Procedural laws and principles contain a clear concept regarding which party must present and prove what information in court proceedings. Claimants in employment proceedings currently try to use the right to access of data subjects under Article 15 GDPR to shake this concept up.
Judgment of the Higher Labour Court of Baden-Württemberg
On 20 December 2018, the Higher Labour Court of Baden-Württemberg (Landesarbeitsgericht Baden-Wuerttemberg – “LAG”) had to decide on the scope and exceptions of the data subjects’ access right (docket no. 17 Ca 4075/17). The decision was part of a lawsuit against unfair dismissal, made by a former employee against their former employer.
The LAG acknowledged the rights to obtain (i) general information about the employees’ personal data processed by the employer (Article 15(1) GDPR) as well as (ii) a copy of that data (Article 15(3) GDPR). According to the LAG, the copy under Article 15(3) GDPR comprises any of the employee’s personal data processed, including any correspondence, as well as performance and conduct data, even if such personal data was not stored in the employee’s employment file.
In the case at issue, the employer conducted internal investigations regarding operational misconduct of its employees and guaranteed its whistleblowers not to disclose their identity. It was, thus, crucial if the access right under Article 15(3) GDPR was restricted based on the rights and freedoms of others (Article 15(4) GDPR). The LAG supports the view that it may constitute a legitimate interest in the secrecy of the source of information if the employer has assured anonymity to its whistleblowers. However, the LAG emphasises that Article 15(4) GDPR may restrict the access request only to the extent that this is necessary to protect third parties’ secrecy interests, subject to balancing of interests test. The LAG took the view that it is not sufficient to make a general reference to the need for protection of whistleblowers. Instead, the LAG requires that the employer names the particular personal data of the employee to which the alleged third parties’ secrecy interests refer. The LAG held that it is necessary to name the related facts, the incident, the topic in terms of time and locality, and the acting persons in that regard.
Provision of a copy of the personal data
Remarkably, the LAG did not decide on how the provision of a copy of the data must be put into practice. This question will be subject to the subsequent enforcement proceedings.
The Bavarian data protection authority (“Bavarian DPA”) has been advising that the relevant GDPR wording refers to a copy of the data rather than a copy of documents or emails, etc., containing the name of the individual. In its activity report 2017/2018 of 22 March 2019 (p. 46 et seq., available in German language here), the Bavarian DPA emphasised that, under Article 15(3) GDPR, it is sufficient to provide the individual with a complete summary of the data processed in an intelligible form that enables the individual to ascertain that this data is accurate and processed in accordance with applicable data protection laws.
The LAG set a high threshold for restrictions to the access right. The view of the LAG introduces the burdensome obligation to inspect large quantities of information. Compiling this information goes far beyond of what is required by the GDPR within the records of processing activities, which contains information on categories of data subjects, on the one hand, and proper employee record keeping, on the other.
It remains to be seen if this view will become established case law, particularly with regard to the fact that the request was made within a dismissal related lawsuit. Article 15 GDPR grants data subjects the right to request information about their personal data only in order to be aware of and verify the lawfulness of the processing activities (cf. Recital 63 GDPR). Looking at these aims, it should be possible to lawfully reject requests made for other non-data protection purposes, without taking the steps required by the LAG.