CJEU - C-453/21 - X-Fab Dresden GmbH & Co. KG: Difference between revisions

Latest revision as of 12:19, 12 May 2023

CJEU - C-453/21 X-Fab Dresden GmbH & Co. KG

Court:	CJEU
Jurisdiction:	European Union
Relevant Law:	Article 38(3) GDPR Article 38(6) GDPR
Decided:	09.02.2023
Parties:	X-Fab Dresden GmbH & Co. KG
Case Number/Name:	C-453/21 X-Fab Dresden GmbH & Co. KG
European Case Law Identifier:	ECLI:EU:C:2023:79
Reference from:	BAG (Germany) ECLI:DE:BAG:2021:210721.U.5AZR572.20.0
Language:	24 EU Languages
Original Source:	Judgement
Initial Contributor:	Bernardo Armentano

The CJEU held that each member state is allowed to lay down more specific rules concerning the dismissal of a DPO, provided that these rules are compatible with EU law and the GDPR. The CJEU also held that a 'conflict of interest', pursuant to Article 38(3) GDPR, may exist when a DPO is entrusted with other tasks or duties, which would result in him/her determining the objectives and methods of personal data processing on behalf of the processor/controller.

English Summary

Facts

The data subject was an employee of the controller, X-FAB (a semiconductor foundry), and held two functions in the company: he was the chairman of the work council and the DPO of X-Fab and other companies of the same group of undertakings. However, on 1 December 2017, the data subject was dismissed from his duties as a DPO, at the request of the DPA of Thuringen (TLfDI) (Germany). As a precautionary measure, the other undertakings also decided to dismiss him, based on the second sentence of Article 38(3) of the GDPR, which had in the intervening period become applicable.

Dissatisfied, the DPO brought action before the a Court in Germany, asking to be reinstated in his position. The controller argued that his positions as a DPO and as the chair of the work council were incompatible as there was a potential conflict of interests between the two functions. In subsequent proceedings, both the courts of first instance and of appeal upheld the data subject’s action. The controller then appealed to the Bundesarbeitsgericht (Federal labour court of Germany).

This Federal Court observed that the outcome of this appeal would depend on the interpretation of EU Law. Specifically, the Bundesarbeitsgericht stated that the question arose as to whether the second sentence of Article 38(3) GDPR (He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks) precludes national legislation from making the dismissal of a DPO subject to stricter conditions than those laid down by EU law. If this was the case, the Court wondered whether that provision had a sufficient legal basis.

The Court also noted that it would be necessary to determine whether the functions of chair of the works council and of DPO may be performed simultaneously the same person or whether that would give rise to a conflict of interests within the meaning of the second sentence of the aforementioned article.

The Bundesarbeitsgericht asked the following preliminary questions to the CJEU:

‘(1) Is the second sentence of Article 38(3) of [the GDPR] to be interpreted as precluding a provision in national law, such as, in the present case, Paragraph 38(1) and (2) in conjunction with the first sentence of Paragraph 6(4) of the [BDSG], which makes dismissal of the [DPO] by the controller, who is his employer, subject to certain conditions set out therein, irrespective of whether such dismissal relates to the performance of his tasks?

If the first question is answered in the affirmative:

(2) Does the second sentence of Article 38(3) GDPR also preclude such a provision in national law if the designation of the [DPO] is mandatory not in accordance with Article 37(1) GDPR, but only in accordance with the law of the Member State?

If the first question is answered in the affirmative:

(3) Does the second sentence of Article 38(3) of the GDPR have sufficient legal basis, in particular in so far as it covers [DPOs] that have an employment relationship with the controller?

If the first question is answered in the negative:

(4) Is there a conflict of interests within the meaning of the second sentence of Article 38(6) of the GDPR if the [DPO] also holds the office of [chair] of the works council established at the controlling body? Must specific tasks have been assigned within the works council in order for such a conflict of interests to be assumed to exist?’

Advocate General Opinion

Not applicable

Holding

The CJEU provided answers to the first and fourth preliminary question.

