X-FAB Dresden

In this case, the applicant, an employee of X-FAB Dresden, was dismissed from his position as data protection officer on the grounds that he was also chairman of the competent works council, a position that, according to the defendant company, generated a conflict of interest as per Article 38(6) of the European General Data Protection Regulation 2016/679 (GDPR).

Paragraph 38, in conjunction with paragraph 6 of the German Federal Law on Data Protection (Bundesdatenschutzgesetz) however, only allows such dismissals of data protection officers for reasons serious enough to justify termination without notice. As such, German data protection law is more favourable towards employees than the GDPR. In its question to the Court of Justice of the European Union (CJEU), the Federal Labour Court asks whether the GDPR constitutes a final comprehensive rule or whether it allows for a more favourable national labour law. The Federal court is leaning towards the latter interpretation.

In its judgement, the CJEU held, regarding the first question referred (a summary of the request is included below), that there are clear parallels to be drawn with the CJEU's judgment of 22 June 2022 in the case of Leistritz C-534/20 and that Article 38(3) of the GDPR must be interpreted as not precluding national legislation which provides that a controller or a processor may dismiss a DPO who is a member of staff of that controller or processor solely where there is just cause, even if the dismissal is not related to the performance of that DPO’s tasks, in so far as such legislation does not undermine the achievement of the objectives of the GDPR.

In addressing the matter related to the conflict of interest, the CJEU held that the GDPR does not establish that there is a fundamental incompatibility between, on the one hand, the performance of DPO’s duties and, on the other hand, the performance of other duties within the controller or processor. [Para. 40].

The fact remains, second, that the controller or its processor must ensure that those other tasks and duties do not give rise to a ‘conflict of interests’. In the light of the meaning of those words in everyday language, it must be held that, in accordance with the objective pursued by Article 38(6) of the GDPR, the DPO cannot be entrusted with performing tasks or duties which could impair the execution of the functions performed by the DPO. [Para. 41]. 

A DPO cannot be entrusted with tasks or duties which would result in him or her determining the objectives and methods of processing personal data on the part of the controller or its processor. [Para. 44]. 

In their case, the applicant is supported by the German Trade Union Confederation’s (DGB - Deutscher Gewerkschaftsbund) Trade Union Centre for Revision and European Law. Their argument in this case will be that the harmonisation effect of the GDPR does not and cannot include labour law on the basis of Art. 16 TFEU. For labour law, Art. 153 TFEU is the relevant provision. The applicant also intends to argue that there is no incompatibility between the office of the data protection officer and that of chairman of the competent works council.