Federal Labour Court decision on employees' right to information according to Art. 15 GDPR

Initial situation

According to Article 15 of the General Data Protection Regulation (GDPR), employees have a right to information against employers regarding the processing of their personal data. Employees are increasingly making use of this right - especially in the context of negotiations on the termination of employment relationships, whether through out-of-court termination agreements or settlements in dismissal protection proceedings. This is also due to the fact that since the introduction of the GDPR, comparatively high pressure on the part of employers can be built up as a tactical means of litigation with little effort and risk of litigation costs and regularly strengthens the negotiating position of employees. Employers who have not yet gained experience with this may be more likely to be persuaded to make concessions.

Employees' requests for information usually bind personnel resources and employers are also faced with enormous time pressure due to the short time limit to provide information (Art. 12 (3) GDPR speaks of "without undue delay, and in any event within one month of receipt of the request"). Only in exceptional cases there is the possibility of a one-time extension of the deadline by two months. In addition, the asserted right to information carries the risk of severe fines, because information that is not provided on time or is incomplete constitutes a data protection violation that can be reported to the data protection authority. Last but not least, employees can also assert claims for damages themselves.

This legal situation poses increasing challenges for employers in their day-to-day practice and requires concrete measures to minimise the risks of data protection violations as well as expenses in the area of human resources management.

Previous case law

So far, the specific scope of the right to information and the also existing right to receive a copy of the processed data (Article 15 (3) of the GDPR) has been disputed in case law and has not been clarified by the highest courts.

Already in 2018, the Baden-Württemberg Regional Labor Court (LAG) (Case No. 17 Sa 11/18) had sentenced an employer to provide comprehensive information and to hand over a copy of all personal data processed in the employment relationship, including all emails relating to the employee. As a result, this decision meant that employers may not only have to compile several thousand emails, but also screen them to identify data of uninvolved third parties and, in individual cases, make them unidentifiable. However, no decision was made at the time, as the parties agreed on a settlement before the appeal hearing.

In the past, various courts have also dealt with this issue. For example, the Labour Court in Bonn (Case No. 3 Ca 2026/19) ruled that a request for information that was too sweeping was to be rejected as too extensive. The Regional Civil Court of Heidelberg (Case No. 4 O 6/19) rejected the claim of a former member of the executive board arguing that the collection, evaluation and, if necessary, redaction of several thousand e-mails (in the specific case more than 10,000) would be unreasonable.

BAG decision dated April 27, 2021 (Ref. 2 AZR 342/20)

Recently, the Federal Labour Court (BAG) again had to decide in a court case that was commonly expected to provide legal clarity as to how extensive the obligation to provide information and to hand over a copy of the processed data actually is (in particular with regard to the personal data included in e-mails, which is often relevant in practice). However, this expectation was not fulfilled.

According to the BAG's press release no. 8/21, the 2nd Senate rejected the action already because of an insufficiently specific claim. The BAG stated: "A claim to surrender a copy of e-mails is not sufficiently specific within the meaning of section 253, subsection 2, no. 1 of the Code of Civil Procedure (ZPO) if the e-mails of which a copy shall be handed out are not designated so precisely that it is undoubted in the enforcement proceedings to which e-mails the conviction relates." If an employee is not able to specify the e-mails, he must first sue for the provision of information within the scope of a step-by-step action in order to be able to file his claim for surrender in a sufficiently specific manner.

As a consequence, the BAG was able not to answer the question of whether the right to be provided with a copy pursuant to Article 15 (3) of the GDPR also covers the provision of copies of e-mails, nor the question of whether it would have been necessary to suspend the proceedings and submit the question of the understanding of the right to be provided with a copy pursuant to Article 15 (3) of the GDPR to the European Court of Justice (ECJ) within the scope of a so-called preliminary ruling procedure.

Result:

Notwithstanding the still existing legal uncertainties concerning the scope of the right to information under data protection law and the right to be provided with a copy, employers should in principle be able to respond to employees' right to information in a timely manner through effective data protection management, both technically and in terms of organisation, without, however, neglecting or even violating the rights and freedoms of other persons, which are equally protected by Article 15 (4) of the GDPR. In this way, employers avoid the risk of fines on the one hand and, on the other hand, do not make themselves unnecessarily vulnerable in the context of negotiations on the termination of employment relationships.