It started with the first question by interpreting Article 38(3) GDPR. According to its own case law, to do so we need to consider the wording of the provision, it's meaning in everyday language, as well as its context and objectives.

First, with regard to the wording, the Court held that the GDPR did not define the terms ‘dismissed’, ‘penalised’ and ‘for performing his [or her] tasks’ in the second sentence of Article 38(3) GDPR. Thus, it considered the use of these terms in normal everyday language to determine their meanings. Based on this line of reasoning, the CJEU concluded that the dismissal of a DPO grounded on the performance of his or her tasks is not allowed. The CJEU also held that the second sentence of Article 38(3) GDPR is intended to apply to any relationship between DPOs and controllers/processors, irrespective of the nature of the relationship.

Second, with regard to the objective of the second sentence of Article 38(3) GDPR, the CJEU referred to Recital 97, which states that DPOs should be in a position from where they can perform their duties and tasks in an independent manner. This independence should enable them to carry out tasks in accordance with the objective of the GDPR, thereby ensuring its consistent and homogeneous application. The CJEU also emphasized this independence is also apparent in the first and third sentences of Article 38(3) GDPR. The first sentence of states that DPOs should not to receive any instructions regarding the exercise of his duties, while the third states that DPOs should also report directly to the highest level of management of the controller/processor. In this context, Article 38(5) GDPR provides that DPO is to be bound by secrecy or confidentiality. Therefore, the CJEU concluded that the objective of Article 38(3) GDPR was to preserve the functional independence of the DPO and to ensure that the GDPR is effective.

Third, the Court assessed the context of the provision. The CJEU assessed the preamble of the GDPR and noted that it was adopted on the basis of Article 16(2) TFEU. This provision states that the Council of the European Union and the European Parliament were laying down rules for the protection of natural persons with regard to the processing of personal data on the one hand, and the free movement of such data on the other. The CJEU held that laying down rules against the dismissal of a DPO fell within the scope of protection of natural persons. From this context, it followed that each member state was free to lay down more protective specific rules concerning the dismissal of a DPO, as long as these national provisions were compatible with the GDPR and EU law, especially with the second sentence of Article 38(3) GDPR. However, if a DPO no longer possesses the professional qualities for the position, he/she cannot be protected as this would undermine the GDPR's objective of ensuring a consistent and homogeneous application of data protection rules.

Answering the first preliminary question, the CJEU concluded that it was up to the national court to determine if the specific national provision was compatible with the GDPR and EU law.

The CJEU then assessed the fourth question. Just like with the first question, the court looked at the wording, the objective and the context of the provision.

First, the Court looked at the wording of Article 38(3) GDPR itself by assessing the wording of this provision in everyday language. The court stated that the there was no established incompatibility in the GDPR between the performance of the DPO's duties on the one hand, and the performance of other duties on the other. Article 38(3) GDPR specifically provided that the DPO can be given tasks other than those for which he/she is responsible under Article 39 GDPR.

Second, the court looked at the objective of Article 38(3) GDPR, ⁣ which was to preserve the functional independence of the DPO and, consequently, to ensure the effectiveness of the GDPR.

Third, the CJEU looked at the context of Article 38(3) GDPR and noted that, according to Article 39(1)(b) GDPR, the task of the DPO was to monitor compliance with the GDPR, EU law and/or national data protection law. The DPO also had to assess the policies of the controller or processor regarding data protection, including the assignment of responsibilities, awareness-raising and training of staff. It followed from this that a DPO cannot be entrusted with tasks or duties which would result in him or her determining the objectives and methods of processing personal data on behalf of the controller or its processor. Under EU law or national law, the review of those objectives and methods must be carried out independently by the DPO. An assessment of a potential conflict of interests, within the meaning of Article 38(3) GDPR, ⁣ must be carried out on a case by case basis, with an assessment of all the relevant circumstances. The Court emphasised the organisational structure of the controller or its processor and in the light of all the applicable rules, including any policies of the controller or its processor, as an important factor.

