Background
Special protection from dismissal and removal from office
Good cause for revocation of appointment
Termination of employment relationship of data protection officer
Termination due to corporate restructuring measures
Comment
In order to fulfil their statutory duty to appoint a data protection officer, many employers assign this position to an employee. However, once an internal data protection officer has been appointed, he or she enjoys special protection from dismissal and removal from office under German law. This update addresses the issue of whether and in what circumstances it is possible for the employer to revoke an appointment of a data protection officer and to terminate his or her employment.
Many companies are obliged to appoint a data protection officer under Section 4(f)(1) of the Federal Data Protection Act. This requirement applies in particular when more than nine individuals carry out automated collection, processing or use of personal data on a permanent basis – that is, when data processing is carried out by IT systems and controlled by software programs (as is usually the case). In addition to employee data, the act also protects data relating to customers and business partners.
The employer initially has the right to choose whether it appoints one of its employees as an internal data protection officer or has these responsibilities carried out by an external party. If a data protection officer is appointed internally, he or she often carries out data protection activities in addition to the main duties owed under his or her employment contract.
Special protection from dismissal and removal from office
Where the company is required to appoint a data protection officer under statute, the data protection officer enjoys special protection from dismissal and removal from office pursuant to Section 4(f)(3) of the act. In practice, this legal protection can lead to major problems for employers, in particular with regard to other employees who also carry out data protection activities.
As with directors and other members of company bodies, it is first necessary to distinguish between the appointment as data protection officer and the original employment relationship. Pursuant to Section 4(f)(3) of the act, as read with Section 626 of the Civil Code, the appointment as data protection officer can be revoked only for good cause. It is necessary to differentiate the revocation of this appointment, and to determine whether and under what circumstances the employment relationship of an internal data protection officer can be terminated. The employer's right to ordinary termination was expressly excluded on September 1 2009 pursuant to Section 4(f)(3) of the act. It is impossible to terminate the employment relationship without notice for good cause. This special protection from dismissal continues to apply for a period of one year after revocation of the appointment as data protection officer.
Good cause for revocation of appointment
On March 23 2011 the Federal Labour Court ruled on the issue of good cause justifying the revocation of the appointment of a data protection officer.(1) The case involved an employee who was appointed as an internal data protection officer for two group companies. Some time thereafter she was also elected to the works council. The employer decided at a later date to have data protection activities for all group companies carried out uniformly by an external data protection officer. Consequently, both the employer and its subsidiary revoked the appointment of the internal data protection officer.
The court ruled that the revocation of the internal data protection officer's appointment was invalid. Good cause exists only if the employer cannot reasonably be expected to have the data protection officer continue to fulfil his or her activities. Some possible reasons for revocation of the appointment might be:
- reasons associated with the function of the activity of the data protection officer which would make the further fulfilment data protection officer duties impossible, or at least significantly more difficult, such as a betrayal of secrets or infringement of control rights as data protection officer; or
- the original employment relationship is validly terminated.
In its ruling the court made clear that an organisational decision of the employer to have the data protection activities of the company carried out by an external data protection officer in the future did not constitute good cause to revoke the appointment. The essence and purpose of special protection from revocation is to increase and secure the effectiveness of data protection at the office in question.
The data protection officer must be free to exercise his or her duties independently and autonomously without fear of revocation of his or her appointment. In the case before the court, the data protection officer's membership of the works council was not in itself grounds for revocation of the appointment.
Termination of employment relationship of data protection officer
Hitherto, court rulings on employment issues have not addressed the issue of whether and in what circumstances the employer can terminate the employment relationship of the data protection officer. The special protection from dismissal granted to an internal data protection officer is comparable to that granted to a member of the works council under Section 15 of the Protection against Unfair Dismissal Act.
Termination due to corporate restructuring measures
Particularly problematic and difficult for employers are cases in which the internal data protection officer is not a full-time data protection officer, but also continues to carry out other tasks in addition to his or her activity as data protection officer. If these tasks cease to exist as a result of corporate restructuring, it is questionable whether the employer can terminate the employment relationship for operational reasons. In this respect, some commentators argue that Sections 15(4) and 15(5) of the Protection Against Dismissal Act relating to members of the works council can be applied analogously, thereby allowing ordinary termination in exceptional cases, such as when the entire business or the relevant part of a business is closed down. Alternatively, the problem can be solved by applying the court rulings on extraordinary termination for operational reasons for employees protected from dismissal under collective bargaining agreements.(2) However, in such cases the employer must also grant a notice period which is equal to the theoretical ordinary notice period.
At any rate, the employer must carefully and comprehensively consider whether it can employ the data protection officer in another position in the same company or at another location. In some cases it may even be necessary to terminate the employment contract of other employees in the same location first.
Where, in exceptional cases, it is possible to terminate the employment relationship of the data protection officer validly, then in addition to dismissal it is also necessary separately to revoke the appointment upon expiry of the ordinary notice period.
Restrictions apply both to the revocation of the appointment of an internal data protection officer and to the termination of their employment relationship. It is difficult for the employer lawfully to revoke the appointment of an internal data protection officer based on a company decision such as the subsequent outsourcing of data protection, or to dismiss a data protection officer if the other employment activity of the data protection officer ceases to exist. Therefore, an employer that is considering appointing an employee as its internal data protection officer should think the decision through carefully. In order to remain flexible with regard to restructuring in the future it is worth considering whether the responsibilities of data protection would best be carried out by an external party from the outset.
For further information on this topic please contact Antje-Kathrin Uhl, Bjoern Gaul, Bernd Roock or Oliver Simon at CMS Hasche Sigle by telephone (+49 711 97 64 250), fax (+49 711 97 64 96251) or email ([email protected], [email protected], [email protected] or [email protected]).
Endnotes
(1) Decision 10 AZR 562/09.
(2) Federal Labour Court Decision 2 AZR 227/97, February 5 1998.