LAG Hessen - 9 Sa 1431/19
From GDPRhub
| LAG Hessen - 9 Sa 1431/19 | |
|---|---|
 | |
| Court: | LAG Hessen (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15(1) GDPR |
| Decided: | 10.06.2021 |
| Published: | |
| Parties: | Transporting Company Employee |
| National Case Number/Name: | 9 Sa 1431/19 |
| European Case Law Identifier: | ECLI:DE:LAGHE:2021:0610.9SA1431.19.00 |
| Appeal from: | LAG Wiesbaden (Germany) 6 Ca 396/19 |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | Bürgerservice Hessenrecht (in German) |
| Initial Contributor: | Jannik |
The Regional Labour Court of Hessen decided that an employer who cannot prove the existence of overriding confidentiality interests has to provide information pursuant to Article 15 GDPR to an employee, even if such information can be used in defence against criminal proceedings initiated by the employer.
English Summary
Facts
The controller, a transporting company located in Germany, employed the data subject for the delivery and assembly of goods. The company filed criminal charges against the employee for aggravated fraud based on falsely overcharged travel expenses and terminated the employment contract.
In order to prove their innocence, the employee requested information pursuant to Article 15 GDPR from the controller, arguing that the information was required for a proper defence within the criminal proceding. The company did not name any interest in secrecy or conflicting interests worthy of protection but refused to provide the information requested. It claimed that the access to confidential data prior to the conclusion of the criminal proceeding resulted in an abuse of rights.
In a first instance, the Labour Court of Wiesbaden decided that the defendant was entitled to receive the information requested because the controller did not provide evidence its overriding confidentiality interests. The data subject filed an appeal.
Holding
The Regional Labour Court of Hesse held that the company's confidentiality interests did not override those of the defendant in effective legal protection recognized by the GDPR. Although the purpose of the right to access is to enable the control of lawfulness of the processing of personal data, the pursuit of further purposes and different motives, such as the exercise of defence rights in a criminal proceeding, does not justify a refusal.
At the same time, the data subject is not required to limit his request for information. The individual pieces of information listed in the application correspond to the standardized requirements of Article 15(1) GDPR and represent the right to information embodied therein. In conclusion, the court upheld the previous court's decision as the company failed to sufficiently substantiate their concerns.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
1. If the employer does not fulfill his general obligation to provide information according to Art. 15 GDPR at all, an overriding interest of the employer that needs to be protected against the legitimate interests of the plaintiff secured by the provisions of the GDPR, including effective legal protection, is not to be recognized. The plaintiff should neither be required to limit his request for information in the application by more specific formulations compared to the provisions of the regulation, nor should his application be interpreted. Whether other standards are to be applied if the person entitled to information considers information already provided to be incomplete under data protection law and requests further information did not have to be clarified in the case at hand. 2. The degree of detail of the information to be communicated must be based on recital 63 of the GDPR. The right to information relates to the so-called "master data" of the person entitled to receive information. In the case of a general right to information, only the "following information" is to be provided in accordance with Art. 15 Para. 1 Clause 2 GDPR. This puts the employee in a position to recognize for what purpose, with what means and with what aim the employer has collected, stored and, if necessary, passed on personal data from him. Hide procedureProcedure Proceeding ArbG Wiesbaden, November 13, 2019, 6 Ca 396/19, judgment subsequently BAG, 2 AZR 330/21 tenor The defendant's appeal against the judgment of the Wiesbaden Labor Court of November 13, 2019 - 6 Ca 396/19 - is rejected. The defendant has to bear the costs of the appeal. The revision is allowed. facts The parties dispute the plaintiff's right to information under Article 15 of the General Data Protection Regulation (GDPR). The defendant essentially provides services for another company, A GmbH (hereinafter A GmbH), a retail company. The defendant transports the goods to the customer on behalf of A GmbH, installs them there and organizes and carries out goods trips between the individual branches of A GmbH. The plaintiff, born on XX.XX.1993, began an apprenticeship at A GmbH on August 1, 2010 and was employed by A GmbH on February 1, 2015 as part of a further oral employment contract for a monthly fee of EUR 400.00 net. The plaintiff was employed by the defendant from February 1, 2015 