BAG - 8 AZR 253/20
From GDPRhub
| BAG - 8 AZR 253/20 | |
|---|---|
 | |
| Court: | BAG (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 2(1) GDPR Article 4(1) GDPR Article 4(2) GDPR Article 4(7) GDPR Article 4(15) GDPR Article 5(1)(a) GDPR Article 5(1)(f) GDPR Article 6(1) GDPR Article 6(3) GDPR Article 9(1) GDPR Article 9(2)(h) GDPR Article 9(3) GDPR Article 32(1)(a) GDPR Article 32(1)(b) GDPR Article 82(1) GDPR Article 99(2) GDPR § 22(2) BDSG § 276(2) SGB V § 35(2)(2) SGB I |
| Decided: | 20.06.2024 |
| Published: | |
| Parties: | Employee Medizinischer Dienst Nordrhein [North Rhine Medical Service] |
| National Case Number/Name: | 8 AZR 253/20 |
| European Case Law Identifier: | ECLI:DE:BAG:2024:200624.U.8AZR253.20.0 |
| Appeal from: | [[:Category:LAG Düsseldorf [Germany]|LAG Düsseldorf [Germany]]] 12 Sa 186/19 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | BAG (in German) |
| Initial Contributor: | Ava Lang |
A court held that the processing of health data by a medical service commissioned by a statutory health insurer to assess a worker’s disability is allowed under Article 9(2)(h) GDPR, even if the worker is employed by the medical service and without having to ensure that no other employee has access.
English Summary
Facts
On 01 September 1999, the data subject started working for the controller, a medical service responsible for providing health assessments for health insurers.
Starting on 22 November 2017, the data subject became unable to work due to illness. Their health insurer ordered an assessment of the data subject's disability on 06 June 2018 due to doubts about their inability to work. This assessment was to be done by the controller, who also happened to be the employer of the data subject. The controller had specific rules in form of a "special case" unit of 36 people in place for this occurrence to prevent preferential treatment or discrimination for its employees. A developed role concept within this unit ensured that the relevant expert assessments were not processed by employees who worked with the person concerned in a department, which was also technically secured with separate storing of key and file. Merging was only possible using a key stored in an encryption library.
An employee the data subject was familiar with produced the required assessment report for the controller and the health insurer in cooperation with the data subject's doctor via a phone call.
On 01 August 2018, the data subject requested a coworker to check whether an assessment report about them was available in the database and to send a picture of it. The coworker complied.
On 15 August 2018, the data subject requested compensation of €20,000 from the controller outside of court, but they denied the claim. The data subject also sought material damages in the second instance by way of a payment and declaratory action, each based on Article 82(1) of the GDPR and § 823(1) of the German Civil Code (BGB) in conjunction with Article 2(1) and Article 1(1) of the Constitutional Law (GG).
The controller then expressed an immediate termination on 05 December 2019 and 12 December 2019 respectively.
The data subject alleged the controller violated their right to privacy based on Article 82(1) GDPR, saying the controller shouldn't have performed its duties as a medical service to gain access to his medical information as an employee. They considered the processing of their health data by the controller to be unacceptable primarily because the controller was their employer. Instead, another medical service should have been tasked to do the assessment. They also claimed that the controller shouldn't have let employees that used to work with the data subject access their medical information, as it detailed a psychological diagnosis that is very sensitive in nature and could spread via gossip across departments, embarrassing the data subject. They also objected to the manner in which the data was collected by the medical expert, who should not have obtained information from their doctor by phone without consent. Based on this, the data subject filed a claim before the LAG Düsseldorf for at least €20,000 from the controller.
The controller filed to dismiss the claim. They insisted they are allowed to perform their statutory duties even in the case of their own employee, as § 276 SGB V and § 25 SGB I lay down what type of information is allowed to be processed in these cases irrespective of the GDPR.
The LAG Düsseldorf denied the claim on 22 February 2019 in the decision 4 Ca 6116/18. It held that processing the health data is allowed and necessary based on Article 6(1)(c) GDPR in connection to §§ 275, 276 SGB V.
The data subject appealed this decision, saying the LAG did not honor the circumstances of employees seeing other employee's sensitive medical data enough in its verdict. They held that the court needed to consider the categories of data (as health data is sensitive data under Article 9(3) GDPR) and apply the principle of proportionality. The controller filed to dismiss the appeal, as they were in support of the decision.
The LAG Düsseldorf decided the appeal was unfounded on 11 March 2020. The data subject then appealed once more, now involving the Federal Labour Court (Bundesarbeitsgericht).
The new appeal included the aforementioned compensation of at least €20,000 from the controller, paying for material damages of lost earnings amounting to €5,812.00 gross for 2018 and 2019 respectively, plus the determining that the controller is obligated to compensate the data subject for the material damages that they have suffered or will suffer as a result of the violation of their personal rights. The controller has moved to dismiss the lawsuit.
Holding
The court dismissed the data subject’s admissible appeal as unfounded, holding that no claim to monetary compensation under Article 82(1) GDPR can be established.
Referring to CJEU case law, the court emphasized that such a claim requires three cumulative conditions: a breach of the GDPR, the existence of damage (material or non-material), and a causal link between the two. These conditions were not met.
The court found no breach of the GDPR. The processing of the data subject’s health data for a medical assessment regarding fitness for work complied with Article 9(2)(h) in conjunction with Article 9(3) GDPR. Processing was deemed necessary under Member State law and carried out by medical personnel for purposes aligned with public and individual health interests, consistent with Recital 53 GDPR.
Additionally, the processing satisfied the general lawfulness requirements under Article 6(1)(c) and (3)(b) GDPR, being necessary to fulfill a legal obligation based on German law. The court confirmed that processing was grounded in national law, particularly § 275 SGB V, which requires health insurers to obtain expert opinions under certain conditions. Consent for a phone call to the doctor was not required, and the controller was authorized to collect data from treating physicians. It was also noted that the assessment, performed by the controller, serves both the insured individual's and society’s interest in ensuring effective and efficient administration of statutory health services.
No further obligations were found under Article 9(3) GDPR regarding internal access restrictions, and the German legislature has not introduced additional conditions for processing health data.
The controller implemented sufficient technical and organizational safeguards in accordance with Article 5(1)(f) and Article 32(1)(a)–(b) GDPR. Processing was conducted solely by specialist personnel tasked with handling the special cases and they were bound by confidentiality. A coworker’s access to the data initiated by the data subject and contrary to the controller’s instructions did not constitute a security failure according to court. As such, no damages were found.
Finally, the principle of proportionality was found to be respected by the court. The processing was limited to what was necessary for the assessment, and it is not apparent to the court that there were other, equally suitable, less burdensome ways to achieve the processing objectives. Based on the findings of the Regional Labor Court, there are no indications that the controller processed the data subject's health data for purposes other than preparing a medical opinion or that the processing did not comply with the safeguards.
Comment
Referenced in the decision is a request to the CJEU for a preliminary ruling on legal questions concerning the interpretation of Article 9(1), Article 9(2), Article 9(3), Article 6(1), and Article 82(1) of the GDPR, found in case C-667/21 Krankenversicherung Nordrhein from December 21, 2023, which is relevant to know and shaped the decision on the matter.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Operative Part
The plaintiff's appeal against the judgment of the Düsseldorf Regional Labor Court of March 11, 2020 – 12 Sa 186/19 – is dismissed.
The plaintiff shall bear the costs of the appeal.
Principle
1. The processing of health data by a medical service commissioned by a statutory health insurance fund to prepare an expert opinion to dispel doubts about the incapacity to work of an insured person may be permissible under Article 9 (2) (h) GDPR even if the insured person is an employee of the medical service.
2. An employer who, as a medical service, processes the health data of its own employee is not, under the provisions of the General Data Protection Regulation or national law, obliged without exception to ensure that no other employee has access to this data.
Facts
1
The parties are disputing the plaintiff's claims for material and non-material damages due to violations of data protection regulations and the violation of the plaintiff's general personality rights.
2
The defendant – formerly the Medical Service of the Health Insurance (MDK) North Rhine and now the Medical Service North Rhine (hereinafter the defendant) – is a public corporation. It provides expert opinions on behalf of statutory health insurance funds under social health insurance law. In 2018, it employed more than 1,000 people across eight locations in the North Rhine region.
3
The plaintiff, who has been employed by the defendant since 1991, most recently worked as a system administrator and helpdesk employee in the defendant's IT department. Since November 2017, he has been continuously unable to work due to illness. From May 2018, he received sick pay from his statutory health insurance provider.
4
In 2018, the defendant, as part of its duties as the Medical Services (MDK), prepared several hundred thousand medical reports/expert opinions for social insurance providers. Data processing was carried out using a specific software program, the "Information System of the Medical Services of the Health Insurance" (ISmed for short), most recently the ISmed 3 system. In April 2015, the defendant, which consistently appointed a data protection officer, and the staff council concluded a service agreement (hereinafter referred to as the "DV") regarding the use of ISmed 3. This agreement stipulates, among other things, that: regulated:
"2. Scope
This service agreement applies to all employees who have access to the lSmed 3 software.
3. Subject
The subject of this service agreement is the introduction, deployment, and use of the lSmed 3 software in the MDK North Rhine, including the hardware and software used for this purpose, as well as the associated and resulting measures:
...
6. Personal Identification in the System
A soft certificate is required for the login process and for working in lSmed 3.
...
7. Access Rights
Access to the lSmed 3 software is granted using a soft certificate.
Access rights in lSmed 3 are determined by assigning rights and roles (see Appendix 2 - Role Concept, Escalation Routines and Rules). ...
8. Evaluations
Personal data (who performs which action) is logged in the attribute history and process history in the system and can be used for network and operational security purposes.
...
The The staff council will be informed about which personal data from ISmed 3 is imported and evaluated in QlikView (...). These data must be anonymized when transferred to the evaluating bodies. ...
Access to anonymized or non-anonymized data for the purpose of individual behavior and performance monitoring will not be permitted unless the statutory participation process has been completed beforehand. Evaluating bodies working with QlikView may not have access to the key tables. The password-protected encryption key is opened by the data protection officers in the presence of the staff council.
