How can employers in Germany respond when employees seek to exercise their right to access data relating to them under data protection rules? A recent Federal Labour Court ruling may provide some guidance.

Requests for access to information under Article 15 of the GDPR seem likely to remain a hot topic in 2022. We are still waiting for case law to give firm guidance on the requirements for the right to access information and also what 'defence' options employers and other data controllers have in terms of data protection law. However, the Federal Labour Court's reasoning in a recent judgement (in case 2 AZR 235/21) could offer initial guidance.

On 16 December 2021, the Federal Labour Court ruled in the case of a former employee who had requested the surrender of all performance and conduct data from the employer. The Court dismissed the action (in contrast to the lower court, Baden-Württemberg Regional Labour Court of 17 March 2021, ref. 21 Sa 43/20). At the time of writing, however, the Federal Labour Court has only published the operative part of the judgement, meaning a degree scope for interpretation remains with regard to the reasons for the ruling.

There are indications that the Court followed its earlier case law (ruling of 27 April 2021 2 AZR 342/20) and that the lack of specificity of the claim caused the requested handover of the documents to be rejected.

In April 2021, the Court rejected a request to hand over all emails as being too general. The claim was not sufficiently specific within the meaning of s243 (2) of the Code of Civil Procedure. Because the request was not sufficiently specific, a 'step-by-step' action had to be brought pursuant to s254 of the Code, meaning the employee must first request details of stored information from the employer and, as a second, subsequent, step, request that the information be handed over.

In the present proceedings, the application was also very broad:

'order the defendant to provide the applicant with information on the applicant's personal performance and conduct data processed by it and not stored in the applicant's personal file'

(The wording of the application is taken from the Regional Labour Court judgement of 17 March.)

It is reasonable to assume that the Federal Labour Court also regarded the application in these proceedings as insufficiently specific under s243 of the Code of Civil Procedure. There was no previous 'step-by-step' action under s254 of the Code (see above). However, it remains to be seen whether the Court's reasoning is as suspected.

In addition, it would be desirable if the ruling includes a differentiated discussion, naming further grounds for refusal for an application under Article 15 GDPR within the framework of the merits of the claim from the employer's point of view. This would provide more certainty for comparable proceedings in future with employers not limited to hoping for applications to be considered insufficiently specific within the framework of admissibility.

The Federal Labour Court has remained true to its line, meaning that at the least, blanket demands from employees to hand over all documents do not have to be followed by employers unquestioningly. In doing so, the Federal Labour Court is apparently continuing to deviate from the Federal Supreme Court (BGH) line. In an insurance industry decision from 15 June 2021, the Federal Supreme Court granted a plaintiff's request to hand over the totality of information that had already been provided in part (VII ZR 579/19).

Practical advice

Independent from the pending Federal Labour Court reasoning, employers already have some scope to respond to a claim for information from an employee or former employee under Article 15 of the GDPR without sending 'everything'. Firstly, if the claim cannot be met economically or in terms of personnel or can be interpreted as excessive, the employer can ask the claimant to make the request more specific (sentence 7 of recital 63 to Article 15 of the GDPR).

In addition, the protection of the rights and freedoms of other individuals may mean that not all documents can be released (Article 15(4d) of the GDPR). This includes trade secrets or intellectual property rights, in particular copyright in software, but also colleagues' or customers' personal data mentioned in the requested data set.

Over time, more decisions will be made by the courts in Germany, which will increase legal certainty and improve employers' ability to respond to wide-reaching information requests under Article 15 of the GDPR.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.