under an oral employment contract for a net amount of EUR 1,100.00 (EUR 1,475.00 gross) with a working time of 32 hours per week. The plaintiff's contractual obligations included the delivery and delivery of goods and assembly work. At the time the complaint was filed, the plaintiff was not married and had no dependent children. The defendant and A GmbH filed criminal charges against the plaintiff and two other employees for serious gang fraud based on the allegation that they had unjustifiably billed excessive and incorrect travel expenses between March 2018 and the end of March 2019. The defendant accuses the plaintiff of taking alleged travel expenses totaling EUR 27,582.04. The public prosecutor's office in Wiesbaden is investigating. In a letter dated April 1, 2019 (page 10 of the file), which the plaintiff received on April 2, 2019, the defendant terminated the employment relationship with the plaintiff extraordinarily, alternatively, properly, for behavior-related reasons. The plaintiff brought an action for protection against unfair dismissal at the Wiesbaden labor court. With a judgment of November 6, 2019 - 6 Ca 236/19 - the labor court upheld a default judgment dismissing the action and considered the extraordinary termination of the defendant on April 1, 2019 to be effective; The judgment is final. Also in a letter dated April 1, 2019, A GmbH terminated the plaintiff's employment relationship extraordinarily and alternatively with ordinary notice for behavior-related reasons. The plaintiff's action for protection against unfair dismissal brought before the Wiesbaden labor court was dismissed by the labor court in its judgment of October 18, 2019 - 8 Ca101/19; The judgment is final. In a letter dated June 21, 2019 (page 3, 4 of the case file), the plaintiff requested the defendant to provide information in accordance with Art. 15 GDPR. The defendant did not provide any information. The plaintiff also unsuccessfully requested information from A GmbH in accordance with Art. 15 GDPR; proceedings against A GmbH are also pending at the Hessian State Labor Court - 9 Sa 861/20. With the complaint received by the Wiesbaden Labor Court on June 25, 2019 and served on the defendant on August 2, 2019 (page 10 of the case file), the plaintiff pursued this request for information. The plaintiff took the view that he was entitled to information under Art. 15 GDPR. He needs the information in order to be able to properly defend himself against allegations of criminal activity. Furthermore, he must know how the remuneration was settled by the defendant, in particular with regard to social security concerns. Art. 15 GDPR is essential. The defendant did not name any conflicting interests worthy of protection. Even in the context of grandfathering disputes, there is no interest in secrecy. The action taken by the plaintiff was also not unlawful. The right to information according to Art. 15 GDPR is an independent right and the facts underlying the criminal and dismissal allegations have been concluded. In addition, there would also be an opportunity for his defense attorney to inspect the files during criminal proceedings. The plaintiff has requested to order the defendant to provide him with information about the personal data of the plaintiff processed by the defendant with regard to - the categories of personal data; - the processing purposes; - the recipients or categories of recipients to whom the personal data have been disclosed or are to be disclosed; - the planned duration of the storage of the personal data, including the definition of the criteria for storage and the storage period; - the existence of a right to rectification or erasure of the personal data concerning the plaintiff; - the existence of a right of appeal to a supervisory authority. The defendant has requested reject the complaint. The defendant took the view that the plaintiff's request for information under Art. 15 GDPR conflicted with overriding legitimate interests in confidentiality on the part of the defendant and A GmbH. Confidential internal data and investigations could not be released before the conclusion of criminal proceedings. The defendant also suffered significant financial losses. The assertion of the right to information in the ongoing dismissal protection proceedings and during ongoing criminal investigations is an abuse of rights within the meaning of Section 242 of the German Civil Code. In the dismissal protection proceedings, the defendant is burdened with the burden of presentation and evidence, and has already presented information that would justify the effectiveness of the dismissal. With a judgment of November 13, 2019 - 6 Ca 396/19 (Bl. 41-51 of the case file) - the Wiesbaden Labor Court upheld the lawsuit. As justification, it essentially stated that the GDPR is directly applicable in the employment relationship. The defendant is processing personal data about the plaintiff, who is therefore also entitled to extended information in accordance with Art. 15 (1) half-sentence 2 GDPR. According to Art. 4 No. 2 GDPR, processing also includes in particular the collection, recording, organization, ordering, storage and use