...
10. Data Protection
Data protection is ensured on the basis of the statutory provisions of the Federal Data Protection Act, the State Data Protection Act, the Social Data Protection Act, etc. Appropriate organizational measures are taken to comply with the specific requirements for employee data protection pursuant to Section 35 of the German Social Code (SGB I).
5
Appendix 2 to the IT system, entitled "Role Concept in ISmed 3," states:
"In order to perform certain activities, each employee requires various rights within ISmed 3. The sum of the various individual rights is reflected in the roles. There are currently six standard roles in ISmed 3, but these can be expanded or supplemented at any time. A user can have multiple roles if their area of responsibility requires it. The roles are:
(1) Occupational Group-Related Roles
▪
'Administrative Staff' for Assistants
An administrative staff member can, for example, create orders, enter documents, edit and forward reports.
...
▪
'Expert Reviewer' and 'Expert Function' for Expert Reviewers:
An expert reviewer creates assigned reports.
Each location has a group work basket for experts. The Expert Reviewer role controls the view and access to the group work basket. Experts.
Experts also have the role of Expert Function, which grants them approval authorization for expert opinions.
▪
…
(2) Location Reference
The group work baskets are branched out for each established regional or functional location. They only become visible to employees when they receive at least one assignment.
▪
…
▪
The administrators and the internal auditor are set up with the virtual location 'A (Maintenance)' as the primary organizational unit.
▪
A virtual location 'Special Case' has been set up for processing expert opinions from employees and their dependents.
(3) Additional Roles
The individual combination of roles and rights for an employee always has at least one location reference (primary organizational unit) and represents a professional group-related role. In addition, additional roles can be assigned to employee groups with special tasks. …
6
In the event that an expert opinion assignment involves an employee employed by the employee the defendant issued an “Instruction for the Protection of Social Data of Employees of the MDK Nordrhein and Their Families” (hereinafter DA). It states:
"1. Aim and Purpose
... This instruction serves the purpose of complying with the legal obligation pursuant to Section 35 (1) Sentence 3 of the Social Code (SGB I) and Section 94 (3) of the Social Code (SGB XI) and avoiding even the appearance of a conflict of interest.
The North Rhine-Westphalia Medical Center (MDK) is particularly concerned with avoiding any resulting preferential treatment or discrimination and ensuring special protection of social data.
Therefore, social data of employees and their dependents should neither be collected nor stored at the employee's place of work.
This requires that the employee report such situations to their health/nursing care insurance provider. The health/nursing care insurance provider is informed of this upon every contact, e.g., even in the case of appeals against benefit decisions, since the case was already closed by the MDK after the expert opinion was prepared and, in this case, would otherwise not be designated as a special case without further notification.
...
3. Definitions
3.1 Social data of employees and their dependents Relatives
...
Social data of employees or their relatives arise when the MDK North Rhine is commissioned by the responsible health or nursing care insurance fund to assess the social-medical requirements for benefits under the Social Code (SGB) for an MDK employee or their relatives. This data should not be confused with 'employee data' that is created or processed within the framework of an employment/service relationship.
3.2 Authorized Access Persons
As defined by these instructions, authorized access persons are employees who, due to their contractual duties, have knowledge of the social data of employees and their relatives or who have been granted access to this data (responsible assessors and assistants). The names of the responsible employees are listed in the attached 'Access Concept'.
4. Principle
Employees and their relatives may not be assessed at their place of employment or office. The relevant documents may not be kept there, nor may the resulting social data be stored there. The following regulation applies to lSmed 3: For all employees working at location A, the designated employees of the "Special Case" organizational unit in B are responsible. For employees at the other locations, the designated employees of the "Special Case" organizational unit in A are responsible.
The social data may only be used by authorized persons for the processing purposes provided. Disclosure to unauthorized third parties is prohibited.
5. Procedure
5.1. Special Case Organizational Unit
a)
lSmed 3
The affected employee or family member must inform their health insurance company prior to commissioning the MDK that their documents may only be submitted to the BBZ, which is responsible for processing special cases. To send the order documents, they must submit the marked envelope, which is already correctly addressed to the "Special Case" organizational unit, to their health insurance company.
Assessment orders under Book V of the Social Code (SGB V) (health insurance) that concern MDK North Rhine employees or their family members must be received by the responsible "Special Case" organizational unit and may only be processed there.
If the order for an assessment of an employee or family member of an employee is mistakenly received by the BBZ without a marked envelope, the order will be forwarded in accordance with the attached "Brief Information on Special Cases." Setting the 'Special Case' attribute transfers an already created case and its associated documents to the 'Special Case' organizational unit. The case is no longer visible to other employees. The ordering health insurance company receives a submission notification.
...
5.2 Special Case/Files
a)
ISmed 3
Incoming cases are marked as 'Special Case' upon entry and processed exclusively by the designated employees of the 'Special Case' organizational unit. The cases must be processed as the product type 'Special Case with Statement' or 'Hospital Special Case' and stored in the electronic archive.
...
...
5.4. Archiving
a)
ISmed 3
After completing the assessment order under SGB V (Health Insurance), complete the order with the expert opinion, including the electronic medical documents remaining with the MDK North Rhine, and store them in the electronic archive.
…
5.5 Assessment orders involving a physical examination for employees/relatives of the MDK Nordrhein
In the case of an assessment order under SGB V or SGB XI that would include a physical examination for an employee/relative of an employee, the assessment will be carried out by the Social Medical Service of the Knappschaft (Miners' Welfare Association).
a)
lSmed 3
If the assessor determines that a physical examination is unavoidable in a special case, the documents will be handed over to the assistants of the 'Special Case' organizational unit for further action:
The assessor closes the case with the code:
'90 Recommended for assessment' (see 'Special Case Training Document').
The case is closed as product type 'SFB without statement'.
The doctor and the assistant of the "Special Case" organizational unit submit the order to the chief physician of the Miners' Association, who assigns the examination to the Miners' Association office closest to the residence of the person being assessed and subsequently arranges for the return of the report.
Electronic archiving is carried out by the assistants of the "Special Case" organizational unit, who scan the report for the order.
The actual preparation of the report by the Federal Miners' Association is to be monitored by the "Special Case" organizational unit.
...
7
A total of 36 employees of the defendant received technical access to the so-called protected area within the "Special Case" organizational unit established under the DA. These employees included medical staff, assistants, and employees of the IT department. Access authorization for processing special cases was divided into the "Outpatient Care Sub-Area" with the Counseling and Assessment Centers (BBZ) A and B, each of which was assigned physicians and assistants; the "Inpatient Care Sub-Area" with the BBZs A and B, each of which was assigned physicians, coding specialists, and assistants; the "Medical Errors Sub-Area" with the BBZ C; and the "IT Department Sub-Area," which was located in A and to which nine people, including the plaintiff, were assigned in 2018. All employees of the so-called protected area were bound by social secrecy within the meaning of Section 35 of the German Social Code (SGB I) and were informed of the criminal and labor law consequences of any violation. They received regular training on the significance of Section 35 of the SGB I and compliance with social data protection regulations.
8
The data processed using ISmed 3 was stored in the data center of a provider based in M. Order data containing the insured persons' master data and the assessment data were stored separately – in two databases. Merging was only possible using a key stored in the Oracle encryption library and only if a task link was established by an authorized user. Access authorization was technically verified by the system. In any case, the IT department employees belonging to the "Special Case" organizational unit were technically able to access reports concerning the defendant's own employees or their relatives – using the existing encryption technology – even after archiving.
9
In June 2018, the statutory health insurance company with which the plaintiff was insured commissioned the defendant to provide an expert opinion to dispel doubts about the plaintiff's incapacity to work. The order was received by mail – without the use of a "Special Case" envelope – at BBZ B and was immediately manually assigned to the so-called protected area. On June 22, 2018, a doctor working at BBZ B, who was part of the "Special Cases" organizational unit, prepared a report – subsequently stored electronically in the "protected area" – which, among other things, diagnosed the plaintiff with a mental illness and contained the finding: "temporary incapacity for work from a medical perspective." Before preparing the report, the doctor obtained information about the plaintiff's health from the plaintiff's treating physician by telephone. After the plaintiff was informed of the conversation by his doctor, he contacted a colleague from the IT department by telephone on August 1, 2018. At his request, the colleague searched the digital archive for the report, took photos of it with her mobile phone, and then sent the photos to the plaintiff via a messenger service.
10
After an unsuccessful out-of-court claim for compensation in the amount of EUR 20,000.00, the plaintiff was granted temporary incapacity for work. The plaintiff pursued his claim for non-pecuniary damages with his action for €20,000.00 and, in addition, sought material damages – in the second instance – by way of a payment and declaratory action, each based on Article 82 (1) of the GDPR and Section 823 (1) of the German Civil Code (BGB) in conjunction with Article 2 (1) and Article 1 (1) of the Basic Law (GG).
11
In the course of the legal dispute, the defendant terminated the employment relationship with the plaintiff without notice and, alternatively, within the prescribed period. The plaintiff then filed a separate action for unfair dismissal. Furthermore, the defendant consulted the staff council regarding an intended termination of the employment relationship with the plaintiff's colleague without notice and, alternatively, with due notice.
12
The plaintiff argued that the defendant violated data protection regulations in several respects by processing his health data in connection with the preparation of the expert opinion dated June 22, 2018. The defendant was fundamentally prohibited from processing the health data of its own employees for the purpose of preparing a medical report commissioned by the health insurance company. If its own employees were affected, the assessment – even if a physical examination was not required – must always be carried out by another medical service. At the very least, the defendant was obligated to ensure that no colleague could gain knowledge of and/or access health data concerning him – the plaintiff. Furthermore, the doctor specifically involved in the assessment, with whom he had "occasionally interacted," was not permitted to obtain information about his incapacity to work from his treating physician by telephone. Finally, the measures to protect his health data related to the processing of the health insurance company's order, and in particular the archiving of the report, were inadequate. Adequate safeguards and controls were lacking that would have effectively prevented unauthorized access to health data concerning the defendant's own employees.
