Scope of the right to information under data protection law

Data protection is playing an increasingly important role in labour law as well and often becomes a powerful instrument in labour law disputes. For example, data protection is being increasingly used as a means of exerting pressure in dismissal disputes in order to obtain higher severance payments. However, in ongoing employee relations as well – for example, in works council work – the question quickly arises as to whether the employer is obligated to share the individual salaries of employees with the works council committee, or whether only the works council chairperson is to be granted the salary lists. Also, in the case of the employer's obligation to offer tests, which currently exists under Section 5 of the SARS-CoV-2 Occupational Health and Safety Ordinance, the question arises as to what extent data protection must be observed: Is the employer allowed to document personal data of the tested employees or not?

In any case, it is clear that there is a great of uncertainty regarding the issue of data protection.

We would therefore like to use the latest case law regarding employee data protection, including a decision by the BAG, as an opportunity to address uncertainties in dealing with this topic.

Facts of the judgement of the Federal Labour Court (BAG, Judgement of April 27, 2021, ref.: 2 AZR 342/20)

An employee requested that his employer provide copies of all the emails sent during his employment, as these also contained personal data and he had a right to this information. The employee argued that his right to a copy of the data also included all (!) of his work-related emails.

BAG decision and further case law

Anyone who now expected a clear answer to this pressing question will unfortunately be disappointed. Since the employee's claim was too vague, the claim was already denied for this reason.

A comparison of the case law of the courts of instance shows that the labour courts interpret the right to information differently. For example, in the instance previous to the BAG decision, the Higher Regional Court of Lower Saxony (judgement of June 9, 2020, ref: 9 Sa 608/19) ruled in favour of the employer and rejected a claim to the surrender of all emails.

The Cologne Higher Regional Court, on the other hand, interprets Article 15 (3) of the GDPR broadly and affirms a right to information similar to the  "right of discovery" found in the United States (judgement of July 6, 2019, Az.: 20 U 75/18).

Outlook

For employers, it would be understandably desirable that the courts would provide clear case law for a restrictive interpretation of the right to information. There are also understandable reasons for such an argument. The enactment of the GDPR is based on so-called recitals. If we look at the English version of Recital 63 (in Article 15 of the GDPR), we can find good arguments that the legislator wanted to handle the right to information restrictively.

Accordingly, the affected person (data subject) should be given access to their personal data but not the corresponding documents containing the data per se.

This interpretation would also correspond to the protective purpose of the GDPR. The GDPR pursues the protection of personal data but does not grant a "right to be probed" vis-à-vis employers. And it is precisely this protection that is fulfilled if the data subject can see what personal data has been processed, and how, and to what extent. They do not need all email correspondence of several years of employment to do this.

Arguments employers can make against information claims

Companies also have rights regarding claims for information. Limits to the right to copies are, for example, the following:

• If the request for information or the request for copies is not sufficiently specific, the employer may refer the request back and demand that the request for information be specific. See: BAG, judgement of April 27, 2021, ref. no.: 2 AZR 342/20
• In the case of manifestly unfounded requests for information or excessive requests, the employer may refuse to comply. However, the employer must prove the extent to which the request or demand for information is manifestly unfounded or excessive. Alternatively, in the aforementioned case, the employer may also demand payment for fulfilling the request for information. See: Art. 12 Para. 5 GDPR
• The employer may object to a comprehensive right to information on the grounds that it adversely affects the rights and freedoms of others. See: Art. 15 Para. 4 GDPR
• Information may also be refused because the data was only stored as per statutory retention requirements, in which case the provision of information would involve a disproportionate effort and processing for other purposes is precluded by appropriate measures. See: Art. 23 Para. 1 GDPR in conjunction with § 34 of Germany’s Federal Data Protection Act (BDSG)

Significance for corporate practice

The ruling of the BAG as well as our consulting practice show that companies are well advised to establish a process for managing employee data protection and keeping it up to date. Good data protection management requires, among other things, data protection notices for the processing of employee data, the obligation of employees to comply with data protection regulations, the development of a plan for deleting data, and guidelines for handling data subject rights in accordance with the GDPR.

Failure to comply and breaches of protection result in a risk that data protection authorities may impose a fine and that persons "affected" by the data processing (may) claim damages.

Do you have questions or want to know more?

Please get in touch

This is a post from our newsletter "People in Business" 1-2021. The entire newsletter can be found here. You can also subscribe to this newsletter and receive the current issue directly on the release date.