of personal data. In an employment relationship, the employer inevitably processes the personal data of the employees he employs; the defendant did not deny this either. These claims are not limited by legitimate interests. The existence of a reason for secrecy does not necessarily lead to the right to be able to refuse the requested information. The right to information is granted in accordance with Section 34 (1) in conjunction with Section 29 (1) sentence 2 BDSG only to a limited extent “to the extent” that the information would reveal information which, by law or by its nature, must be kept secret, in particular because of the overriding legitimate interests of a third party. However, the facts that are relevant for an individual assessment and which could lead to the restriction of the right to information were not presented by the defendant. The defendant only makes general reference to the defendant's and A GmbH's interests in secrecy and takes the view that confidential internal data and investigations cannot be released before the conclusion of the criminal proceedings. According to the defendant, however, it remains unclear to which personal data of the plaintiff the alleged interests worthy of protection are based. It would have been sufficient, but also necessary, to explain to which precise information (facts/incident/subject in terms of time and place as well as persons involved) the overriding legitimate interest in non-disclosure should refer. The assertion of the plaintiff's right to information is also not an abuse of rights within the meaning of Section 242 of the German Civil Code. The termination facts themselves have already been concluded. The defendant appealed against the judgment served on November 19, 2019 (page 52 of the file) on November 29, 2019 (page 56 of the file) and justified it on January 20, 2020 (page 137ff. of the file). The defendant is of the opinion that the plaintiff has no right to information under Article 15 (1) GDPR. Legitimate interests of the defendants and the general public are opposed. Due to the serious breaches of duty committed in the course of his employment relationship with the defendant in the period from March 2018 to the end of March 2019 and the financial loss caused as a result, the personal data of the plaintiff are undoubtedly to be classified as data worthy of protection. In the context of the internal and confidential investigations of the defendant in connection with fraudulent acts of the plaintiff, the defendant has an interest in secrecy. By providing the desired information about which personal data was processed for which processing purpose and for what storage period, the investigations could be endangered Defendants a right to refuse information on grounds of abuse of rights. In addition, the right to information from Art. 15 Para. 1 GDPR means that the employer has to provide the employee with evidence to which the employee has no access according to the ZPO. The defendant requests to amend the judgment of the Wiesbaden Labor Court of November 13, 2019 - 6 Ca 396/19 - and to dismiss the action. The plaintiff requests to dismiss the appeal. The plaintiff defended the judgment of the Labor Court. He is of the opinion that he has a comprehensive right to information because he has no access to documents, stored data, storage media, storage locations or to the question of how data had already been sent by the defendant in the course of processing, for example to the public prosecutor's office or other outsiders. It is therefore impossible for him to request deletion, correction or restriction of processing if there is no knowledge of the storage volume. The plaintiff is also of the opinion that he does not have to state any purpose of his information that would lead to a restriction of his right to information. He continues to assume that he has a comprehensive right to information and can only name areas for which he needs information; in this respect, reference is made to his brief of March 19, 2021 (pages 204, 205 of the file). These are the defendant's records of the plaintiff's working hours from 2017 to April 2019; all notes and notes on working hours; Records of all orders from the defendant to customers in which the plaintiff worked or was involved and whose execution he supported in the period from January 1, 2017 to April 30, 2019; all mileage statements submitted by the plaintiff; all wage slips showing working hours and remuneration as well as mileage reimbursements; all payments from the cash register to the plaintiff and his work colleagues against whom criminal charges had been filed, as well as all data, notes, records and information that had been communicated to the Wiesbaden public prosecutor's office in connection with a criminal complaint against the plaintiff. The scope of the right to information is not restricted by law or for any other reason, or should be restricted at all. There is no public interest in protecting the defendant if it does not collect and store or process data properly. It is also not clear to what extent this data, which is available and already known to the public prosecutor during the investigation, should