13
As a result of the resulting violations of the General Data Protection Regulation, which also constituted a serious violation of his general personality rights, he suffered non-material damages, which the defendant must compensate. The actual knowledge of his health data by the defendant's employees, who are his colleagues, and the possibility of viewing his data – at least by employees of the IT department after it had been stored in the "protected area" – caused him to fear that his health status would be discussed "behind his back" among colleagues and, consequently, the associated concern of exposure. He also had reason to fear that HR managers and superiors would at least "behind his back" learn about the causes of his illness. Furthermore, the defendant attempted to "silence" him and his colleague with the announced or envisaged dismissals; The intention to terminate his colleague's employment caused him remorse. The claim for material damages or a corresponding determination arises from the loss of earnings he suffered as a result of the unlawful telephone call between the defendant's expert and his treating physician. Learning of the telephone call resulted in him not being fully able to work again from December 2018 onward – contrary to his physician's prior expectations – but remaining incapacitated due to illness.
14
The plaintiff has most recently requested that:
1.
the defendant be ordered to pay him reasonable compensation at his discretion, but at least €20,000.00;
2.
the defendant be ordered to pay him material damages in the amount of his lost earnings, amounting to €5,812.00 gross less €2,653.00 net for the months of December 2018, January 2019, February 2019, March 2019, April 2019, and May 2019, as well as €5,812.00 gross for the months of June 2019, July 2019, August 2019, September 2019, and October 2019, plus interest at a rate of five percentage points above the base interest rate since the action was filed;
3.
Alternatively, to determine that the defendant is obligated to compensate the plaintiff for the material damages that he has suffered and/or will suffer as a result of the violation of his personal rights asserted in the lawsuit, and
4.
To determine that the defendant is obligated to compensate the plaintiff for the material damages that he has suffered and/or will suffer as a result of the violation of his personal rights asserted in the lawsuit, for the period up to October 2019.
15
The defendant has moved to dismiss the lawsuit.
16
The Labor Court dismissed the lawsuit with regard to claim 1. The Regional Labor Court dismissed the plaintiff's appeal – also with regard to claims 2 and 4. It considered claim 3 to be non-existent. With the appeal on points of law, the plaintiff continues to pursue his claims. The defendant requests that the appeal be dismissed.
17
By order of August 26, 2021 (- 8 AZR 253/20 (A) – BAGE 175, 319), the Senate stayed the appeal proceedings and referred a request to the Court of Justice of the European Union for a preliminary ruling pursuant to Article 267 TFEU on legal questions concerning the interpretation of Article 9(1), Article 9(2), Article 9(3), Article 6(1), and Article 82(1) of the GDPR. The Court ruled on the preliminary ruling proceedings in its judgment of December 21, 2023 (- C-667/21 – [Krankenversicherung Nordrhein]).
Reasons for the Decision
18
The plaintiff's admissible appeal is unfounded. The Regional Labor Court rightly dismissed the plaintiff's appeal. The action, to the extent that it is for the Senate to decide, is unsuccessful.
19
I. The admissible main claim under 1. is unfounded.
20
1. The claim is admissible, in particular sufficiently specific within the meaning of Section 253 (2) No. 2 of the Code of Civil Procedure (ZPO).
21
a) The plaintiff bases his claim for non-pecuniary damages on several alleged violations by the defendant of provisions of the General Data Protection Regulation and the associated, allegedly unlawful interference with his general personality rights. However, he does not derive his claim from a plurality of subject matters in dispute; it can therefore remain open whether an inadmissible alternative joinder of actions would otherwise exist.
22
aa) The subject matter of the proceedings is determined according to the two-part definition of subject matter applicable to labor court judgment proceedings by the filed claim (claim) and the underlying factual circumstances (cause of action). The subject matter of the dispute encompasses all facts that, from a natural perspective, based on the parties' point of view and encompassing the facts in their essence, belong to the set of facts submitted for decision, which the plaintiff submitted to the court in support of his claim for legal protection (cf. Federal Labor Court, December 13, 2023 – 5 AZR 259/22 – para. 22 with further references).
23
bb) The plaintiff considers the processing of his health data by the defendant to be inadmissible primarily because the defendant is his employer and because, during the processing, colleagues who – like him – belonged to the "protected area" had access to his particularly sensitive data. Furthermore, he objects to the manner in which the data was collected by the medical expert, who, in his opinion, should not have obtained information from his treating physician by telephone without his consent. The plaintiff expressly does not cite his colleague's access to the expert report stored in the archive on August 1, 2018, as a "liability-giving" data protection violation, as he clarified at the final hearing before the Regional Labor Court. However, he clearly wants this access to be understood as evidence of the defendant's inadequate protective measures when storing his health data, on which he also bases his claim for compensation.
24
cc) Accordingly, it cannot be overlooked that the claim for monetary compensation is based on alleged data protection violations in various processing steps/activities. However, the focus of the claim is the disclosure and/or (possibility of) knowledge of the plaintiff's health data to or by the defendant's own employees, in particular those employees who are his "colleagues," and the handling of the data in the context of the medical opinion commissioned by the statutory health insurance fund. Furthermore, the processing activities complained of constitute a series of operations, i.e. a sequence of processing operations (such as the consecutive collection, recording, use, and storage) in connection with personal data, which, according to Art. 4 No. 2 GDPR, constitutes processing within the meaning of the General Data Protection Regulation and which, when viewed naturally, constitutes a single factual situation and thus a single cause of action in a procedural sense. The relevant single subject matter of the dispute is thus characterized by all data protection violations which, according to the plaintiff's allegations, are related to the preparation of the report on his incapacity to work and which fall within the period beginning with the health insurance company's order of June 6, 2018, until the access to the archived report on August 1, 2018.
25
b) The plaintiff also legitimately submitted the first claim without specifying a figure and only stated a minimum amount of the (total) compensation claimed. The amount of monetary compensation to be awarded to the plaintiff – presumably – depends on a judicial estimate pursuant to Section 287 (2) of the Code of Civil Procedure (ZPO) (on the admissibility of an unquantified claim for benefits in such a case, see: Federal Labor Court (BAG) April 22, 2004 – 8 AZR 620/02 – to II 2 of the reasons; Federal Court of Justice (BGH) January 21, 2021 – I ZR 207/19 – marginal no. 78 with further references). Furthermore, the plaintiff has stated sufficient facts that the court should consider for the estimate (on this requirement, see Federal Labor Court (BAG) February 15, 2005 – 9 AZR 635/03 – to A of the reasons with further references, BAGE 113, 361), namely, among other things, The uncertainty about the possible disclosure of his health data among colleagues, the resulting strain on professional interactions, and even the fear of his health being discussed behind his back and the associated concern about exposure.
26
2. The application is unsuccessful on the merits. The requirements of the relevant grounds for the claim are not met.
27
a) The defendant continues to have standing to sue, which is not disputed between the parties. Previous legal relationships with the Medical Service of the North Rhine Health Insurance Fund have been transferred to the defendant, the Medical Service of North Rhine. The (re-)establishment of the Medical Services as corporations under public law (Section 278 (1) Sentence 1 of the Social Code Book V as amended by Article 1 No. 25 of the Act for Better and More Independent Audits of December 14, 2019 – MDK Reform Act, Federal Law Gazette I p. 2789) has only declaratory significance for the defendant, as it was already previously organized as a corporation under public law (cf. Article 73 (4) of the Act on Structural Reform in the Health Care System of December 20, 1988, Health Care Reform Act – GRG, Federal Law Gazette I p. 2477) (for this and the relevant transitional provisions in the Social Code Book V, see BSG October 19, 2023 – B 1 KR 22/22 R – para. 19 with further references).
28
b) The plaintiff has no claim against the defendant for the requested monetary compensation under Art. 82 (1) GDPR.
29
aa) The scope of application of the General Data Protection Regulation and thus of Art. 82 GDPR is indeed open.
30
(1) Pursuant to Art. 99 (2) GDPR, the Regulation applies from May 25, 2018. All individual processes associated with the health insurance company's order for an expert opinion to dispel doubts about the plaintiff's incapacity to work took place after June 6, 2018, and thus during the period of application of the General Data Protection Regulation.
31
(2) The fact that the defendant carried out the data processing in question not in its capacity as an employer, but in its capacity as a medical service, does not preclude the application of the General Data Protection Regulation.
32
(a) According to Section 35 (2) Sentence 1 of the Social Code (SGB I) (as amended by Article 19 of the Act Amending the Federal Social Security Act and Other Provisions of July 17, 2017 – BVGÄndG, Federal Law Gazette I, p. 2541), which has also been in force since May 25, 2018, the provisions of Chapter 2 of Book X of the Social Code and the other books of the Social Code exhaustively regulate the processing of social data, unless the General Data Protection Regulation directly applies. According to Section 35 (2) Sentence 2 of the SGB I, the General Data Protection Regulation and this Act apply mutatis mutandis to the processing of social data within the scope of activities that fall outside the scope of the General Data Protection Regulation, unless otherwise provided in this or another law. This constitutive regulation ensures a full data protection regime for the processing of social data, regardless of the scope of the General Data Protection Regulation (cf. BT-Drs. 18/12611 p. 97; BSG 18 December 2018 – B 1 KR 31/17 R – para. 14, BSGE 127, 181; Bieresborn NZS 2017, 887, 891).
