Authors: Katharina Pauls and Katia Helbig
In a legal dispute to be decided by the German Federal Labor Court, the court had the opportunity to rule on the highly controversial scope of the right to information under Art. 15 GDPR. Specifically, the issue was whether or to what extent Art. 15 GDPR grants a right to receive copies of e-mails. This question is controversially discussed, particularly in the employment context. A decision on the merits was not issued, however, because the court already considered the claim to be too vague and therefore dismissed it as inadmissible. This result, nevertheless, is disappointing only at first glance. Rather, the decision is likely to provide an important guidepost for dealing with information claims and will hopefully, at least in part, cause a rethink.
Scope of Art. 15 GDPR not yet specified
The scope of the right to information under Art. 15 GDPR is highly disputed. This is especially the case in the employment context as responding to requests for information according to Art. 15 GDPR is always a challenge for employers due to the large amount of personal data available. Among other things, it is still unclear whether or to what extent employers shall provide copies of e-mails pursuant to Art. 15 (3) GDPR concerning the employee in question. As prescribed by statutory restrictions in the framework of the right to information under Art. 15 GDPR, employers would first have to review in each individual case whether an e-mail is subject to such a request and whether individual words or passages therefore shall be redacted or the e-mail may even be excluded from such a request altogether. As a result – especially in the case of a large number of e-mails – the employer would have to take quite a considerable effort.
It is therefore not surprising that particularly former employees often assert the right to information according to Art. 15 GDPR (specifically the right to a copy according to Art. 15 (3) GDPR) in the event of a dispute in order to exert pressure on their (former) employer and to bring about a swift and – from their point of view – successful end to the dispute.
Since decisions of the German labor courts have so far predominantly established an inconsistent understanding of the scope of the right to information pursuant to Art. 15 GDPR (cf. Regional Labor Court of Baden-Württemberg, ruling of 20th December 2018, file no. 17 Sa 11/18 and Labor District Court Bonn, ruling of 16th July 2020, file no. 3 Ca 2026/19), the German Federal Labor Court (Bundesarbeitsgericht / BAG) now had the opportunity to provide clarity.
Case to be decided by the BAG
The background to the BAG’s decision (cf. file no. 2 AZR 342/20) was the lawsuit of a commercial lawyer who objected to the termination of his employment contract. As so often, the claimant furthermore asserted his right in accordance with Art. 15 GDPR. As the court of last instance, the BAG had to decide upon the question whether the (former) employer was obligated under Art. 15 (3) GDPR to provide the claimant with a copy of all e-mail correspondence the claimant had conducted himself or in which he was mentioned by name. The Regional Labor of Court of Lower Saxony answered this question in the negative (ruling of 9th June 2020, file no. 9 Sa 608/19). According to its decision, the right to receive a copy does not go further than the mandatory information stipulated in Art. 15 (1) GDPR.
The BAG’s decision
The BAG dismissed the claim. However, there was no substantive discussion of the scope of Art. 15 GDPR as the BAG already considered the claim to be too vague within the meaning of Sec. 253 (2) No. 2 German Code of Civil Procedure (Zivilprozessordnung / ZPO). In the absence of a substantiated claim, it remained unclear for the court which e-mails the employer would have had to provide to the claimant in detail. According to the BAG, this would have required the claimant to designate the requested copies of the e-mails so precisely that it was undoubtedly clear which e-mails the claimant was referring to. As a result, it would have not been possible to enforce the judgement on the basis of the claim. Thus, the claim was already been dismissed as inadmissible.
Despite the lack of a decision on the merits concerning the scope of Art. 15 GDPR, the BAG’s ruling is nevertheless likely to provide an important guidepost for dealing with information claims in practice
Although it is initially disappointing that the BAG discussed the scope of Art. 15 GDPR or, more specifically, the right to receive a copy pursuant to Art. 15 (3) GDPR, the decision is likely to be of a groundbreaking nature in professional practice.
It can be assumed that employees will have to be much more specific in their requests in accordance with Art. 15 GDPR in the future – at least with regard to the problematic issue of copies of e-mails. If they do not do so and the employers then refuse to provide the information on the grounds of a lack of specificity, the latter will no longer be at risk of losing, at least before the labor courts. Accordingly, in such cases employers cannot be convicted to pay damages. In recent times, there has been an increase in such convictions on the basis of incomplete information provided by the employers within the frame of Art. 15 GDPR. However, if the request for information pursuant to Art. 15 GDPR is already too vague and the employer cannot tell what is to be covered by it, compensation for damages due to the allegedly incomplete provision of information cannot be considered.
Sufficiently substantiated requests for the provision of copies of e-mails should also facilitate their processing by the employer immensely. This is particularly the case because it is unlikely that an employee will take the effort to compile an extensive list of e-mails specified in detail. Thus, the number of documents to be reviewed will likely decrease rapidly.
It remains to be hoped that the BAG’s decision will furthermore have an impact on the practices of the German data protection authorities as these have assessed the scope of the right according to Art. 15 GDPR just as inconsistently as the German labor courts. While some authorities, in line with professional practice and the decision of the BAG, have already demanded that requests for information be made more specific in the past, others assumed that the mere reference to all existing e-mails or even the reference to the issuance of all documents concerning the employee in question should already be sufficient. The BAG’s decision is not binding for the data protection authorities. Nonetheless, the authorities should also be interested in a consistent handling in accordance with the requirements established by the German labor courts. It therefore remains to be seen to what extent the authorities will adapt their practices concerning the scope of the right to information according to Art. 15 GDPR in the future. If the authorities do not adapt their practices and initiate administrative fine proceedings against the employer despite the vagueness of the request for information, employers could and should refer to the BAG’s decision in the subsequent proceedings as the authorities cannot ignore the decision (at the latest within the framework of the principle of opportunity). If need be, a subsequently competent district or regional court would have to decide the matter with the backing of the BAG’s decision.