not be disclosed. The legislature does not distinguish between "determination-critical" and "determination-uncritical" data. Due to the further submissions of the parties in the appeal, reference is made to the pleadings of the parties together with attachments and to the minutes of the oral hearing of August 20, 2020 (page 180 of the file) and June 10, 2021 (page 222 of the file). The Court of Appeal consulted the court files of the plaintiff's dismissal protection proceedings against the defendant - 6 Ca 236/19 - and against A GmbH - 8 Ca 101/19 - of the Wiesbaden Labor Court for information purposes and made them the subject of the oral hearing. Reasons for decision A. The defendant's appeal against the judgment of the Wiesbaden Labor Court of November 13, 2019 - 9 Ca 396/19 - is permissible according to §§ 8 Para. 2, 64 Para. 2 Letter b ArbGG and also permissible in other respects, in particular form - and submitted in a timely manner and sufficiently reasoned for the Appeals Chamber, §§ 66 Para. 1 ArbGG; 519, 520 para. 1, 3 and 5 ZPO. B. In the matter, the defendant's appeal is unsuccessful because it is unfounded. The Wiesbaden Labor Court rightly upheld the plaintiff's claim. I. The complaint is admissible. The complaint is sufficiently specific within the meaning of Section 253 (2) No. 2 ZPO. The plaintiff demands information from the defendant in accordance with Art. 15 Para. 1 Clause 1 General Data Protection Regulation (GDPR). The plaintiff has maintained the application in accordance with the wording of the provision of Article 15 (1) GDPR. 1. An application for action is sufficiently specific if it describes the claim raised by means of figures or a concrete description in such a way that the framework of the judicial decision-making authority (§ 308 ZPO) is clearly defined, content and scope of the substantive legal force of the desired decision (§ 322 ZPO ) are recognizable, the risk of the plaintiff possibly losing in part is not passed on to the defendant due to avoidable inaccuracies and any enforcement is not burdened with a continuation of the dispute in the enforcement proceedings (BAG, judgment of April 27, 2021 - 2 AZR 342/20 - 19, juris). However, the requirements for specifying the subject-matter of the dispute in a claim also depend on the specifics of the applicable substantive law and the circumstances of the individual case. The requirements for the specificity of the claim are then to be determined in consideration of the defendant's interest to be protected, to be able to defend himself exhaustively against the claim, as well as his interest in legal clarity and legal certainty with regard to the effects of the decision, with the plaintiff's interest in effective legal protection, which is also worthy of protection ( BGH, judgment of October 13, 2015 - VI ZR 271/14 - para. 19, juris; BGH, judgment of November 28, 2002 - I ZR 168/00 - para. 46, juris). 2. Based on this, the plaintiff's application is determined within the meaning of § 253 Para. 2 No. 2 ZPO. Because in contrast to other constellations - such as the facts underlying the decision of the BAG with judgment of April 27, 2021 - 2 AZR 342/20 - the defendant, who undisputedly processed personal data relating to the plaintiff, has the plaintiff on his flat-rate information requester of June 21, 2019 did not provide any information at all. You have not fulfilled the general obligation to provide information. In this case, it must suffice for the applicant to invoke legal provisions that provide for the claim made. An overriding interest of the defendant that needs to be protected compared to the legitimate interests of the plaintiff secured by the provisions of the GDPR, also in effective legal protection, is not to be recognized. The individual’s right to information about the personal data relating to him or her, standardized in Art. 15 GDPR, is part of the “Magna Carta” of the data protection individual rights of the data subject (the right to information under data protection law in the employment relationship, Lembke, NJW 2020, 1841). The right to information serves to enable the person concerned to assert their rights to deletion, correction and restriction of processing and data portability (Art. 16 et seq. GDPR). 3. The objects of the information requested by the plaintiff are based on the catalogs of Art. 15 GDPR, which the plaintiff has included in his application accordingly. In view of the sufficient specificity of his claim resulting from the lack of information from the defendant and determined above, it is also in the interest of the plaintiff to determine his claim not necessary to focus on the areas of the requested information specified by him in the appeal instance. Because the scope of the obligation to provide information, which has not been fulfilled by the defendant at all, results from the GDPR itself. The plaintiff is neither required to limit his request for information in the application by more specific formulations compared to the requirements of the regulation, nor is it to interpret his application. In the event of a dispute, it does not have to be clarified whether other standards are to