Employee data protection: Unspecified information claims and blanket copy claims are not sufficient

The German Federal Labor Court has specified the requirements for an effective request for information and copies pursuant to Art. 15 GDPR: According to this, unspecified information claims and the mere blanket assertion of a copy are not sufficient. The following article summarizes the most important aspects of the ruling.

The ruling of the German Federal Labor Court (BAG, 2 AZR 235/21), which dates back to December 2021 and the written opinion for which have now been published, should be particularly pleasing for employers, who have been increasingly confronted with data protection information claims since the (binding) entry into force of the General Data Protection Regulation (GDPR) in May 2018. Particularly in proceedings for protection against dismissal, a corresponding claim for information is frequently made in a standardized manner and the provision of a copy of the data is requested. The ruling in question here rejected an employee's assertion of his right to information under data protection law.

The background

According to the BAG, unspecified claims for information and blanket claims for copies do not meet the requirements of Article 15 of the GDPR.

Within the scope of Art. 15 (1) GDPR, data subjects (in particular employees) have the right to request confirmation from the controller (in particular employer) as to whether personal data concerning them is being processed; if this is the case, they have a right to information about such personal data and other related information. Pursuant to Article 15(3) of the GDPR, the controller must provide a copy of the personal data subject of the processing.

In its ruling, the BAG sets out procedural requirements for the judicial assertion of the claim and, in particular, states the necessary specificity of the application to be made.

The facts

In the underlying case, an employee (plaintiff) had filed an action for unfair dismissal against a termination by the employer for behavioral reasons: Among other things, allegations had been received against the plaintiff in a whistleblower system in place at the employer (defendant) for reporting possible grievances. After the related action for protection against dismissal had been decided in separate proceedings, the BAG only had to decide on the provision of information on the personal data processed by the employer and the provision of a copy of this data.

The ruling

The BAG ruled that the motions filed by the employee were inadmissible for lack of sufficient specificity.

The employee had requested:

1. The defendant is ordered to provide the plaintiff with information on the personal performance and conduct data of the plaintiff processed by it and not stored in the plaintiff's personnel file, with regard to

• the purposes of the data processing,

• the recipients to whom the Defendant has disclosed or will disclose the Plaintiff's personal data,

• the storage period or, if this is not possible, criteria for determining the period,

• the origin of the plaintiff's personal data, to the extent that the defendant has not collected it from the plaintiff himself; and

• the existence of automated decision-making, including profiling, and meaningful information about the logic involved and the scope and intended effects of such processing.

 2. The defendant is ordered to provide the plaintiff with a copy of his personal performance and conduct data which are the subject of the processing carried out by it.

In this context, the employee specifically requested information on a copy of his personal performance and conduct data in e-mail correspondence between a specific employee of the employer and him in the period between January 1, 2016 and December 31, 2017, information on and a copy of the cases concerning him under the existing whistleblower system with specific file numbers precisely designated by the plaintiff, and information on and a copy of any performance evaluations of the employer concerning him in the period between January 1, 2012 and December 31, 2018.

In this regard, the BAG stated that the request under 1. submitted by the employee did not meet the statutory requirements for specification, as it - in addition to the wording of Art. 15 of the GDPR - used terms that required further interpretation, the result of which remained unclear among the parties ("performance and behavioral data"). In addition, the exclusion of a storage location in the request ("not stored in the plaintiff's personnel file") "obscures" what information is actually requested as a result.

It was not apparent to the BAG which of the data the request should still include. It could, for example, concern assessments or expressions of opinion by other employees about the plaintiff (whereby, for example, the European Court of Justice had pointed out in 2014 that the data subject can demand information about the stored "factual bases", but not about the "analyses" based on them) or about information that possibly departs from the "concept of performance and behavior", as will often be the case with a mere e-mail exchange.

What the plaintiff had not requested was information about "all" stored personal data, which would correspond to the wording of Article 15 (1) GDPR. The BAG expressly leaves open whether, in view of the special nature of the right to information resulting from EU law, it is permissible for the employee - insofar as he has not yet received any information from the employer - to make a request oriented to the pure wording of Art. 15 GDPR without further specification, but considers this to be worth considering. This legal question has therefore not yet been decided by the highest court.

The employee's request to be provided with a copy of his personal performance and behavioral data (request no. 2.) was also rejected by the BAG judges as inadmissible.

A mere abstract mention of the requested "copy" by repeating the wording of Article 15 (3) sentence 1 GDPR and by adding the criteria "performance and conduct", which are subject to interpretation, again does not meet the requirements of a sufficiently specific claim, since these terms must first be interpreted in terms of content.

However, even without the unclear criteria of "performance and conduct", the term "copy" is not sufficiently clear. The mere repetition of the wording of the law is in any case not sufficient for the assertion of the claim for the provision of a copy under Article 15 (3) GDPR.

The term "copy" can be understood to mean that the employer must provide the employee with either a paper printout or, for example, an electronic data copy. In its decision from April 2021, the BAG had already clarified that the claim to the provision of copies must be precisely defined. In case of doubt, the employee must file a step-by-step action and specify his claim for surrender after being provided with information.