A mid-level German employment court recently had to consider the scope of subject access requests under the EU General Data Protection Regulation (GDPR) in the context of compliance and whistle-blowing regimes. The Regional Labour Court (Landesarbeitsgericht) of Stuttgart decided that an employer was required not only to provide an employee with the records containing performance and behavioural data, but also to disclose information regarding internal investigations. This is the first reported successful enforcement of a data subject access right under Article 15 GDPR before a regional labour court in Germany. (The judgment was handed down on 20 December 2018 but has just been published in full text.)
The case
A high-ranking employee had defended himself against the termination of his employment contract. During the proceedings he made a data subject access request under the GDPR, requesting information on internal charges which had led to his dismissal. The employer refused to respond to his request, relying on protection of whistle-blower confidentiality.
The Regional Labour Court of Stuttgart considered the scope of Article 15(4) GDPR which provides:
“The right to obtain a copy [of the data undergoing processing] shall not adversely affect the rights and freedoms of others.”
The court held that:
- the employer was required to disclose the requested information to the employee and was not entitled to refuse to comply with the request by relying on the exemption pursuant to Article 15(4) GDPR without giving any justification; and
- there is no general rule that protection of whistle-blower confidentiality overrides the employee’s access right. The employer is not entitled to routinely rely on exemptions pursuant to Article 15(4) GDPR and should consider them on a case-by-case basis. In this case the employer had not provided any facts justifying why the whistle-blower identity should be protected.
Our take
Especially in the United Kingdom and Ireland data subject access requests are often used as a mechanism for trial preparation, by current or former employees for the purposes of actual or intended litigation. The judgment of the Regional Labour Court of Stuttgart could provide encouragement for a similar trend to grow in Germany.
As the motivation of a data subject is largely irrelevant to the data controller’s obligation to respond to their request, data subject access requests can be a powerful tool for the employee. UK and Irish businesses are already aware of how burdensome and costly they can be.
This case will probably escalate to the highest labour court in Germany. It remains to be seen what the outcome would be.
