Germany: National law may provide for stricter requirements for the dismissal of a data protection officer than the GDPR

The Federal Labour Court submitted questions to the ECJ concerning requirements for the dismissal of an internal data protection officer as it had to decide in two cases whether a dismissal issued to a data protection officer was legally effective:

In the first case, an employer dismissed the data protection officer arguing that there was a conflict of interest between this position and his regular work. The employee claimed that there was no good cause for the dismissal which is necessary for the dismissal of a data protection officer according to the Federal Data Protection Act (BDSG).

In the second case the employer justified the dismissal of the data protection officer with the fact that he held the position of the chairperson of the works council at the same time. The employer viewed these two positions as incompatible due to of a potential conflict of interest .

As the GDPR just prohibits a dismissal of the data protection officer based on the fulfillment of his tasks and does not require a good cause for the dismissal, the Federal Labour Court wanted to know whether the national German Federal Data Protection Act (BDSG) can validly set stricter dismissal requirements than the GDPR. The ECJ decided that national provisions can provide such stricter requirements for the dismissal of a data protection officer, which then apply to a case taking place in the relevant jurisdiction.

Regarding the potential conflict of interest between the positions of a data protection officer and a chairperson of the works council the ECJ explained the interpretation of the relevant Art. 36(6) GDPR. Accordingly, a conflict of interest can exist if other tasks or duties cause the data protection officer to determine the purpose and recourses of the processing of personal data. Whether the work as a chairperson of the works council meets this threshold was not answered by the ECJ..

Instead, the ECJ referred back to the national courts to determine whether (1) there is such a conflict of interest and (2) the (national) requirements for dismissal are met.

Practical Point

• The ECJ once again strengthens the position of the data protection officer by permitting stricter national provisions.
• The ECJ does not provide real guidance for employers, the decision whether there is an effective dismissal remains a case-by-case one under national law. The decisions of the Federal Labour Court in the two pending cases must be awaited.
• A data protection officer must not necessarily be an internal employee of the company, it is also permissible to work with an external data protection officer, in which case the special termination protection does not become relevant.