Germany: Can A Works Council Chair Also Be The Data Protection Officer?

Back in 2011, a German court ruled that works council membership did not necessarily preclude serving as data protection officer. The same court, after referring the question to the European Court of Justice, has now changed tack, ruling that the two offices are incompatible.

Under the German Data Protection Act, employers with more than 20 employees which conduct automated processing of personal data must appoint a data protection officer ('DPO'). These conditions are easily satisfied in many companies due to the use of IT systems in areas like HR, marketing and sales. In SMEs, however, there may not be many suitable candidates for the DPO position. Members of works councils are therefore often considered for the role. In a recent ruling (not yet been published in full), the German Federal Labour Court ('BAG') has decided that the chair of the works council is not eligible to serve as DPO.

The facts of the case

The decision of the Federal Labor Court

On 6 June 2023 the BAG ruled that the revocation of the appointment had been justified. According to the Court, there will be good cause for termination of an appointment where the DPO does not have the expertise or reliability required to properly perform the role. Reliability may be in question if there is a risk of a conflict of interest, and the Court held that his can be assumed where the DPO holds a position which involves making important decisions about the processing of personal data. Before reaching its decision, the BAG had referred the question to the ECJ for a preliminary ruling.

The ECJ held that the duties of works council chair and DPO could not be performed by the same person without a conflict of interest arising. Personal data may only be made available to the works council for purposes expressly provided for in relevant legislation. Under German law, the works council must decide on the specific circumstances in which it requests personal data from the employer, and how it then processes this data. Because the works council determines the purposes and means of processing personal data, the works council chair is unable to monitor compliance with data protection law in a sufficiently independent way.

The DPO has the task of checking whether the employer, as data controller under the GDPR, complies with data protection law. The DPO's supervisory powers also extend to the works council, which is considered part of the employer under German law. What's more, the DPO advises the employer and the works council on compliance with data protection law in the workplace. A conflict of interest can clearly be seen. As DPO, the works council chair would not be able to provide independent and neutral advice to the employer on data protection matters, due to the differing interests of the employer and the works council. The ECJ's decision, prompting a long-overdue change in the German case-law, is therefore to be welcomed.

Conclusion

The BAG expressly left open the question of whether all works council members are prevented from serving as DPO. However, the arguments we have considered here suggest that a conflict of interest may arise for these employees too. Since the GDPR obliges an employer to ensure that the tasks and duties of a DPO do not lead to conflicts of interest, care should be taken to avoid appointing works council members to this important role.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.