Hes­si­an Hig­her Labour Court comments on the right to infor­ma­ti­on in data pro­tec­tion law in accordance with Arti­cle 15 GDPR

In no less than two rulings dated 10 June 2021 (Case 9 Sa 1431/19 and Case 9 Sa 861/20) (only in Ger­man), the Hig­her Labour Court of Hes­se dealt with the right to infor­ma­ti­on under data pro­tec­tion law in accordance with Arti­cle 15 GDPR and spe­ci­fied the scope and pro­ce­du­re for pro­vi­ding infor­ma­ti­on in more detail. In addi­ti­on, the Hig­her Labour Court comments on abu­se of a request for information.

Scope of a gene­ral claim to information

In the decisi­ons, the plain­tiff, the for­mer employee of the defen­dant com­pa­ny, had reques­ted the lat­ter to pro­vi­de him infor­ma­ti­on pur­suant to Arti­cle 15 GDPR. The plain­tiff was ter­mi­na­ted for extra­or­di­na­ry cau­se after the public pro­se­cu­tor initia­ted an inves­ti­ga­ti­on into serious gang-related fraud at the expen­se of the defen­dant. The defen­dant did not com­ply with the plaintiff’s request for infor­ma­ti­on, which was ulti­mate­ly asser­ted in the legal action, with refe­rence to legi­ti­ma­te inte­rests in con­fi­den­tia­li­ty on account of the cri­mi­nal pro­cee­dings and on account of the claim asser­ted in what it con­si­de­red to be an abu­se of rights.

The Labour Court of Wies­ba­den gran­ted the action in both cases. In its con­clu­si­ons, the Labour Court cla­ri­fies that the right to infor­ma­ti­on pur­suant to § 34(1)i (only in Ger­man) in con­junc­tion with § 29(1), Sen­tence 2 (only in Ger­man) of the Federal Data Pro­tec­tion Act (BDSG) is only restric­ted “inso­far as” infor­ma­ti­on is dis­c­lo­sed which must be kept secret in accordance with a legal pro­vi­si­on or by its natu­re, par­ti­cu­lar­ly becau­se of the over­ri­ding legi­ti­ma­te inte­rests of a third par­ty. Howe­ver, the defen­dant here only made a gene­ral refe­rence to con­fi­den­tia­li­ty inte­rests and it remai­ned unclear to what per­so­nal data of the plain­tiff the alle­ged inte­rests worthy of pro­tec­tion would refer. In addi­ti­on, the asser­ti­on of the clam to infor­ma­ti­on was not an abu­se of rights in the terms of § 242 of the Civil Code (only in German).

The defen­dant had appealed against the ruling, citing, among other things, that it was up to the plain­tiff to spe­ci­fy the data reques­ted. Moreo­ver, it could not be expec­ted to dif­fe­ren­tia­te bet­ween data that were “cri­ti­cal to the inves­ti­ga­ti­on” and data that were “not cri­ti­cal to the investigation”.

The Hig­her Labour Court dis­mis­sed the appeal as lacking merit, sta­ting that the scope of the duty to pro­vi­de infor­ma­ti­on, which had not been ful­fil­led at all by the defen­dant to date, resul­ted from the GDPR its­elf and thus the plain­tiff could not be requi­red to limit his request for infor­ma­ti­on and dis­clo­sure through more spe­ci­fic for­mu­la­ti­ons than tho­se requi­red by the Regu­la­ti­on. The level of detail of the infor­ma­ti­on to be pro­vi­ded should be based on Con­si­de­ra­ti­on 63 of the GDPR (only in Ger­man). Accord­ing to the lat­ter, the pur­po­se of the claim to infor­ma­ti­on is for the data sub­ject to be awa­re of the pro­ces­sing and to be able to veri­fy its lawfulness.

Accord­ing to the Hig­her Labour Court, this can be used to jus­ti­fy a gra­dua­ted bur­den of ful­fill­ment: Only what is reques­ted has to be ful­fil­led. This initi­al­ly inclu­des the “mas­ter data” of the per­son enti­t­led to infor­ma­ti­on. In the case of a gene­ral claim to infor­ma­ti­on – as in the pre­sent case – only the “fol­lowing infor­ma­ti­on” pur­suant to Arti­cle 15(1), Second Clau­se of the GDPR must be pro­vi­ded. In addi­ti­on to the so-called “mas­ter data”, the other infor­ma­ti­on cove­r­ed by Arti­cle 15(1) GDPR must be pro­vi­ded, i.e. the infor­ma­ti­on pur­suant to Arti­cle 15(1), Lite­ri a to h GDPR must be pro­vi­ded cumulatively.

High hurd­les for the rejec­tion of a claim for infor­ma­ti­on due to abu­se of rights

The Hig­her Labour Court also took a clo­ser look at the abu­se of requests for infor­ma­ti­on and the pos­si­bi­li­ties of defen­ding against the request.

The plain­tiff had also jus­ti­fied his claim for infor­ma­ti­on by sta­ting that he might need the data to defend hims­elf in the ongo­ing inves­ti­ga­ti­ve pro­cee­dings and to defend and enfor­ce civil claims.

The defen­dant objec­ted inter alia that the claim for infor­ma­ti­on had been asser­ted abu­si­ve­ly. In its view, the right to infor­ma­ti­on does not ser­ve to pre­pa­re civil claims and make them more enfor­ce­ab­le, but to make data pro­ces­sing more trans­pa­rent. In the pre­sent case, the plain­tiff is merely see­king a way to harm his for­mer employer.

The Hig­her Labour Court did not con­si­der the pre­re­qui­si­tes for a limi­ta­ti­on of the right to infor­ma­ti­on due to an abu­se of rights to be met: No limi­ta­ti­on of the claim to infor­ma­ti­on is pro­vi­ded for in the event the infor­ma­ti­on of the data sub­ject would affect the enfor­ce­ment of civil claims of the data con­trol­ler or con­tains data from civil con­tracts or ser­ves to pre­vent dama­ge cau­sed by cri­mi­nal acts.

The Hig­her Labour Court of Sax­o­ny recent­ly issued a much more business-friendly ruling on this issue.

Sum­ma­ry

The decisi­ons once again show that requests for infor­ma­ti­on under data pro­tec­tion law remain an extre­me­ly important issue, espe­cial­ly in rela­ti­on to employees. It is the­re­fo­re essen­ti­al for com­pa­nies to keep a regis­ter of pro­ces­sing acti­vi­ties and to care­ful­ly docu­ment the data pro­ces­sed about employees in order to be pre­pa­red for pos­si­ble claims for information.

back

Stay up-to-date

We use your e-mail address exclusively for sending our newsletter. You have the right to revoke your consent at any time with effect for the future. For further information, please refer to our privacy policy.