33
The preparation of an expert opinion by the defendant regarding the plaintiff's incapacity to work concerns social data within the meaning of Section 35 (1) of the German Social Code (SGB I). This constitutes personal data within the meaning of Article 4 (1) of the GDPR, which is processed by an agency named in Section 35 of the German Social Code (SGB I) in connection with its duties under this Code (Section 67 (2) Sentence 1 of the German Social Code X, as amended by Article 24 (2) of the Federal Employment Services Amendment Act (BVGÄndG). According to Section 35 (1) Sentence 4 of the German Social Code (SGB I), the agencies named in Section 35 (1) of the German Social Code (SGB I) also include the working groups of the benefit providers. This included the "Medical Service of the Health Insurance" working group, which is supported by the health insurance funds in each (federal) state pursuant to Section 278 (1) Sentence 1 of the German Social Code (SGB V) (as amended by Article 1 of the German Social Security Act (GRG). To the extent that the defendant now continues to exist as a medical service, Section 35 of the Social Code (SGB) I applies "mutatis mutandis" within its area of responsibility pursuant to Section 276 (2) Sentence 5 of Book V of the German Social Code (SGB V) (as amended by Article 1 No. 24 of the Medical Services Reform Act).
34
(b) According to the remaining provisions, the material and personal scope of application of the GDPR is open. As already stated in the Senate's decision of August 26, 2021 (- 8 AZR 253/20 (A) - para. 15, BAGE 175, 319), the defendant, as part of the medical expert opinion commissioned by the plaintiff's health insurance company on June 6, 2018, processed personal data of the plaintiff concerned (Article 4 No. 1 GDPR), which predominantly constitutes health data (Article 4 No. 15 GDPR), within the meaning of Art. 2 (1), Art. 4 (2) GDPR "processes." The term "processing," which is to be interpreted broadly (ECJ October 5, 2023 - C-659/22 - [Ministerstvo zdravotnictvi (Mobile Application Covid-19)] para. 27 with further references), also includes the telephone inquiry of information about the plaintiff's state of health for further documentation and evaluation in an expert opinion, which – as here – is intended to be stored in a filing system of the defendant (for the oral transmission of data stored in a filing system, see ECJ March 7, 2024 - C-740/22 - [Endemol Shine Finland] paras. 32 et seq.). Furthermore, the defendant is, at least insofar as it processed the plaintiff's personal data to conduct the medical assessment of his incapacity to work, the controller within the meaning of Art. 4 (7) GDPR.
35
bb) However, the requirements for a claim for damages under Art. 82 (1) GDPR are not met.
36
(1) According to the case law of the Court of Justice of the European Union (hereinafter "Court"), this claim depends on three conditions. There must be a breach of the General Data Protection Regulation, material or non-material damage, and a causal link between the breach and the damage, and these three conditions must be met cumulatively (see ECJ 25 January 2024 – C-687/21 – [MediaMarktSaturn] para. 58; 21 December 2023 – C-667/21 – [Krankenversicherung Nordrhein] para. 82 with further references). With regard to the burden of presentation and proof, the Court has clarified that the person claiming compensation for non-material damage on the basis of Article 82(1) GDPR must demonstrate that all three conditions for the claim are met (see ECJ 11 April 2024 – C-741/21 – [juris] para. 35; 25 January 2024 – C-687/21 – [MediaMarktSaturn] paras. 60 et seq.).
37
(2) Accordingly, the plaintiff cannot claim non-material damages under Article 82(1) GDPR. There is – under all aspects raised by the plaintiff – no violation of the provisions of the General Data Protection Regulation. The processing of the plaintiff's health data in connection with the preparation of the expert opinion to dispel doubts about the plaintiff's incapacity to work does not violate the prohibition on processing under Article 9(1) GDPR. It meets the specific legality requirements arising from Article 9 (2) (h) in conjunction with Article 9 (3) GDPR. The processing also met the general legality requirements arising from Article 6 (1) GDPR. Finally, the defendant has taken sufficient data protection precautions. In particular, the measures taken by the defendant in this regard satisfy the principles of integrity and confidentiality set out in Article 5 (1) (a) GDPR and specified in Article 32 (1) (a) and (b) GDPR.
38
(a) Contrary to the plaintiff's opinion, the data processing is not unlawful because, given its simultaneous status as an employer and as a medical service, the defendant would be prohibited from processing the plaintiff's health data under Article 9 GDPR.
39
(aa) According to Article 9 (1) GDPR, the processing of special categories of personal data, such as health data, is prohibited. However, according to Article 9(2)(h) GDPR, this prohibition does not apply in cases where processing is necessary for assessing an employee's ability to work on the basis of Member State law and subject to the conditions and safeguards set out in Article 9(3) GDPR.
40
(bb) The defendant may rely on the exception provided for in Article 9(2)(h) GDPR, even though he was the plaintiff's employer at the time the health data was processed. According to the case law of the Court of Justice (ECJ 21 December 2023 – C-667/21 – [Krankenversicherung Nordrhein] para. 58), Article 9(2)(h) GDPR is also applicable, subject to the proviso that the data processing meets the conditions and safeguards expressly laid down in that provision and in Article 9(3) GDPR, to situations in which a medical assessment body processes health data of one of its employees not as an employer but as a medical service in order to assess that employee's ability to work. The Court derived this understanding from the wording and regulatory context of the strictly regulated exception contained in Article 9(2)(h) GDPR and recognized that this interpretation is consistent with the objectives of the General Data Protection Regulation and those of Article 9 thereof (see ECJ 21 December 2023 – C-667/21 – [Krankenversicherung Nordrhein] paras. 41 to 57). Accordingly, it is beyond doubt that the scope of the exception provision, including Article 9(3) GDPR, is not limited to cases in which a "neutral third party," i.e., an entity other than the employee's employer, processes health data to assess the employee's ability to work. Otherwise, Article 9(2)(h) GDPR would add a requirement that is not contained in the provision and that, depending on the design of the respective healthcare system, may not be met in all Member States (cf. ECJ, December 21, 2023 - C-667/21 - [Krankenversicherung Nordrhein], paras. 51 and 52).
41
(cc) The data processing by the defendant is also covered by Article 9(2) GDPR – subject to the necessity of the specific processing activities complained of by the plaintiff – insofar as the specific legality requirements of Article 9(2)(h) in conjunction with Article 9(2) GDPR are met. Art. 9 (3) GDPR (cf. ECJ December 21, 2023 – C-667/21 – [Krankenversicherung Nordrhein] para. 44).
42
(aaa) The defendant processed the plaintiff's health data for a purpose stated in Art. 9 (2) (h) GDPR, namely the assessment of the plaintiff's incapacity to work. To the extent that Art. 9 (2) (h) GDPR refers to "capacity to work," this term is clearly also to be understood in a negative sense, especially since the Court of Justice did not express any concerns in this regard in the preliminary ruling.
43
(bbb) The processing of the data was based on a power granted to the defendant under German law.
44
(aaaa) Pursuant to Section 275 (1) Sentence 1 No. 3 Letter b of the Social Code (SGB V), health insurance funds are obligated, in cases specified by law or if necessary due to the nature, severity, duration, or frequency of the illness or the course of the illness, to obtain an expert opinion from the Medical Service of the Health Insurance (Medical Service) (now – with the deletion of the words "of the Health Insurance (Medical Service)" by Article 1 No. 21 of the MDK Reform Act – only "Medical Service"; hereinafter referred to uniformly as Section 275 (1) Sentence 1 No. 3 Letter b of the SGB V) in order to eliminate any doubts regarding the incapacity to work in the event of incapacity for work. The plaintiff's statutory health insurance fund requested such an opinion from the defendant on June 6, 2018, which is indispensable for the processing of health data.
45
(bbbb) According to Section 276 (2) Sentence 1 of the Social Code (SGB V) (as amended by Article 1 No. 16g of the Act to Strengthen the Provision of Medical Devices and Aids of April 4, 2017, Medical Devices and Aids Supply Act (HHVG), Federal Law Gazette I p. 778), the Medical Service may collect and store social data and transmit it to another medical service, insofar as this is necessary for the examinations, consultations, and expert opinions pursuant to Section 275 of the SGB V. The term "social data" defined in German law in Section 67 (2) of the SGB X includes health data within the meaning of Article 4 No. 15 of the GDPR (cf. BeckOK SozR/Westphal as of June 1, 2024, SGB X Section 67, marginal no. 6; Wiesner/Wapler/Walther, 6th ed., SGB X Section 67, marginal no. 3).
46
(cccc) To the extent that, according to Article 9 (2) (h) GDPR, as Recital 53, sentence 1, clarifies, processing must also be necessary "in the interest of individual natural persons and of society as a whole," in particular in connection with the management of health and social services and systems (cf. ECJ, December 21, 2023 – C-667/21 – [Krankenversicherung Nordrhein], para. 56), this requirement is also met. In Germany, the administration of systems and services in the health or social sector within the area of statutory health insurance includes, among others, the statutory health insurance funds and the Medical Service (Kühling/Buchner/Weichert, 4th ed. GDPR, Art. 9, para. 107). It is not possible to conclusively define which purposes are in the interest of individual natural persons. This includes, in any case, the provision and processing of health-related social benefits by public service providers such as statutory health insurance funds (cf. Ehmann/Selmayr/Schiff 3rd ed. GDPR Art. 9 para. 61). To the extent that these providers are required to obtain an opinion from the Medical Service to dispel doubts about an insured person's incapacity to work, this procedure is part of the processing of statutory health insurance benefits. The assessment by the Medical Service is suitable for dispelling uncertainties, including those concerning the entitlement to receive sick pay. It is in the interest of the insured person that this assessment be carried out by the Medical Service as an entity independent of the health insurance fund providing the benefits. The assessment to dispel doubts about incapacity to work by a Medical Service, utilizing its expertise, is also in the interest of society as a whole, as it ensures the quality and cost-effectiveness of the procedures for billing services provided by statutory health insurance funds. This in turn serves the financial stability of statutory health insurance as a whole (cf. BVerfG 13 September 2005 – 2 BvF 2/03 – para. 239, BVerfGE 114, 196).
47
(ccc) The guarantees required by Article 9 (3) GDPR are met.
48
(aaaa) According to this provision, the processing of an employee's health data for the purpose of assessing their ability to work may only take place if these data are processed by or under the responsibility of specialist personnel and this specialist personnel is subject to professional secrecy under Union law or the law of a Member State or the rules of national competent bodies, or if the processing is carried out by another person who is also subject to an obligation of confidentiality under Union law or the law of a Member State or the rules of national competent bodies.
