Compliance Investigations: Employees are entitled to information on personal data under the GDPR, not the entire compliance report

Authors: Verena Braeckeler-Kogel, MAES (Basel) and Meike Christine Rehner

The Federal Labour Court has ruled that Article 15 GDPR generally does not give employees the right to request the provision of entire compliance reports. The right of access relates to the personal data contained in the document, but not to the document itself.

 

Data subject access rights under Article 15 GDPR are still a significant factor in employment law disputes. Employees are increasingly using this right to obtain information about internal decision-making processes, compliance investigations or personnel measures. In a recent case before the Federal Labour Court, it was disputed whether the right of access under data protection law also extends to the disclosure of a complete internal investigation report regarding the conduct of an employee.

The Federal Labour Court has now provided further guidance on the scope of Article 15 GDPR. In its view, the law generally grants a right of access regarding the personal data contained in a compliance report, but not to the disclosure of the entire report itself. The ruling thus provides important guidance for employers when conducting internal compliance and whistleblowing investigations and strengthens the protection of confidential legal assessments and other parts of such reports that do not constitute the employee’s personal data.

 

Background

The claimant was employed in a leadership position by the defendant. After several employees had raised complaints about her leadership style, the employer commissioned an external law firm to carry out a compliance investigation. The final report on this investigation contained statements from whistleblowers and witnesses, evaluations by the commissioned firm, as well as legal analyses and client advice.

Pursuant to Article 15 GDPR, the claimant requested complete copies of different versions of the compliance report. Whilst the Labour Court had initially upheld the claim, the Regional Labour Court dismissed most of the claim. The Federal Labour Court upheld this decision.

 

Key Issues

According to the Federal Labour Court, Article 15 GDPR does not, in principle, confer a right to receive a copy of an entire compliance report. Rather, the right of access relates to the personal data contained therein and not to the document as such. Employers are therefore not generally required to disclose internal investigation reports simply because they contain personal data about the employee concerned.

In the court’s view, the disclosure of documents in their entirety may only be considered in exceptional circumstances, where this is necessary to make the personal data contained therein comprehensible or to enable the data subject to exercise their rights under data protection law. The Federal Labour Court did not consider these conditions to have been met in the case in question. In particular, it did not regard legal analyses and client advice as personal data relating to the employee concerned.

The ruling thus strengthens the confidential nature of internal compliance and whistleblowing investigations. Employers are afforded additional legal certainty when conducting internal investigations, as data protection rights cannot, in principle, be used to obtain copies of complete investigation reports or internal legal analyses.

 

Practical Points

When drafting compliance reports, companies should distinguish clearly between statements of fact, personal data and legal assessments. Such a structure makes it substantially easier to process later requests for information made by employees under the GDPR.

• The ruling reduces the risk that employees might gain access to internal investigation strategies, legal assessments or other sensitive aspects of a compliance investigation through their right of access under data protection law.
• Nevertheless, even following this decision, the full or partial disclosure of documents remains possible in exceptional cases. It is decisive whether the disclosure of certain extracts of documents may be necessary in order to enable the data subject to fully understand the personal data contained in them.