be applied if the person entitled to information considers information that has already been provided under data protection law to be incomplete and requests further information. A claim for information is basically fulfilled within the meaning of Section 362 (1) of the German Civil Code if the information according to the declared will of the debtor represents the information in the total scope owed. If the information is provided in this form, any incorrect content does not prevent fulfillment. However, the suspicion that the information provided is incomplete or incorrect can, exceptionally, justify a claim for information to a greater extent if the person obliged to provide information has not made a declaration with regard to a specific category of information items, for example because he mistakenly assumed that he was with regard to of these objects is not obliged to provide information (according to the Federal Court of Justice, judgment of June 15, 2021 - VI ZR 576/19 -, paras. 19, 20, juris). II. The lawsuit is justified. The plaintiff has a right to information against the defendant to the extent stipulated by the labor court, § 15 GDPR. 1. According to Art. 99 (2) GDPR, the GDPR has been in force since May 25, 2018. It is directly applicable. According to Art. 288 TFEU, the GDPR applies directly in every member state of the Union without the need for further implementation by national law. 2. The right to information according to Art. 15 GDPR also exists in an employment relationship that has meanwhile ended. According to Art. 15 GDPR, the data subject within the meaning of Art. 4 No. 1 GDPR has a right to information from the person responsible within the meaning of Art. 4 No. 7 GDPR with regard to the processed personal data concerning them. Insofar as the defendant is (still) processing personal data about its former employee at the time of the request for information, it is the person responsible within the meaning of Art. 4 No. 7 DSGVO and the former employee - the plaintiff - is the data subject within the meaning of Art. 4 Para. 1 GDPR. 3. The defendant, as an employer, processes the plaintiff's personal data. This is undisputed between the parties. According to Art. 4 No. 2 GDPR, processing also includes in particular the collection, recording, organization, ordering, storage and use of this data. 4. The eligibility requirements according to Art. 15 Para. 1 GDPR are fulfilled; a specification of the “personal data” that goes beyond his request is not necessary. The individual information listed in the application meets the requirements of Art. 15 GDPR and reflects the right to information regulated there. a) The degree of detail of the information to be communicated must be based on recital 63 of the GDPR. According to recital 63 sentence 1 of the GDPR, the data subject’s right to information regarding the personal data concerning them serves the purpose of being aware of the processing and being able to check its legality. Recital 63 of the GDPR reads as follows: "A data subject should have a right of access to personal data relating to him or her that has been collected and be able to exercise this right easily and at reasonable intervals in order to be aware of the processing and to be able to verify the lawfulness of it. This includes the right of data subjects to access their own health-related data, such as data in their medical records that contain information such as diagnoses, test results, findings from the treating physicians and details of treatments or interventions. Every data subject should therefore have the right to know and learn, in particular for what purposes the personal data is processed and, if possible, how long it will be stored, who the recipients of the personal data are, the logic behind the automatic processing of personal data Data takes place and what the consequences of such processing may be, at least in cases where the processing is based on profiling. Wherever possible, the controller should be able to provide remote access to a secure system that would allow the data subject direct access to their personal data. This right should not affect the rights and freedoms of others, such as trade secrets or intellectual property rights, and in particular copyright in software. However, this must not result in the data subject being denied any information. If the controller processes a large amount of information about the data subject, it should be able to require the data subject to specify what information or processing operations their request for access relates to before providing the access." b) From this - at least for the employment relationship that has meanwhile ended as a continuing obligation - even in the case of a dispute - a graded burden of performance can be justified, which means that only what has been demanded has to be fulfilled. aa) According to the understanding of the Appeals Chamber, the right to information refers to the so-called "master data" of the person entitled to receive information - in this case the plaintiff. According to the definition of Art. 4 No. 1 Clause 1 GDPR, "personal data" is any information relating to an identified or