49
(bbbb) The processing of the plaintiff's health data met these requirements. The doctors involved in preparing medical opinions for the defendant, even if they are directly employed by the defendant, are subject to a (punishable) duty of professional secrecy pursuant to Section 203 Paragraph 1 No. 1 of the Criminal Code and Section 9 of the Professional Code for North Rhine-Westphalian Doctors of November 14, 1998 (as amended on November 21, 2015, Federal Gazette NRW No. 7 of March 16, 2016, p. 148). The remaining administrative and IT staff, in particular the staff of the "Special Case" organizational unit solely responsible for processing medical opinions from one of the defendant's own employees, must, due to employment/service law obligations, maintain social secrecy, to which the defendant is subject as a medical service – as shown above (in paragraph 33) – and which constitutes professional secrecy within the meaning of the German Civil Code. Art. 9 (3) GDPR (cf. BeckOK SozR/Gutzler, March 2024, SGB I § 35, para. 11; Kühling/Buchner/Weichert, 4th ed. GDPR Art. 9, para. 142). Social secrecy aims to provide institutional protection for secrets to a comparable extent as for personal professional secrets (cf. Kühling/Buchner/Weichert, ibid.). Furthermore, the defendant's non-medical employees, to the extent that their professional activities entail that they become aware of the health data of data subjects, are subject, as collaborating persons, to a duty of confidentiality punishable by law under Section 203 (4) of the German Criminal Code (StGB).
50
(cccc) Art. 9 (3) GDPR does not impose any further requirements. In particular, this does not result in an obligation for the defendant to ensure that no colleague of an employee affected by an assessment has access to that employee's health data. As the Court of Justice recognized in response to the Senate's request for a preliminary ruling, this provision too cannot be supplemented by unwritten criteria, since the EU legislature has defined the specific protective measures it intended to impose on controllers for processing operations within the meaning of Article 9(2)(h) GDPR, and because the interpretation of this provision cannot be determined by considerations derived from the healthcare system of a single Member State or arising from the specific features of a particular case (see ECJ, 21 December 2023 – C-667/21 – [Krankenversicherung Nordrhein] paras. 62 et seq., 70).
51
(ddd) It is true that, under Article 9(4) GDPR, Member States are empowered to introduce or maintain additional conditions, including restrictions, where the processing of health data is concerned. This includes the power of Member States to require the controller, in cases covered by Article 9(2)(h) GDPR, to exclude colleagues of the data subject from access to data concerning their state of health (ECJ December 21, 2023 – C-667/21 – [Krankenversicherung Nordrhein] paras. 65, 70), provided that this restriction does not undermine the practical effectiveness of the permission for data processing expressly provided for in Article 9(2)(h) GDPR and the framework of which is defined in Article 9(3) GDPR (ECJ December 21, 2023 – C-667/21 – [Krankenversicherung Nordrhein] para. 67). However, the German legislature has not made use of this possibility of introducing such a restriction.
52
(aaaa) There is no provision in German law that imposes an abstract and general restriction on the Medical Service regarding the conduct of an assessment pursuant to Section 275 (1) Sentence 1 No. 3 Letter b of the Social Code Book V, to the effect that no other employee who works with the person concerned – even occasionally – as a "colleague" may have access to that person's health data. Such a requirement can be found neither in Section 276 (2) of the Social Code Book V (as amended by Article 1 No. 16g of the Health Insurance Act (HHVG), which regulates the processing of social data, among other things, in the cases covered by Section 275 of the Social Code Book V, nor in the provisions generally applicable to the processing of social data in Chapter 2 of the Social Code Book X (Sections 67 to 85a).
53
Moreover, the provision in Section 35 (1) Sentence 3 of the Social Code (SGB I) (now in conjunction with Section 276 (2) Sentence 5 of the Social Code (SGB V)) argues against the assumption of such a restriction. According to Section 279 (5) Sentence 5 of the Social Code (SGB V), persons who make or participate in personnel decisions may neither have access to employees' social data nor may they be passed on to this group of persons by those authorized to access it. The provision is clearly guided by the idea that service providers such as statutory health insurance funds or a medical service may process social data of their own employees.
54
(bbbb) A restriction – at least in part – of the defendant's processing powers also does not follow from the regulations on the appointment of experts applicable during the period in dispute. According to Section 279 (5) Sentence 5 of the Social Code (SGB V), the limitation of the defendant's processing powers is not based on the provisions applicable during the period in dispute. 1 SGB V (as amended by Art. 1 GRG; now Section 278 Para. 2 Sentence 1 SGB V as amended by Art. 1 No. 25 MDK Reform Act), the specialist tasks of the Medical Service - i.e. the tasks according to Section 275 SGB V (cf. Wagner in Krauskopf Soziale Krankenversicherung, Pflegeversicherung Stand June 2018 Section 279 SGB V Rn. 16) - are carried out by doctors and members of other medical professions. According to the provision in Section 279 Para. 5 Sentence 1, which remained in effect until December 31, 2019, the Medical Service had 2 SGB V (as amended by Art. 1 GRG), which was deleted without replacement in the course of the amendments to SGB V by the MDK Reform Act (cf. BR-Drs. 359/19 p. 76), to commission experts as a priority, which referred to the commissioning of external experts not employed by the Medical Service (cf. Becker/Kingreen/Sichert 6th ed. SGB V § 279 Rn. 7). However, according to the justification of the government draft of the Health Reform Act (cf. BT-Drs. 11/2237 p. 233; in this respect, Section 287 Paragraph 5 of the draft version), this requirement was related to the right of the Medical Service to employ civil servants, which was limited to civil servants and civil servant candidates who had been taken on by the State Insurance Institutions, and was intended to ensure the most qualified possible performance of the tasks pursuant to Section 275 of the Social Code Book V, given the limited assessment/advisory capacities available. According to the explanatory memorandum to the draft bill for the MDK Reform Act (BR-Drs. 359/19 p. 76), the provision on the priority commissioning of experts from Book V of the Social Code (SGB V) was deleted, as the type and scope of the possible commissioning of external experts, in addition to the use of in-house employees to handle peak workloads or to process rare and specialized expert reports, "will be defined in the future by a directive ... pursuant to Section 283 Paragraph 2 Sentence 1 Number 5," i.e., a directive of the Federal Medical Service. This demonstrates that the previous provision in Section 279 Paragraph 5 Sentence 2 of Book V of the Social Code primarily served quality assurance purposes and in any case did not aim to restrict the Medical Service's powers in the processing of health data.
55
(cccc) Finally, specific restrictions on the processing of health data of one of the company's own employees do not arise for the Medical Service from the Guidelines for Assessment of Incapacity for Work (BGA-AU 2017) issued as a guideline by the Federal Association of Statutory Health Insurance Funds on May 15, 2017 (in the version of May 15, 2017, valid until December 31, 2021, see Section 411 (2) Sentence 1 of the Social Code Book V). Therefore, for the present assessment, it is not relevant whether guidelines within the meaning of Section 282 (2) Sentence 3 or Section 283 (2) of the Social Code Book V are to be regarded as legal provisions within the meaning of Article 9 (4) of the GDPR (for the issue, see Gola/Heckmann/Schulz, 3rd ed., GDPR Article 9, marginal no. 49).
56
(dddd) In light of all of the above, the view occasionally expressed in the literature (cf. Halder/Maluszczak jurisPR-ITR 3/2024 note 4 under C) that the German legal system has already, in principle, "assigned" the tasks and duties of the medical service in the event of its own employees being affected to another service cannot be accepted. By not generally obliging the medical service to commission another service in the event of its own employees being affected, the German legislature has not imposed such a restriction on the service – evidently aware and aware that the processing of data for the preparation of an expert opinion within the meaning of Section 275 (1) Sentence 1 No. 3 Letter b of the Social Code Book V regularly includes the health data of a data subject. The assumption of a "lack of jurisdiction" under data protection law of the specifically commissioned service solely on the grounds that a medical assessment concerns the incapacity to work of one of its own employees would run counter to this fundamental legislative decision.
57
(b) The processing of health data based on Article 9(2)(h) GDPR is not lawful simply because it meets the specific requirements set out in that provision. Rather, the processing based on the aforementioned provision must simultaneously satisfy, among other things, the conditions for lawfulness arising from Article 6(1) GDPR (ECJ December 21, 2023 – C-667/21 – [Krankenversicherung Nordrhein] paras. 78 et seq.). These conditions are, however, met.
58
(aa) According to Article 6 (1) GDPR, the processing of personal data is lawful if it is necessary to fulfill a legal obligation of the controller (Article 6 (1) subparagraph 1 (c) GDPR). The legal basis for such processing may arise from the law of the Member States (Article 6 (3) sentence 1 (b) GDPR). This requires that the purpose of the processing is specified in this legal basis (Article 6 (3) sentence 2 GDPR), the legal provisions pursue an objective in the public interest, and are proportionate to the legitimate purpose pursued (Article 6 (3) sentence 4 GDPR).
59
(bb) As already shown (in para. 44), by preparing the medical opinion to dispel doubts about the plaintiff's incapacity to work, the defendant fulfilled a task assigned to it under Section 275 (1) Sentence 1 No. 3 Letter b of the Social Code (SGB V). If the health insurance company requests such an opinion, its execution is mandatory for the Medical Service and its processing is necessary.
60
(cc) The German legislature has created a sector-specific legal basis for data processing by the Medical Service in Section 276 (2) of the Social Code (SGB V). According to Section 276 (2) Sentence 1 of the Social Code (SGB V), as already explained, the Medical Service may collect and store social data, i.e., both personal data within the meaning of Article 6 (1) GDPR and health data within the meaning of Article 9 (1) GDPR, and transmit it to another Medical Service, insofar as this is necessary, among other things, for opinions pursuant to Section 275 of the Social Code (SGB V). According to sentence 3 of the provision, legally collected and stored social data may only be processed or used for the purposes specified in Section 275 of the Social Code (SGB V), and for other purposes only if this is mandated or permitted by legal provisions of the Social Code.
