Holding simultaneous roles as works council chairperson and company data protection officer

Access German version here

If the company data protection officer is also the chair of the works council, she / he can be dismissed from her / his position as data protection officer. The German Federal Labor Court (BAG) has determined that the two functions are incompatible due to a conflict of interest (Judgment of 6 June 2023 – 9 AZR 383/19).

The case

The plaintiff is the chair of the works council in the defendant's subsidiary and was also appointed as the in-house data protection officer in 2015. Following an intervention by the competent supervisory authority, the defendant revoked the appointment of the plaintiff as the data protection officer. The plaintiff contested this.

Chair of the works council decides on data processing operations

In the opinion of the BAG, there is an irreconcilable conflict of interest in the case of simultaneous activity as works council chairperson and as data protection officer, which allows the dismissal of the data protection officer for good cause (Section 6 para. 4 sentence 1 of the German Federal Data Protection Act in conjunction with Section 626 para. 1 German Civil Code). The court based its decision on the principles established by the European Court of Justice (ECJ) with regard to the requirement to avoid conflicts of interest (Article 38 para. 6 General Data Protection Regulation). In this regard, a conflict is to be assumed if a data protection officer also holds a position that permits them to determine the purpose and means of data processing (Judgement of 9 February 2023 - C-453/21). Such a position is incompatible with the office of data protection officer, as it is the responsibility of the data protection officer to monitor compliance with data protection regulations. Were such an arrangement to exist, the data protection officer would be in a position of having to review themself.

In the opinion of the BAG, the dual role of works council chairperson and data protection officer is a conflict of interest, as the works council also processes personal data in the exercise of its duties and rights under the German Works Constitution Act. In some cases, the works council also decides which data is to be processed and how, ie it determines the purposes and means of data processing. The chair of the works council is responsible for representing the works council, meaning that they would need to monitor themself as the data protection officer.

Takeaways for employers

The BAG's decision was surprising. In its reference to the ECJ, the court indicated that it would not find there to be conflict of interest in this case. Nevertheless, the clarification of this long-standing controversial issue is to be welcomed from a practical perspective. It remains unclear whether simple membership of the works council is sufficient to justify dismissal. It will also have to be clarified in the future whether other positions in the company structure should be excluded from the role of data protection officers due to their influence on data processing operations. A proper examination is always required if the company data protection officer performs additional activities or offices. This applies in particular given that, in the event of a conflict of interest, the supervisory authorities may assume that a company which is obliged to appoint a data protection officer has failed to appoint a (permissible) data protection officer.