identifiable natural person; an identifiable natural person is one who, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier or one or more special features, expresses the physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person can be identified. bb) In the case of a general right to information - as in the case at hand - only the "following information" is to be provided in accordance with Art. 15 Para. 1 Clause 2 GDPR. This puts the employee in a position to recognize for what purpose, with what means and with what aim the employer has collected, stored and, if necessary, passed on personal data from him. In addition to the so-called "master data", the other information covered by Art. 15 Para. 1 GDPR must be transmitted, ie. to disclose the information pursuant to Article 15 Paragraph 1 Letters a to h cumulatively - as requested by the plaintiff. (1) Pursuant to Section 15 (1) (a) GDPR, the person responsible must provide the data subject with information about the purposes of the processing. This information enables verification of purpose limitation in accordance with Article 5 Paragraph 1 Letter b GDPR (Paal/Pauly/Paal, 3rd edition 2021, GDPR Article 15 Rn. 24). The plaintiff has a right to information about the purposes of the data processing, although the processing purposes can no longer be provided for each category of personal data (Data Protection Directive/Schmidt-Wudy, GDPR Art. 15 para. 54). (2) The categories of personal data relating to and processed by the plaintiff must be communicated, Section 15 (1) (b) GDPR. The processing of special categories of personal data is governed by Art. 9 GDPR. (3) According to recital 63 of the GDPR, the "recipients" (Art. 4 No. 9 GDPR) must be informed; the categories of recipients can be disclosed optionally. (4) The plaintiff is to be informed of the planned storage period. (5) The defendant must inform the plaintiff of his rights as a data subject when providing information in accordance with paragraph 1 letter e and of his right to lodge a complaint in accordance with Article 15 paragraph 1 letter f GDPR. 5. In the present case, the right to the requested information is not limited by the legitimate interests of the defendant. In this regard, the court of appeal follows the contested judgment unreservedly, adopts its reasons and refers to them to avoid repetition (pages 7 to 9 of the contested judgment, p. 48-50 of the case file), Section 69 (2) ArbGG. The only additional thing to do is: a) The conditions for a restriction of the right to information due to good faith abuse of rights pursuant to Section 242 of the German Civil Code are not met. The dismissal protection procedure has been finally concluded. The fact that the plaintiff is hoping for information on the exercise of rights in connection with the criminal proceedings against him does not restrict the right to information either. Even if the meaning and purpose of the right to data information according to recital 63 of the GDPR is to enable the legality of the processing of personal data to be checked, the pursuit of a purpose that goes beyond this and a different motive does not justify the objection of abuse of rights. A search for the "true" motive underlying the exercise of a right to which the applicant is entitled under the law, as well as a subsequent assessment as a "phantom motive" must be ruled out in the absence of concrete evidence. The requirements for the form of objection to abuse of rights contained in Art. 12 (5) GDPR in the case of an obviously unfounded or excessive application are evidently not present here. b) A restriction in the event that the information of the person concerned would affect the enforcement of civil law claims of the person responsible or contains the data from civil law contracts and serves to prevent damage from criminal offenses (cf. § 34 Para. 1 No. 1 in conjunction Section 33 (1) no. 2 letters a, b, d, f, g BDSG) is not provided for. c) An interest in secrecy on the part of the defendant is also not to be recognized in the case of a dispute; the defendant has not sufficiently demonstrated this. The defendant cannot be allowed to be able to completely deny the plaintiff's right to information "in the basic version" with a mere abstract reference to the criminal proceedings that have not yet been concluded. A restriction of the right to information can only be assumed “insofar as” third-party interests worthy of protection exist and these should be classified as more important in the necessary individual case consideration compared to the right to information (LAG Baden-Württemberg, judgment of March 17, 2021 - 21 Sa 43/20 - Rn. 60, juris). The limitation of Art. 15 GDPR, on the other hand, must not result in the data subject being denied any information (recital 63 sentence 6 of the GDPR). Therefore, a restriction of the right to information according to Art. 15 GDPR should first be implemented by making the corresponding text passages unrecognizable or blacking out. C. The decision on costs follows from Section 97 (1) ZPO, since the defendant's appeal is unsuccessful. The revision was permitted in accordance with Section 72 (2) No. 1 ArbGG.
