German Federal Labour Court dismissed employee’s claim
On 27 April 2021, the German Federal Labour Court (Bundesarbeitsgericht, the Federal Court) held that employees cannot request their employer to provide them with copies of all (i) the employee’s entire email correspondence; and (ii) any emails mentioning the employee by name.
The Federal Court said that under applicable civil procedural rules the request was not specific enough – it was not possible precisely identify the emails such that any order could be enforced. The court chose to base its decision on civil proceedings laws, not on data protection law.
The facts
An employee submitted a data subject access request to his former employer under Art. 15 of the General Data Protection Regulation (GDPR). He requested “a copy of his personal data undergoing processing”. The employer provided the employee with a copy of his personal data and some emails. However, the employee contended that, in his opinion, the copy was not sufficient. He therefore brought an action against his former employer claiming that the employer failed to provide a complete copy his entire email correspondence and email correspondence mentioning him by name.
The parties mutually settled part of the dispute but, the claim in relation to whether the employer needed to provide the employee’s entire email correspondence remained open.
At first instance, the Hameln Labour Court dismissed the action. It held that the request to provide a complete copy of emails was not specific enough under German civil procedure rules. The court of appeal, however, ordered the employer to provide the employee with copies of the employee’s emails, but only those containing the employee’s personal data on the basis that this was covered by the access right under the GDPR. The court of appeal held that the employer is not required to provide a complete copy of entire documents and emails (e.g. of personnel files) and did not share the expansive view taken the lower courts The court of appeal argued that Art. 15 (3) of the GDPR only mentions the requirement to provide “a copy of the personal data undergoing processing” and therefore data subjects are not entitled to access entire data sets. It also held that the GDPR requires a certain degree of informational value of the data about the data subject, particularly since recital 63 states that in the case of larger amounts of data, data subjects must also specify which copies are to be provided. Further, the court of appeal said that data subjects do not need to be provided with complete email correspondence where they were the recipient or author since Article 15 of the does not cover information that is already known to the data subject, so the court of appeal.
Our take
This judgement has arguably limited the scope of data subject access rights, something which has not previously been addressed by other German courts. It highlights that the principles of national law must be complied with when enforcing the GDPR. The court obviously used civil proceedings laws as an “easy exit” from the case, which also avoided having to present the question about the reach of Article 15 to the Court of Justice of the European Union. This judgement would, however, mainly affect the data subject requests submitted under German law.