The CJEU concluded that a 'conflict of interest' may exist where a DPO is entrusted with other tasks or duties, which would result in he/she determining the objectives and methods of processing personal data on behalf of the processor/controller. National courts had to assess such a situation on a case by case basis, considering all the relevant circumstances. The courts had to pay particular attention to the organisational structure of the controller/processor in the light of all applicable rules, including the own policies of the controller/processor.

Comment

The CJEU did not answer the second and third preliminary question because of the answer to the first question.

The CJEU ruling did not provide much information regarding the prior proceedings and the arguments which were used there. This is reflected in the summary. For instance, it is not clear what were the data subjects arguments. Most likely that these arguments were (partly) based on German law, which states that a controller/processor cannot dismiss a DPO unless there is 'just cause' for the dismissal. These German provisions seemed to provide stricter rules for the dismissal of a DPO in comparission with Article 38 GDPR. (These German provisions were Paragraph 38(1) and 38(2) of the BDSG, in conjunction with paragraph 6(4) of the BDSG and lastly, Paragraph 626 of the Civil Code - see paragraphs 7 - 9 of this CJEU ruling for more context) .

Further Resources

Share blogs or news articles here!

@@ Line 39: / Line 39: @@
 |Reference_Case_Number_Name=ECLI:DE:BAG:2021:210721.U.5AZR572.20.0
-|Initial_Contributor=
+|Initial_Contributor=Bernardo Armentano
 |
 }}
-'''SUMMARY NOT FINALISED YET, To be updated'''
+The CJEU held that each member state is allowed to lay down more specific rules concerning the dismissal of a DPO, provided that these rules are compatible with EU law and the GDPR. The CJEU also held that a '''conflict of interest''<nowiki/>', pursuant to [[Article 38 GDPR#3|Article 38(3) GDPR]], may exist when a DPO is entrusted with other tasks or duties, which would result in him/her determining the objectives and methods of personal data processing on behalf of the processor/controller.
 ==English Summary==
 === Facts ===
-In this decision, the data subject had been an employee of X-FAB, a semiconductor foundry, since 1993. He held two functions in the company. He was the chairman of the workcouncil and he was the DPO of the company since 2015. However, on 1 December 2017, he was suddenly fired as DPO at the request of the state officer for data protection of Thuringen (Germany), based on the second sentence of [[Article 38 GDPR|Article 38(3) GDPR]], which states that ....... (13).
+The data subject was an employee of the controller, X-FAB (a semiconductor foundry), and held two functions in the company: he was the chairman of the work council and the DPO of X-Fab and other companies of the same group of undertakings. However, on 1 December 2017, the data subject was dismissed from his duties as a DPO, at the request of the [https://gdprhub.eu/index.php?title=TLfDI_(Thuringia) DPA of Thuringen (TLfDI) (Germany)]. As a precautionary measure, the other undertakings also decided to dismiss him, based on the second sentence of Article [[Article 38 GDPR#3|38(3) of the GDPR]], which had in the intervening period become applicable.
-The data subject brought action before the first instance German court in order to be reinstated as DPO at the controller. The latter argued that his functions as DPO and chair of the workcouncil were incompatible. The court of first instance and the court op appeal agreed with the data subject. The controller appealed this at the Bundesarbeitsgericht, which referred questions to the CJEU. (15)
+Dissatisfied, the DPO brought action before the a Court in Germany, asking to be reinstated in his position. The controller argued that his positions as a DPO and as the chair of the work council were incompatible as there was a potential conflict of interests between the two functions. In subsequent proceedings, both the courts of first instance and of appeal upheld the data subject’s action. The controller then appealed to the Bundesarbeitsgericht (Federal labour court of Germany).
-=== Advocate General Opinion ===
+This Federal Court observed that the outcome of this appeal would depend on the interpretation of EU Law. Specifically, the Bundesarbeitsgericht stated that the question arose as to whether the second sentence of [[Article 38 GDPR#3|Article 38(3) GDPR]] (''He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks'') precludes national legislation from making the dismissal of a DPO subject to stricter conditions than those laid down by EU law. If this was the case, the Court wondered whether that provision had a sufficient legal basis.
