Do data protection officers have special protection from dismissal? A recent (non-final) ruling in Spain clarifies the remedies for DPOs who are unfairly dismissed, and Ius Laboris lawyers explain how the position differs in their countries.
In a ruling of 29 December 2021, the Labour Chamber of the High Court of Justice of Madrid analysed the remedies data protection officers (DPOs) have in the event of dismissal. It particularly considered if they are entitled to choose between reinstatement or an unfair dismissal severance payment if there are no valid grounds support their dismissal (given that Spanish law does not specifically provide this option to DPOs).
In this case, a Resolution from the Labour Court of Madrid (subsequently challenged and appealed before the Labour Chamber of the High Court of Justice of Madrid) declared a Data Protection Officer had been unfairly dismissed and ordered the employer to pay the statutory unfair dismissal severance without recognising the DPO's right to choose between reinstatement or payment of the dismissal severance. The court considered that Spanish law does not provide this option to DPOs.
However, in its ruling, the High Court of Justice of Madrid not only confirmed the DPO was unfairly dismissed, but also held that DPOs are entitled to the same treatment that the Act on Prevention of Occupational Risks expressly provides to members of the occupational health and safety Prevention Service appointed by an organisation. These individuals are entitled to choose between reinstatement in their job position or payment of the unfair dismissal severance if their dismissal is declared unfair.
In its Resolution, the High Court recognised that Spanish legislation does not expressly contemplate this legal guarantee for DPOs as it does for the members of the Prevention Service appointed by the employer. However, it applies by analogy based on Article 38(3) of the GDPR (Regulation (EU) 2016/679) which states that '(...) the data protection officer (...) shall not be dismissed or penalised by the controller or the processor for performing his tasks.' The most relevant legal arguments included in the 29 December 2021 ruling are set out below.
Article 38(3) of the GDPR expressly states that '(...) the data protection officer (...) shall not be dismissed or penalised by the controller or the processor for performing his tasks.' It establishes an additional guarantee for DPOs who cannot be dismissed for the mere performance of their duties as DPOs. Therefore, an additional guarantee must be put in place for this type of employees.
The guarantee to which DPOs would be entitled in the event of dismissal would be the same as that provided to employees who have been assigned by the employer to be members or the Company's Prevention Service under the Act on Prevention of Occupational Risks (this is also provided by law to Prevention Service Delegates and Workers' Representatives). This means DPOs may choose between reinstatement (with payment of salary accrued from the termination date until notification of the Court's decision) or payment of the unfair dismissal severance if their dismissals are declared unfair by Court.
The Court held that Article 4.1 of the Spanish Civil Code applies in this case. Article 4.1 states that rules should be applied by analogy when, despite not contemplating a specific case, they regulate a similar scenario. This would be the case in a situation such as the comparison here between DPOs and employees appointed as members of an organisation's Prevention Service.
The Supreme Court of Justice of Spain is yet to issue its final decision on this matter; however, organisations should be aware of risks described above if contemplating, or needing to, dismiss a DPO.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.