61
(aaa) The legal basis in this respect corresponds to the requirements of Article 6 (1) subparagraph 1 letter c in conjunction with Article 6 (3) sentence 1 letter b GDPR. It regulates data processing by the Medical Service within the scope of its tasks (on this requirement, see ECJ March 30, 2023 – C-34/21 – [Main Staff Council of Teachers] para. 87 with further references). According to Recital 45, the General Data Protection Regulation does not require a specific law for each individual processing operation. For example, a law may be sufficient as the basis for multiple processing operations if the processing – as in this case – is carried out due to a legal obligation incumbent on the controller (Federal Labor Court, May 9, 2023 – 1 ABR 14/22 – para. 66).
62
(bbb) Section 276 (2) Sentence 1 and Sentence 3 of the Social Code Book V also satisfy the requirements of Article 6 (3) Sentence 2 of the GDPR. They define, among other things, the purpose of the processing with the expert opinions pursuant to Section 275 of the Social Code Book V. The stated purpose is legitimate within the meaning of Article 6 (3) Sentence 4 of the GDPR, as demonstrated by the standard example in Article 9 (2) (h) GDPR "for the management of systems and services in the health and social sector" and Recital 52 Sentence 2 of the GDPR (see para. 46).
63
(ccc) The legal bases legitimizing data processing pursuant to Section 276 (2) Sentence 2 and Sentence 3 of the Social Code Book V are also proportionate to the purpose pursued.
64
(aaaa) Article 6 (3) Sentence 4 of the GDPR takes into account the principle of proportionality enshrined in Article 52 (1) Sentence 2 of the Charter of Fundamental Rights (cf. Paal/Pauly/Frenzel, 3rd ed., GDPR, Article 6, para. 45; cf. also Recital 4, Sentence 2 of the GDPR). This principle requires that the measures adopted by the EU institutions be appropriate for achieving the legitimate objectives pursued by the legislation in question and do not exceed the limits of what is appropriate and necessary to achieve those objectives (see ECJ 8 April 2014 – C-293/12, C-594/12 – [Digital Rights Ireland] para. 46 with further references; BSG 20 January 2021 – B 1 KR 7/20 R – para. 48, BSGE 131, 169).
65
In this context, a balanced approach is required between legitimate processing objectives, on the one hand, and the rights to respect for private life and to the protection of personal data, as conferred on natural persons by Articles 7 and 8 of the Charter of Fundamental Rights. Exceptions and limitations with regard to the protection of personal data must be limited to what is strictly necessary, in the sense that this objective cannot reasonably be achieved as effectively by other means that are less intrusive. Furthermore, the interference must not be disproportionate to the objective pursued, which implies, in particular, a weighting of the importance of this objective and the gravity of the interference (see ECJ, 8 December 2022 – C-694/20 – [Orde van Vlaamse Balies and Others], paras. 41, 42; 8 April 2014 – C-293/12, C-594/12 – [Digital Rights Ireland], para. 52; BSG, 20 January 2021 – B 1 KR 7/20 R – para. 49, BSGE 131, 169; each with further references).
66
(bbbb) Measured against this, proportionality is maintained.
67
(aaaaa) The strict purpose limitation of processing pursuant to Section 276 (2) Sentence 1 and Sentence 2 of the Social Code (SGB V) limits all processing by the defendant to the extent necessary to fulfill its tasks and, in this respect, complies with the principle of data minimization (Article 5 (1) (c) GDPR).
68
(bbbbb) It is not apparent that there are other, equally suitable, less burdensome ways to achieve the processing objectives. Carrying out the task assigned to the Medical Service to prepare a medical opinion to dispel doubts about an insured person's incapacity to work is simply not possible without the recording and collection of personal (health) data. Permission to store data serves mandatory documentation requirements in the healthcare sector and also takes into account the requirements of modern healthcare administration. The interference with the insured persons' right to protection of their personal data associated with the processing is serious. This applies all the more so given that the data is particularly sensitive within the meaning of the GDPR. Art. 9 (1) GDPR are affected. However, this is countered by the public interest in ensuring the quality and cost-effectiveness of statutory health insurance benefits, which, according to the balancing of interests carried out by the Union legislature in Art. 9 (2) (h) GDPR, can also legitimize such a serious interference under the conditions specified in the provision (on the financial stability of statutory health insurance as a "primarily important public good," see also BVerfG 13 September 2005 – 2 BvF 2/03 – C III 1 c of the reasons, BVerfGE 114, 196; on the relevance of this public interest in connection with measures to prevent benefit abuse, see BSG 20 January 2021 – B 1 KR 7/20 R – paras. 44, 52, BSGE 131, 169).
69
(ccccc) The legal basis is also appropriate within the meaning of Article 6 (3) sentence 4 GDPR insofar as it does not generally exclude the processing of health data in the event that the medical service is also the data subject's employer. Admittedly, in such situations, there is a significantly increased interest in maintaining the confidentiality of the data, which relates to both the employer and the data subject's professional environment. However, national law takes this particularly high interest in maintaining confidentiality into account by imposing on the bodies bound by social secrecy the access restrictions contained in Section 35 (1) sentence 3 of the German Social Code (SGB I) with regard to persons with personnel decision-making authority, including those involved. In contrast, a corresponding statutory provision with regard to all employees of a service was not required from the point of view of proportionality. In this respect, it is generally sufficient if the need to maintain the integrity and confidentiality of a data subject is taken into account through technical and organizational measures within the service. Given the multiple medical services available in Germany, it would be possible to assign the tasks pursuant to Section 275 of the Social Code (SGB V) to another service from the outset in the event that one of the company's employees is affected. However, this would entail disadvantages in the processing of statutory health insurance benefits, which would make processing by another service less effective and cost-effective. On the one hand, the responsibility of one medical service for all assessments arising within its area of responsibility promotes the uniform application of the standards to be applied in the assessment – in the interest of all insured persons – as they arise in particular from the BGA-AU 2017. On the other hand, the establishment of multiple medical services in Germany is precisely intended to ensure that assessments are carried out as close to the place of work and residence as possible, as this gives specialist staff easier access to service providers, including the treating general practitioners. If service providers are known to the experts through regular contact, this can influence confidence in the reliability of their assessments for determining incapacity for work, which in turn can facilitate the expert's assessment of whether the medical opinion on the person's incapacity for work can be based on existing findings or whether an additional medical examination of the health status may be necessary. This, in turn, ensures not only the quality but also the cost-effectiveness of the performance of tasks by the medical services, which are financed by the health and long-term care insurance funds.
70
(ddddd) This finding is not contradicted by the Court's statements in the preliminary ruling on the principles of integrity and confidentiality referred to in Article 5(1)(f) GDPR and specified in Article 32(1)(a) and (b) GDPR. The Court of Justice has indeed recognized that, based on these principles, a controller who, as a medical service, processes an employee's health data may be obliged to ensure that no colleague of the data subject has access to this data (see ECJ, December 21, 2023 – C-667/21 – [Krankenversicherung Nordrhein], paras. 59 et seq.). However, these requirements do not require abstract, general regulation by the legislature. They are addressed to the controller and must therefore be taken into account when assessing whether specific protective measures taken satisfy the obligations arising from the principles of integrity and confidentiality.
71
(c) The individual processing activities carried out by the defendant in connection with the medical opinion of June 22, 2018, comply with the requirements of Section 276 (2) Sentence 1 and Sentence 3 of the Social Code Book V. Thus, their specific implementation was necessary within the meaning of Article 9 (2) (h) GDPR to assess the plaintiff's ability (or inability) to work and, within the meaning of Article 6 (1) Subparagraph 1 (c) GDPR, to fulfill a legal obligation incumbent upon the defendant in this regard. In particular, no violation of the General Data Protection Regulation can be identified due to the conduct of the physician involved.
72
(aa) Based on the findings of the Regional Labor Court, there are no indications that the defendant processed the plaintiff's health data for purposes other than preparing a medical opinion on the plaintiff's incapacity to work, or that the processing did not comply with the safeguards within the meaning of Article 9 (2) (h) in conjunction with Article 9 (3) GDPR with regard to the specific personnel involved.
73
(bb) The data processing was also lawful insofar as the expert obtained information about the plaintiff's health status from his treating physician by telephone.
74
(aaa) According to Section 276 (2) Sentence 2 of the Social Code Book V, the service providers, including, among others, The medical service, which includes established (contract-based) physicians, is obliged, upon request from the Medical Service and provided that this request states the purpose of the assessment, to transmit insured-related data directly to the Medical Service. This implies that the medical service's assessors are authorized to collect data directly from the treating physician. The law governing case processing by the Medical Service does not contain a requirement that data queries and transmissions may only be made in writing (cf. Krauskopf/Knittel, as of February 2024, SGB V § 276, marginal no. 10; Spickhoff/Nebendahl, 4th ed., SGB V § 276, marginal no. 6). A telephone inquiry is also generally required, as it serves to ensure the prompt processing of the opinion. Since the transmission of data by a service provider to the Medical Service does not require the insured person's consent (see BT-Drs. 19/8351 p. 212; Becker/Kingreen/Seifert 8th ed. SGB V § 276 para. 4), such consent was also not required for the information provided over the telephone in this case.
75
(bbb) Accordingly, the BGA-AU 2017 regulations in force at the time of the telephone call expressly provided for data collection over the telephone. There, in No. 3.1.7 ("Supplementary Instruments of the SFB" Information Gathering), under the heading "Telephone Consultation with the MDK Contracted Physician," it states: "A telephone conversation between the MDK and the contracted physician is advisable, among other things, to clarify functional impairments, impairments to activities or participation in working life, or the individual prognosis for the further course of the disease. ... However, the contracted physician is not obligated to provide information over the telephone." Accordingly, the relevant assessment guidelines leave the decision as to whether information is obtained from the contracted physician by telephone to the expert's due discretion. This corresponds to the recognizable purpose of the guideline provision, which is in the (public) interest of both the benefit providers and the insured person, namely to clarify the existence of incapacity for work as quickly as possible in appropriate cases. By granting the contracted physician the right to refuse to provide information over the telephone, the interests of the person affected are adequately protected.