+The Court also noted that it would be necessary to determine whether the functions of chair of the works council and of DPO may be performed simultaneously the same person or whether that would give rise to a ''conflict of interests'' within the meaning of the second sentence of  the aforementioned article.
+The Bundesarbeitsgericht asked the following preliminary questions to the CJEU:
+''‘(1)      Is the second sentence of Article 38(3) of [the GDPR] to be interpreted as precluding a provision in national law, such as, in the present case, Paragraph 38(1) and (2) in conjunction with the first sentence of Paragraph 6(4) of the [BDSG], which makes dismissal of the [DPO] by the controller, who is his employer, subject to certain conditions set out therein, irrespective of whether such dismissal relates to the performance of his tasks?''
+''If the first question is answered in the affirmative:''
+''(2)      Does the second sentence of Article 38(3) GDPR also preclude such a provision in national law if the designation of the [DPO] is mandatory not in accordance with Article 37(1) GDPR, but only in accordance with the law of the Member State?''
+''If the first question is answered in the affirmative:''
+''(3)      Does the second sentence of Article 38(3) of the GDPR have sufficient legal basis, in particular in so far as it covers [DPOs] that have an employment relationship with the controller?''
+''If the first question is answered in the negative:''
+''(4)      Is there a conflict of interests within the meaning of the second sentence of Article 38(6) of the GDPR if the [DPO] also holds the office of [chair] of the works council established at the controlling body? Must specific tasks have been assigned within the works council in order for such a conflict of interests to be assumed to exist?’''
+=== Advocate General Opinion  ===
 Not applicable
 === Holding ===
-With the first question, the referring court asked the CJEU if Article 38(3) GDPR should be interpreted in such a way that it precluded a provision in national law, which would make the dismissal of the DPO, who was also an employee, by the controller subject to certain conditions in this national law, irrespective if of this dismissal related to the performance of his tasks.
+The CJEU provided answers to the first and fourth preliminary question.
-First, the court held that the GDPR does not define the terms ‘dismissed’, ‘penalised’ and ‘for performing his [or her] tasks’ in the second sentence of Article 38(3). The Court considered the use of these words in normal everyday language, and considered that that this implied that the DPO in question must be protected against any decision terminating him or her duties, by which he or she would be placed at a disadvantage or which would constitute a penalty. A measure resulting in the dismissal of the DPO by the controller or processor is capable of constituting such a measure.
-Second, the court held that the second sentence of Article 38(3) GDPR applies whether or not the DPO is an employee of the controller/processor. The second sentence of Article 38(3) GDPR is intended to apply to any relationship between DPO’s on the one hand and controller’s and processors on the other hand, irrespective of the nature of the relationship.
+It started with <u>the first question</u> by interpreting [[Article 38 GDPR#3|Article 38(3) GDPR]]. According to its own case law, to do so we need to consider the '''wording of the provision''', it's meaning in everyday language, as well as its '''context''' and '''objectives'''.
-Third,  Article 38 GDPR imposes a limit to prohibit the dismissal of a DPO on a ground relating to the performance of his or her tasks. One of these tasks is the monitoring of compliance with EU or Member State legal provisions on data protection and with the policies of the controller or processor concerning the protection of personal data. (Article 39(1)(b) GDPR.
+''First'', with regard to the '''wording''', the Court held that the GDPR did not define the terms ‘''dismissed''’, ‘''penalised''’ and ''‘for performing his [or her] tasks''’ in the second sentence of [[Article 38 GDPR|Article 38(3) GDPR]]. Thus, it considered the use of these terms in normal everyday language to determine their meanings. Based on this line of reasoning, the CJEU concluded that the dismissal of a DPO grounded on the performance of his or her tasks is not allowed. The CJEU also held that the second sentence of [[Article 38 GDPR#3|Article 38(3) GDPR]] is intended to apply to any relationship between DPOs and controllers/processors, irrespective of the nature of the relationship.
-The Court continued to refer to recital 97 in order to describe the objective pursued by Article 38(3) GDPR. DPO’s, whether or not they are employees of the controller, should be in a position to perform their duties and tasks in an independent manner. They should therefore be able to carry out tasks in accordance with the objective of the GDPR, which is, pursuant to recital 10, to ensure a consistent and homogeneous application of data protection rules.
