbach, judgment of March 16, 2020 - AN 14 K 19.00464 - juris para. 16ff).
A preliminary procedure does not take place in accordance with Section 68 Paragraph 1 Sentence 2 2nd Alternative No. 1 VwGO in conjunction with Section 8 Paragraph 1 HDSIG. The one month period of § 74 Abs. 2 VwGO is maintained.
According to Section 20 Paragraph 5 No. 2 BDSG, the correct respondent is the Hessian State Commissioner for Data Protection and Freedom of Information. The Hessian representative for data protection and freedom of information is the responsible supervisory authority according to § 13 HDSIG. According to § 20 paragraph 1 BDSG in conjunction with § 19 paragraph 3 HDSIG, this is eligible if there are disputes between a natural or legal person and a supervisory authority, here a country, about the rights according to Art. 78 paragraphs 1 and 2 DS- GMO goes.
According to § 20 paragraphs 1 and 3 BDSG in conjunction with Article 78 paragraph 2 DS-GVO, the Administrative Court of Wiesbaden has local jurisdiction.
The lawsuit is unfounded with regard to the admissible applications.
The plaintiff has neither a right to intervention by the defendant against the lawyer nor a right to a new decision in compliance with the legal opinion of the court, Section 113 (5) VwGO.
The disputed decision of March 1, 2021 is fully judicially reviewable (cf. in detail VG Wiesbaden, judgment of June 7, 2021 - 6 K 307/20.WI).
According to Art. 77 Para. 1 DS-GVO, without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement, if the data subject is of the opinion that the processing of your personal data violates the General Data Protection Regulation. According to Art. 57 (1) lit. a) GDPR, each supervisory authority must monitor and enforce the application of the GDPR. Art. 58 DS-GVO regulates the powers of the supervisory authority (in this sense also ECJ, judgment of June 14th, 2021, Az. C-645/19).
There is no entitlement to the imposition of a fine pursuant to Article 58(2)(i) GDPR. The imposition of a fine requires a violation of the GDPR.
The lawyer's data processing was and is lawful.
When processing the data, the lawyer did not violate the GDPR, in particular Art. 5 Para. 1 GDPR. Rather, the data processing, including that of the plaintiff’s personal data, took place lawfully in accordance with Article 6 (1) UA 1 Sentence 1 f), Article 9 (2) (f) GDPR. Regarding the question of the applicability of § 26 BDSG, reference is made to the submission to the ECJ (Wiesbaden Administrative Court, decision of January 27th, 2021, Az. 23 K 1360/20.WI).
The lawyer is "responsible" within the meaning of Art. 4 No. 7 DS-GVO and would therefore be the correct addressee of a fine notice. According to this provision, the person responsible is the one who alone or jointly with others decides on the purposes and means of processing personal data.
Lawyers are an independent organ of the administration of justice, § 1 BRAO. The lawyer is the appointed independent advisor and representative in all legal matters, § 3 para. 1 BRAO. In this capacity, he regularly processes personal data on the basis of a mandate. The focus of the activity is on the professionally anchored independent activity. A lawyer is therefore to be classified as the person responsible under data protection law (cf. Kühling/Buchner/Hartung, 3rd edition 2020, DS-GVO Art. 28 para. 47). This results in particular from its legal status as an independent organ of the administration of justice according to § 1 Para. 1 BRAO and its independent advisory and representative capacity according to § 3 Para. 1 BRAO. The lawyer himself is responsible for the content of the pleadings with regard to liability and the design (cf. BeckOK DatenschutzR/Spoerr, DS-GVO, 34th Ed. November 1st, 2020, Art. 28).
There is also data processing within the meaning of Art. 4 No. 2 DS-GVO. According to Art. 4 No. 2 DS-GVO, a processing operation is any operation carried out with or without the help of automated processes or any such series of operations in connection with personal data such as collecting, recording, organizing, organizing, storing, adapting or Modification, reading, retrieval, use, disclosure by transmission, distribution or any other form of provision, comparison or linking, restriction, deletion or destruction.
According to Art. 6 Para. 1 UA 1 S. 1 f) in conjunction with Art. 9 DS-GVO, data processing is lawful if the processing is necessary to protect the legitimate interests of the person responsible or a third party, provided that the interests or fundamental rights and freedoms are not violated of the data subject, which require the protection of personal data, prevail.
For the question of whether there is a legitimate interest, the interest of the person responsible must first be considered on the basis of the intended purpose. For example, legal, economic or non-material interests come into consideration (Gola, DS-GVO/Schulz, DS-GVO, 2nd edition 2018, Art. 6 para. 57).
In the present case, it is in the lawyer's interest to fulfill the contractual obligation with the client, the employer (cf. § 3 Para. 3 BRAO). For this purpose, it is required to take over the legal representation in the labor court proceedings and to present the case. In addition, the lawyer did not declare herself about the plaintiff's data in her own name, but as a representative and on behalf of the party about the facts reported to her by the client. The statements of a lawyer in the process are party presentations.