76
(ccc) To the extent that the plaintiff refers to an applicable envelope procedure in connection with his complaint that the doctor should have obtained the information in writing, this procedure – at least during the period in dispute – only applied to data collection by the health insurance companies from the service providers, as is again evident from the requirements of the BGA-AU 2017 (No. 3.1.4 under the heading "Initiation of social-medical case consultation [SFB] by the health insurance company").
77
(ddd) According to the documentation in the expert report dated June 22, 2018, the "treatment provider phone call" of June 21, 2018, addressed the question of when the plaintiff could be expected to return to work. The data request therefore served to clarify the expected duration of his incapacity to work and was thus carried out for the purpose of preparing the medical opinion. The plaintiff has not provided any indication that data was requested during the phone call that was outside the scope of the expert opinion. He merely expressed – entirely unsubstantiated – concerns regarding excessive information gathering. Thus, insofar as he bases his claim for damages on the phone call, he has not met his burden of demonstrating a violation of the General Data Protection Regulation. The plaintiff has not claimed that he could not have obtained further information about the content of the phone call – for example, by asking his treating physician.
78
(cc) It is irrelevant whether a violation of the General Data Protection Regulation has occurred insofar as the health insurance company transmitted the original expert opinion order to the defendant outside of the intended envelope procedure. In this respect, the defendant is in any case not the controller within the meaning of Art. 4 No. 7 GDPR.
79
(d) The data processing by the defendant also meets the requirements for lawful and fair processing, even with regard to the necessary safeguards.
80
(aa) The provisions of Section 276 (2), Sentences 6 to 9, of the German Social Code (SGB V) are decisive in this respect. Since these are special data protection precautions for the Medical Service (cf. Becker/Kingreen/Seifert 8th ed. SGB V § 276 Rn. 12), the general provisions in § 67a (collection of social data) and § 67b SGB X (storage, modification, use, transmission, restriction of processing and deletion) (each as amended by Art. 24 BVGÄndG) apply in addition, whereby these expressly also cover the processing of the data specified in Art. 9 Para. 1 GDPR, i.e., among other things, health data (§ 67a Para. 1 Sentence 2 and § 67b Para. 1 Sentence 2 SGB X). To the extent that § 22 Para. 2 BDSG applies "accordingly" according to § 67a Para. 1 Sentence 3 and § 67b Para. 1 Sentence 4 SGB X, the provisions therein also apply to processing by the Medical Service. Otherwise, however, the data protection provisions of the Social Code take precedence over the provisions of the Federal Data Protection Act (see Sydow/Marsch GDPR/BDSG/Kampert 3rd ed. GDPR Art. 9 para. 75).
81
(aaa) According to Section 276 (2) SGB V, the Medical Service must store social data used to identify the insured person separately from the insured person's medical social data (sentence 6). Technical and organizational measures must be taken to ensure that the social data is accessible only to those persons who need it for their duties (sentence 7). The key for merging the data must be retained by the Medical Service's Data Protection Officer and must not be made accessible to other persons (sentence 8). Furthermore, every merging must be logged (sentence 9).
82
(bbb) According to Section 22 (2) Sentence 1 of the Federal Data Protection Act (BDSG) (as amended by Article 1 of the EU Data Protection Adaptation and Implementation Act of June 30, 2017 – DSAnpUG-EU, Federal Law Gazette I p. 2097), in the cases referred to in Paragraph 1, i.e., in cases involving the processing of special categories of personal data such as the health data processed here, appropriate and specific measures must be taken to safeguard the interests of the data subject. Taking into account the state of the art, the implementation costs, and the nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of the risks associated with the processing for the rights and freedoms of natural persons, these include the measures listed in a catalog at the end of Section 22 (2) Sentence 2 of the Federal Data Protection Act. These include, among others: Technical and organizational measures to ensure that processing is carried out in accordance with the General Data Protection Regulation (No. 1); measures that ensure that it can be subsequently checked and determined whether and by whom personal data has been entered, modified, or removed (No. 2); raising awareness among those involved in processing operations (No. 3); restricting access to personal data within the controller and processors (No. 5); pseudonymization of personal data (No. 6); and encryption of personal data (No. 7).
83
(ccc) Section 22 (2) of the Federal Data Protection Act (BDSG) only lists the possible measures as examples. Therefore, the protective measures to be taken by the medical service do not have to be the explicitly named measures. However, to the extent that the controller takes other protective measures, they must strictly respect the data subject's interest in confidentiality and, when assessed on an evaluative basis, comply with the criteria listed in Section 22 (2) of the Federal Data Protection Act (BDSG) (Federal Labor Court, May 9, 2023 – 1 ABR 14/22 – para. 76 with further references). Furthermore, the special protective measures listed in Section 276 (2) of the Social Code Book V are mandatory, as is evident from the wording "has."
84
(bb) The aforementioned provisions of national law are applicable. They contain specific regulations within the meaning of Article 6 (2) and (3) sentence 3 GDPR, and – where health data is concerned – also within the meaning of Article 6 (3) GDPR. Art. 9 (4) GDPR, and respect the prohibition of repetition of norms under EU law (see ECJ 30 March 2023 – C-34/21 – [Main Staff Council of Teachers] para. 67, on the opening clause of Art. 88 GDPR; Federal Labor Court 9 May 2023 – 1 ABR 14/22 – para. 50, on Section 26 (3) BDSG). This also applies to the provisions included in Section 22 (2) BDSG. These, too, are not limited to a mere repetition of obligations that already apply under the General Data Protection Regulation. In particular, the measures specified as examples in Section 22 (2) Sentence 2 BDSG go beyond the general principles for the processing of personal data enshrined in Art. 5 GDPR (cf. Federal Labor Court 9 May 2023 – 1 ABR 14/22 – para. 71).
85
(cc) The terms "technical and organizational measures" and "appropriate and specific measures" within the meaning of Section 276 (2) Sentence 7 of the Social Code Book V and Section 22 (2) of the Federal Data Protection Act (BDSG) are vague legal concepts. Whether the precautions taken in the individual case are sufficient under data protection law is therefore subject to the assessment of the courts of fact, which is only subject to limited review under the law of appeal (Federal Labor Court, May 9, 2023 – 1 ABR 14/22 – para. 72 with further references).
86
In the final analysis, this is irrelevant. The Regional Labor Court's assessment that the measures taken by the defendant were sufficient withstands even unrestricted review under the law of appeal. This also applies considering that the burden of proof regarding compliance with the principles of integrity and confidentiality set out in Art. 5 (1) GDPR generally lies with the controller in accordance with the principle of "accountability" enshrined in Art. 5 (2) GDPR (cf. ECJ, May 4, 2023 – C-60/22 – para. 53 with further references). This proof has been provided on the basis of the findings made by the Regional Labor Court.
87
(aaa) German law, insofar as it obliges the controller to take appropriate protective measures, does not impose lower requirements than EU law. In particular, the standards by which the fulfillment of the relevant obligations is assessed do not differ from those of EU law. The assessment must therefore generally be based on the principles developed in the Court's case law on Article 5(1) GDPR (see ECJ 21 December 2023 – C-667/21 – [Krankenversicherung Nordrhein] para. 68; 14 December 2023 – C-340/21 – [Natsionalna agentsia za prihodite] paras. 41 et seq.).
88
(bbb) The relevant national provisions here – like Article 5(1) in conjunction with Article 32(1) GDPR – require the controller, depending on the circumstances of the case, to implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk. In doing so, taking into account the requirements of national law, among others, In addition to the mandatory requirements set out in Section 276 (2) of the Social Code (SGB V) and Section 35 (1) of the Social Code (SGB I), the criteria listed non-exhaustibly in Section 67a (1) and Section 67b of the Social Code (SGB X) in conjunction with Section 22 (2) of the Federal Data Protection Act (BDSG) must be taken into account.
89
On this basis, the suitability of the technical and organizational measures must be assessed in two steps. First, the risks of a breach of the protection of personal data posed by the processing in question and their potential consequences for the rights and freedoms of natural persons must be determined. This assessment must be carried out specifically, taking into account the likelihood and severity of the identified risks. Second, it must be examined whether the measures taken by the controller are appropriate to these risks, taking into account the state of the art, the implementation costs, and the nature, scope, circumstances, and purposes of this processing, while bearing in mind that the controller has a certain degree of discretion in determining the measures (see ECJ 14 December 2023 – C-340/21 – [Natsionalna agentsia za prihodite] paras. 41 et seq.).
90
(ccc) In the context of this examination, it must first be established that employees of the defendant who are affected by an opinion such as this one can legitimately expect that their health data will remain confidential from their employer and colleagues. If such data is disclosed, there is a risk of experiencing disadvantages in personnel decisions or stigmatization among employees. However, this risk is already limited by statutory regulations, as Section 35 (1) of the German Social Code (SGB I) prohibits HR managers and those involved in personnel decisions from having access to such data. On the other hand, it is limited by the requirements contained in Section 276 Paragraph 2, Sentences 6 to 9 of the Social Code Book V (SGB V). The defendant has complied with these requirements with the service instructions issued and the service agreement concluded with the staff council, whereby the instructions and regulations contained therein are each based on the processing of data subjects’ health data by the defendant using ISmed. According to the service agreement, access to the ISmed 3 software was achieved using a soft certificate. Access rights were defined in ISmed 3 by assigning rights and roles, which ensured that only those employees who are internally responsible for processing the order according to previously agreed specifications have access to the social data of a data subject. Access authorization was technically checked systematically in advance for each process. For the completion of tasks in accordance with Section 275 Paragraph 1 of the SGB V, which include, among other things: To address the issues affecting the defendant's own employees, a (virtual) "Special Case" organizational unit was created within ISmed 3. Due to technical restrictions, access was restricted to the units—a total of 36 of the defendant's more than 1,000 employees. Furthermore, a developed role concept within this unit ensured that the relevant expert opinion orders were not processed by employees who worked with the person concerned in a department, which was also technically secured. After completion of the expert opinion order, the order and the expert opinion, including the remaining electronic medical documents, were stored in ISmed 3's electronic archive. There, the order data was stored together with the master data and separately from the expert opinion data in two databases. Merging was only possible using a key stored in an Oracle encryption library. In any case, the nine employees of the "IT Department" sub-division of the "Special Case" organizational unit continued to have technical access to all expert opinions prepared within this unit after archiving. The parties do not dispute that the defendant complied with the requirements regarding the data protection officer. Furthermore, the defendant informed all employees of the social secrecy requirement pursuant to Section 35 of the German Social Code (SGB I) as part of the work instructions and renewed this instruction at regular intervals.