+''Second'', with regard to the '''objective''' of the second sentence of [[Article 38 GDPR#3|Article 38(3) GDPR]], the CJEU referred to Recital 97, which states that DPOs should be in a position from where they can perform their duties and tasks in an independent manner. This independence should enable them to carry out tasks in accordance with the objective of the GDPR, thereby ensuring its consistent and homogeneous application. The CJEU also emphasized this independence is also apparent in the first and third sentences of [[Article 38 GDPR#3|Article 38(3) GDPR]]. The first sentence of  states that DPOs should not to receive any instructions regarding the exercise of his duties, while the third states that DPOs should also report directly to the highest level of management of the controller/processor. In this context, [[Article 38 GDPR|Article 38(5) GDPR]] provides that DPO is to be bound by secrecy or confidentiality. Therefore, the CJEU concluded that the objective of [[Article 38 GDPR#3|Article 38(3) GDPR]] was to preserve the functional independence of the DPO and to ensure that the GDPR is effective.
-The court continued with the fact that the the objective of ensuring the functional independence of the DPO, pursuant to the second sentence of Article 38(3) GDPR, is also apparent from the first and third sentences of this Article. This requires that that DPO should not to receive any instructions regarding the exercise of his duties as DPO. He/she should also report directly to the highest level of management of the controller/processor. In this context, Article 38(5) GDPR which provides that DPO is to be bound by secrecy or confidentiality in this regard.
+''Third'', the Court assessed the '''context''' of the provision. The CJEU assessed the preamble of the GDPR and noted that it was adopted on the basis of Article 16(2) TFEU. This provision states that the Council of the European Union and the European Parliament were laying down rules for the protection of natural persons with regard to the processing of personal data on the one hand, and the free movement of such data on the other. The CJEU held that laying down rules against the dismissal of a DPO fell within the scope of protection of natural persons. From this context, it followed that each member state was free to lay down more protective specific rules concerning the dismissal of a DPO, as long as these national provisions were compatible with the GDPR and EU law, especially with the second sentence of [[Article 38 GDPR#3|Article 38(3) GDPR]]. However, if a DPO no longer possesses the professional qualities for the position, he/she cannot be protected as this would undermine the GDPR's objective of ensuring a consistent and homogeneous application of data protection rules.
-Therefore, the second sentence of Article 38(3) of the GDPR must be regarded as seeking to preserve the functional independence of the DPO and to ensure that the GDPR is effective. This interpretation is supported by the context of the provision an by the legal basis on which the EU legislature adopted the GDPR, which was Article 16(2) TFEU. From this, it followed that each member state was free to lay down more protective specific rules concerning the dismissal of a DPO, as long as these national provisions are compatible with the GDPR and EU law, in particular the second sentence for Article 38(3) GDPR. The court also noted that such increased protection cannot undermine the objectives of the GDPR. That would be the case if this increased protection would prevent any dismissal a DPO who no longer possesses the professional qualities required pursuant to Article 37(5) GDPR, or who does not fulfil his/her tasks. If a DPO would be so protected that he/she could not be fired anymore, even when they were not up for the task, this would undermine the objective of the GDPR.
+Answering the <u>first preliminary question</u>, the CJEU concluded that it was up to the national court to determine if the specific national provision was compatible with the GDPR and EU law.
-The court concluded that it was up to the national court to determine if the specific provision were compatible with the GDPR and EU law.
+The CJEU then assessed the <u>fourth question</u>. Just like with the first question, the court looked at the '''wording''', the '''objective''' and the '''context''' of the provision.
-Fourth question
+''First'', the Court looked at the '''wording''' of [[Article 38 GDPR#3|Article 38(3) GDPR]] itself by assessing the wording of this provision in everyday language. The court stated that the there was no established incompatibility in the GDPR between the performance of the DPO's duties on the one hand, and the performance of other duties on the other. [[Article 38 GDPR#3|Article 38(3) GDPR]] specifically provided that the DPO can be given tasks other than those for which he/she is responsible under [[Article 39 GDPR]].
