In no less than two rulings dated 10 June 2021 (Case 9 Sa 1431/19 and Case 9 Sa 861/20) (only in German), the Higher Labour Court of Hesse dealt with the right to information under data protection law in accordance with Article 15 GDPR and specified the scope and procedure for providing information in more detail. In addition, the Higher Labour Court comments on abuse of a request for information.
Scope of a general claim to information
In the decisions, the plaintiff, the former employee of the defendant company, had requested the latter to provide him information pursuant to Article 15 GDPR. The plaintiff was terminated for extraordinary cause after the public prosecutor initiated an investigation into serious gang-related fraud at the expense of the defendant. The defendant did not comply with the plaintiff’s request for information, which was ultimately asserted in the legal action, with reference to legitimate interests in confidentiality on account of the criminal proceedings and on account of the claim asserted in what it considered to be an abuse of rights.
The Labour Court of Wiesbaden granted the action in both cases. In its conclusions, the Labour Court clarifies that the right to information pursuant to § 34(1)i (only in German) in conjunction with § 29(1), Sentence 2 (only in German) of the Federal Data Protection Act (BDSG) is only restricted “insofar as” information is disclosed which must be kept secret in accordance with a legal provision or by its nature, particularly because of the overriding legitimate interests of a third party. However, the defendant here only made a general reference to confidentiality interests and it remained unclear to what personal data of the plaintiff the alleged interests worthy of protection would refer. In addition, the assertion of the clam to information was not an abuse of rights in the terms of § 242 of the Civil Code (only in German).
The defendant had appealed against the ruling, citing, among other things, that it was up to the plaintiff to specify the data requested. Moreover, it could not be expected to differentiate between data that were “critical to the investigation” and data that were “not critical to the investigation”.
The Higher Labour Court dismissed the appeal as lacking merit, stating that the scope of the duty to provide information, which had not been fulfilled at all by the defendant to date, resulted from the GDPR itself and thus the plaintiff could not be required to limit his request for information and disclosure through more specific formulations than those required by the Regulation. The level of detail of the information to be provided should be based on Consideration 63 of the GDPR (only in German). According to the latter, the purpose of the claim to information is for the data subject to be aware of the processing and to be able to verify its lawfulness.
According to the Higher Labour Court, this can be used to justify a graduated burden of fulfillment: Only what is requested has to be fulfilled. This initially includes the “master data” of the person entitled to information. In the case of a general claim to information – as in the present case – only the “following information” pursuant to Article 15(1), Second Clause of the GDPR must be provided. In addition to the so-called “master data”, the other information covered by Article 15(1) GDPR must be provided, i.e. the information pursuant to Article 15(1), Literi a to h GDPR must be provided cumulatively.
High hurdles for the rejection of a claim for information due to abuse of rights
The Higher Labour Court also took a closer look at the abuse of requests for information and the possibilities of defending against the request.
The plaintiff had also justified his claim for information by stating that he might need the data to defend himself in the ongoing investigative proceedings and to defend and enforce civil claims.
The defendant objected inter alia that the claim for information had been asserted abusively. In its view, the right to information does not serve to prepare civil claims and make them more enforceable, but to make data processing more transparent. In the present case, the plaintiff is merely seeking a way to harm his former employer.
The Higher Labour Court did not consider the prerequisites for a limitation of the right to information due to an abuse of rights to be met: No limitation of the claim to information is provided for in the event the information of the data subject would affect the enforcement of civil claims of the data controller or contains data from civil contracts or serves to prevent damage caused by criminal acts.
The Higher Labour Court of Saxony recently issued a much more business-friendly ruling on this issue.
Summary
The decisions once again show that requests for information under data protection law remain an extremely important issue, especially in relation to employees. It is therefore essential for companies to keep a register of processing activities and to carefully document the data processed about employees in order to be prepared for possible claims for information.
back