91
(ddd) The Regional Labor Court's assessment that, based on this, the defendant's protective measures are to be considered sufficient is correct.
92
(aaaa) The precautions were – at least in compliance with the existing guarantees within the meaning of Article 9 (3) GDPR, i.e., the existing (punishable) professional secrecy and the (also punishable) confidentiality obligation derived from the defendant's obligation to social secrecy – suitable to fundamentally rule out the possibility of the risks associated with the processing of employees' health data materializing. The defendant has ensured, through organizational regulations and in view of the fact that the "Special Case" organizational unit is a purely virtual structure, that the processing always necessary in connection with a medical opinion is only carried out by persons who do not work at the same location as an affected employee, but at another, even geographically distant location. Such persons did not pose a significant risk of compromising the plaintiff's integrity, in particular no risk of suffering disadvantages due to personal acquaintance. To the extent that such a risk could have materialized more easily during a physical examination, the defendant countered this by instructing the Knappschaft to delegate medical opinions requiring such an assessment to the Knappschaft. It must be admitted that the plaintiff's actions did not completely rule out the possibility of a direct colleague in the IT department gaining knowledge of the information in the course of his professional duties. In this respect, however, it should be noted that although IT employees have technical access to expert opinions, their duties, according to the defendant's unchallenged submission, typically do not entail acquainting themselves with the content of expert opinions. If they do so, this is unauthorized and can result in significant employment law consequences.
93
(bbbb) The fact that, in the plaintiff's case, a direct colleague of the plaintiff gained access to the archived expert opinion – especially at the plaintiff's own instigation and in violation of the defendant's instructions – is not sufficient to assume inadequate safeguards. In this respect, it must be taken into account that, as confirmed by Recital 83 of the General Data Protection Regulation, the EU legislature, in the context of the required measures, pursues the objective of "mitigating" the risks of a personal data breach, without claiming that they can be eliminated (see ECJ, 14 December 2023 – C-340/21 – [Natsionalna agentsia za prihodite], paras. 38 et seq.). This intention of the EU legislature is equally relevant to the question of whether the defendant complied with its obligations under national law to uphold the principles of integrity and confidentiality.
94
Taking into account all the circumstances of the present case, this question must be answered in the affirmative. The defendant, in principle, took appropriate safeguards for the normal course of administrative operations. Admittedly, a controller must always assume a certain risk that employees will not comply with instructions or other general requirements. However, the defendant's discretion to counter the risk with the measures taken would at most have been exceeded if unauthorized access had occurred more frequently. However, according to the defendant's – again undisputed – statements, this is not the case here. In any case, under this premise, it was particularly not necessary to exclusively involve another service for medical opinions concerning the defendant's own employees, such as the miners' insurance fund for a required physical examination. It cannot be ignored that such a regular process would in turn entail its own risks, simply because of the additionally required data exchange. Secondly, such a regular "external" commissioning does not change the fact that the defendant is obligated to prepare an expert opinion in relation to the commissioning health insurance company. Even assuming a complete "external" outsourcing of the expert opinion, the defendant would still have to further process the results of this assessment for transmission to the commissioning health insurance company, and for this purpose, storage in the ISmed 3 system would have to be considered necessary. Finally, as already discussed in the context of the proportionality assessment conducted above (see paras. 63 et seq.), engaging another service would not be equally effective and economical.
95
(3) Since, in light of all of the above, no violation of the General Data Protection Regulation can be identified, it can remain open whether the plaintiff's arguments regarding the further requirements for a claim for damages under Article 82 (1) GDPR are conclusive, in particular whether damage has been sufficiently demonstrated according to the requirements of this provision.
96
c) The requirements for a claim for damages based on other possible grounds for a claim are also not met. In particular, the claim for non-material damages pursued in the main claim under 1 is not justified under Section 823 (1) of the German Civil Code (BGB) in conjunction with Article 2 (1) and Article 1 (1) of the German Basic Law (GG). If – as in this case – data processing is permissible under the provisions of the General Data Protection Regulation and national regulations, the right to informational self-determination of the employee affected by the data processing is protected (cf. Federal Labor Court (Bundesarbeitsgericht) April 9, 2019 – 1 ABR 51/17 – para. 51 with further references, Federal Employment Agency (BAGE) 166, 269).
97
II. The action is also unsuccessful in other respects. The main claims 2 and 4, with which the plaintiff pursues claims for material damages or seeks a declaration to that effect, are unfounded. The alternative declaratory claim 3 was not submitted to the Senate for decision.
98
1. The main claim 2 is admissible without further ado as a quantified claim for benefits. The claim 4 does raise admissibility concerns with regard to an existing interest in a declaratory judgment. However, it is in any event unfounded.
99
a) The fourth motion is sufficiently specific, but requires interpretation in this respect.
100
aa) The motion is directed "for the period from November 2019" at establishing the defendant's obligation to compensate the plaintiff for the material damages that he "has suffered and/or will suffer as a result of the violation of his personality rights asserted in the action." Taken literally, the motion would be inadmissible because it does not meet the specificity requirement of Section 253 (2) No. 2 of the Code of Civil Procedure. In a motion for a declaratory judgment, the legal relationship to be established must be described in the motion so precisely that there is no doubt as to the scope of the res judicata (cf. Federal Labor Court (Bundesarbeitsgericht) April 7, 2004 – 7 ABR 35/03 – at B II 3 c of the Reasons, BAGE 110, 146).
101
bb) However, the literal wording of a motion is not required for the understanding of the motion. Rather, the court must examine the declared intent as it emerges from the grounds of the action, the objective of the proceedings, and the interests involved. The rules of interpretation applicable to declarations of intent (§§ 133, 157 BGB) must be applied for the interpretation. The appeal court is also authorized to interpret motions (cf. Federal Labor Court, March 16, 2010 – 3 AZR 744/08 – para. 19; January 23, 2007 – 9 AZR 557/06 – para. 20 with further references).
102
cc) According to its meaning, the application seeks a declaration of the defendant's obligation to compensate the plaintiff for the loss of earnings that he has already incurred and will incur in the future since November 1, 2019, resulting from the allegedly unauthorized telephone call between the defendant's expert and his treating physician in connection with the preparation of a socio-medical report dated June 22, 2018. This takes into account, firstly, that the plaintiff most recently based his claim for material damages in the second instance exclusively on the aforementioned telephone call. Secondly, in his second claim for compensation, the plaintiff is solely claiming – in this respect, quantified – loss of earnings for the period prior to November 1, 2019. It is obvious that the declaratory action is intended to relate to an obligation to compensate for corresponding damages for the subsequent period.
103
In this interpretation, the application meets the requirements of Section 253 (2) No. 2 of the Code of Civil Procedure (ZPO).
104
b) Whether the plaintiff has a legal interest in the requested declaratory judgment (Section 256 (1) of the Code of Civil Procedure (ZPO)) is irrelevant.
105
aa) However, the arguments presented so far regarding the requirements of Section 256 (1) of the Code of Civil Procedure (ZPO) are insufficient (see the Federal Court of Justice (BGH) October 5, 2021 – VI ZR 136/20 – paras. 16 et seq. with further references regarding the interest in a declaratory judgment in a claim for a declaration of liability for damages). The plaintiff did indeed assert in the oral hearing before the Regional Labor Court that he continued to be unable to work beyond October 31, 2019. However, he did not provide any evidence regarding the causes of this additional illness and thus did not adequately demonstrate the mere possibility of further damage occurring as a result of the telephone call made in mid-2018. For this reason alone, the interest in a declaratory judgment is questionable.
106
bb) Ultimately, this is irrelevant to the admissibility of the action. The interest in obtaining a declaratory judgment is a genuine procedural prerequisite only for a judgment granting the claim (Federal Labor Court, October 18, 2023 – 5 AZR 22/23 – para. 13 with further references).
107
2. The second and fourth applications are (in any case) unfounded. The plaintiff seeks material damages under Article 82 (1) GDPR and Section 823 (1) BGB in conjunction with Article 2 (1) and Article 1 (1) GG. As justification, he invoked the inadmissibility of the processing of his data due to the alleged fact that the defendant's expert was not authorized to obtain information from his treating physician by telephone. However, as already stated in relation to claim 1, the doctor's conduct does not constitute an impermissible processing of the plaintiff's health data and therefore also does not constitute an impermissible interference with his general personality rights. Therefore, a claim for material damages is also generally lacking in terms of liability.
108
3. According to the statement of reasons for the action, the alternative claim 3 was filed only in the event that claim 2 was inadmissible. This intra-procedural condition has not been met.
109
III. The decision on costs follows from Section 97 (1) of the Code of Civil Procedure.
Categories:
- BAG (Germany)
- Germany
- Article 2(1) GDPR
- Article 4(1) GDPR
- Article 4(2) GDPR
- Article 4(7) GDPR
- Article 4(15) GDPR
- Article 5(1)(a) GDPR
- Article 5(1)(f) GDPR
- Article 6(1) GDPR
- Article 6(3) GDPR
- Article 9(1) GDPR
- Article 9(2)(h) GDPR
- Article 9(3) GDPR
- Article 32(1)(a) GDPR
- Article 32(1)(b) GDPR
- Article 82(1) GDPR
- Article 99(2) GDPR
- 2024
- German