The processing is also necessary to safeguard the legitimate interests of the client, in this case the defendant employer. The activity of a lawyer would be impossible if he were not fundamentally allowed to present what the client tells him. He would even expose himself to the risk of legal liability if, contrary to § 138 Paragraph 2, Paragraph 3 ZPO, he did not dispute the arguments of the opposing party and presented the facts from the perspective of the client. Out of legal caution, the lawyer is required to present and dispute comprehensively.
The balancing of interests to be carried out within the framework of Art. 6 Para. 1 UA 1 S. 1 f) DS-GVO between the legitimate interest of the person responsible or a third party (here the client) in the processing and the interest of the plaintiff in the confidentiality of his data goes out in favor of the lawyer.
The data used by the lawyer are neither incorrect nor obtained by them in an illegal manner. She was not present at the conversation on August 29, 2019. She also extensively stated that she herself had no insight into the "BEM file" and, based on the plaintiff's statement, asked the employer questions to clarify the facts. There is no doubt about that.
In this context, it does not matter whether it was an effective "BEM talk". Even if "BEM" was carried out effectively, the lawyer would not betray any secrets. This may use all the circumstances, because they themselves are not subject to secrecy due to the lack of participation in the conversation. Otherwise she would violate the interests of the client and her obligations from the client relationship. However, this is not important in the present case, since the plaintiff himself submitted in the labor court proceedings that it was not an effective "BEM". Accordingly, the content of the conversation cannot be subject to secrecy. The content of the conversation can be used even more. The plaintiff, who holds a doctorate in law, should have recognized this.
In addition, the plaintiff himself introduced the data and thus health data into the proceedings by initiating the proceedings at the labor court with his complaint and by enforcing the subject matter of these proceedings by asserting his right to employment suitable for suffering.
The processing of the plaintiff's health data according to Art. 9 Para. 1 DS-GVO is permissible. Because it fulfills the requirements of Art. 9 Para. 2 lit f) GDPR for data processing through the presentation and storage in the process.
In principle, according to Art. 9 Para. 1 DS-GVO, the processing of health data of a natural person is prohibited. However, Article 9(2)(f) GDPR states that this prohibition does not apply if the processing is necessary for the establishment, exercise or defense of legal claims or for actions taken by the courts in the context of their judicial work.
This norm serves to secure the right to a guarantee of justice (cf. Art. 47 GRCh, Art. 20 Para. 2 S. 2, Para. 3 GG). If a legal claim can only be enforced by processing special categories of personal data, in this case sensitive health data, this should not fail (Kuhling/Buchner/Weichert, 3rd ed. 2020, DS-GVO Art. 9 para. 83). The data protection regime should not go so far that the legitimate enforcement of rights is no longer possible (Paal/Pauly/Frenzel DS-GVO Art. 9 para. 37). Against the background of equality of arms and effective legal protection, the same must also apply to defending against claims.
Art. 9 (2) lit. f) GDPR refers to the national procedural regulations, which are intended to ensure an appropriate balance of interests of the parties involved. An explicit reference to national regulations was therefore not necessary (Kuhling/Buchner/Weichert, 3rd edition 2020, GDPR Art. 9 para. 87).
The subject of the dispute in the proceedings before the ArbG Hannover and the LAG Niedersachsen is the claim to employment that is suitable for suffering, as asserted by the plaintiff in his applications and written pleadings. For this purpose, the plaintiff himself presented medical certificates, an e-mail from Mrs. X, which deals with the content of the "BEM" and an e-mail from him to the employer, which also refers to the "BEM". .
If one follows the argumentation of the plaintiff, the right to guarantee justice would be unilaterally undermined at the expense of the defendant in the labor court proceedings. The special position of the lawyer as an independent organ of the administration of justice must also be taken into account, § 1 BRAO. It follows from § 3 Para. 3 BRAO that everyone has the right, within the framework of the statutory provisions, to be advised by a lawyer of their choice in legal matters of all kinds and to be represented before courts, arbitral tribunals or authorities. Section 11 (2) sentence 1 ArbGG also provides for this. That would be impossible if the lawyer were prevented from speaking at the trial in the present case.
Since the lawyer's data processing was and is lawful, claim 4), which must be decided due to the lack of success of claims 1) to 3), is also unsuccessful for the reasons listed above.
Since the behavior of the lawyer in the labor law process is not objectionable, the defendant's discretionary power is reduced to zero with regard to non-intervention.
The decision on costs follows from Section 154 (1) VwGO.
The statement regarding the provisional enforceability regarding the costs results from § 167 VwGO in conjunction with §§ 708 No. 11, 711 ZPO.