-The fourth question was basically a request for clarification of the phrase ‘conflict of interest’ within the meaning of Article 38(6) GDPR. The controller had to ensure that potential other  tasks and duties of its DPO do not result in a conflict of interest. The court used different interpretation methods to determine the meaning of the phrase.
+''Second'', the court looked at the '''objective''' of [[Article 38 GDPR#3|Article 38(3) GDPR, ⁣]] which was to preserve the functional independence of the DPO and, consequently, to ensure the effectiveness of the GDPR.
-First, the Court looked at the wording of Article 38(6) GDPR itself by looking and the use of the phrase in everyday language. The court held that, in accordance with the objective pursued by Article 38(6) GDPR, the DPO cannot be entrusted with performing tasks or duties which could impair the execution of the functions performed by the DPO.
+''Third'', the CJEU looked at the '''context''' of [[Article 38 GDPR|Article 38(3) GDPR]] and noted that, according to [[Article 39 GDPR|Article 39(1)(b) GDPR]], the task of the DPO was to monitor compliance with the GDPR, EU law and/or national data protection law. The DPO also had to assess the policies of the controller or processor regarding data protection, including the assignment of responsibilities, awareness-raising and training of staff. It followed from this that a DPO cannot be entrusted with tasks or duties which would result in him or her determining the objectives and methods of processing personal data on behalf of the controller or its processor. Under EU law or national law, the review of those objectives and methods must be carried out independently by the DPO. An assessment of a potential conflict of interests, within the meaning of [[Article 38 GDPR#3|Article 38(3) GDPR, ⁣]] must be carried out on a case by case basis, with an assessment of all the relevant circumstances. The Court emphasised the organisational structure of the controller or its processor and in the light of all the applicable rules, including any policies of the controller or its processor, as an important factor.
-Second, the court looked at the objective pursued by Article 38(6) GDPR, which was to preserve the functional independence of the DPO and, consequently, to ensure the effectiveness of the provisions of the GDPR.
+The CJEU concluded that a '''conflict of interest''<nowiki/>' may exist where a DPO is entrusted with other tasks or duties, which would result in he/she determining the objectives and methods of processing personal data on behalf of the processor/controller. National courts had to assess such a situation on a case by case basis, considering all the relevant circumstances. The courts had to pay particular attention to the organisational structure of the controller/processor in the light of all applicable rules, including the own policies of the controller/processor.
-Third, the CJEU looked at the context of Article 38(6) of the GDPR and noted that, according to Article 39(1)(b) of the GDPR, the task of the DPO is, inter alia, to monitor compliance with the GDPR, other provisions of EU law or of the law of the Member States on data protection and the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits. From this, it followed that , that a DPO cannot be entrusted with tasks or duties which would result in him or her determining the objectives and methods of processing personal data on the part of the controller or its processor. Under EU law or the law of the Member States on data protection, the review of those objectives and methods must be carried out independently by the DPO. existence of a conflict of interests, within the meaning of Article 38(6) of the GDPR, must be carried out, case by case, on the basis of an assessment of all the relevant circumstances, in particular the organisational structure of the controller or its processor and in the light of all the applicable rules, including any policies of the controller or its processor.
 == Comment ==
 The CJEU did not answer the second and third preliminary question because of the answer to the first question.
+The CJEU ruling did not provide much information regarding the prior proceedings and the arguments which were used there. This is reflected in the summary. For instance,  it is not clear what were the data subjects arguments. Most likely that these arguments were (partly) based on German law, which states that a controller/processor cannot dismiss a DPO unless there is ''<nowiki/>'just cause''<nowiki/>' for the dismissal. These German provisions seemed to provide stricter rules for the dismissal of a DPO in comparission with [[Article 38 GDPR]]. (These German provisions were Paragraph 38(1) and 38(2) of the BDSG, in conjunction with paragraph 6(4) of the BDSG and lastly, Paragraph 626 of the Civil Code - see paragraphs 7 - 9 of this CJEU ruling for more context)  .
 == Further Resources ==
 ''Share blogs or news articles here!''