Key decision of the German Federal Labour Court - Right of data access under Art. 15 para. 3 GDPR

Data controllers are faced with immense challenges in fulfilling these requests. The decision provides some, but not full clarity in which cases employers can push back on certain access requests:

The Federal Labour Court has ruled that a data subject must precisely designate the e-mails of which he would like to receive a copy, otherwise their claim is not sufficiently specified and, hence, not enforceable under German procedural rules and must therefore be dismissed. For the future, this means that an employee cannot request a blanket handover of all e-mails in which they are mentioned. However, it remains unclear whether employees can demand copies of these e-mails if the request is sufficiently specified.

Facts of the case:

The parties were in dispute to which extent an employee (the claimant in a dismissal claim) could claim full copies of his personal data processed by the employer. According to the employee, the employer should hand out all e-mail correspondence between him and the employer, as well as any and all e-mails in which he was mentioned between other members of staff of the employer. In the given case, the employer had provided the employee with information on the categories of personal data of the employee processed by the employer, as well as ZIP files containing the stored personal data.

The German Federal Labour Court has now decided that the employee’s claim for a copy of e-mails is not sufficiently specified if the e-mails of which a copy shall be provided are not specified in such detail that it is unambiguous in the enforcement proceedings which e-mails the judgement to be enforced actually refers to.

The first court instance (Labour Court Hameln) had dismissed the claim arguing that the employee had not sufficiently substantiated the claim. In the appeal, the Lower Saxony Federal Labour Court partially upheld the employee’s claim, arguing that an ample request to be provided with “all copies of personal data” was sufficiently substantiated in line with Art. 15 para. 3 GDPR. The court supported the employee in that he had requested copies of all e-mails he had written or in which his name appeared. The provision of the ZIP files has not fulfilled the request. The Lower Saxony Federal Labour Court had decided that the employee was entitled to receive a copy of the personal data that the employer had processed, however it denied a claim under Art. 15 para. 3 GDPR to be provided with copies of the entire email correspondence regarding the employee.

Conclusion:

In general, the decision of the Federal Labour Court is favourable and in line with recent labour court decisions. The Federal Labour Court has refrained from making a referral to the ECJ. Such a procedure would have further delayed a decision, but would probably also have led to more legal clarity. Several labour courts have already dismissed claims for the handover of entire data records and have interpreted Art. 15 para. 3 GDPR in a rather restrictive sense, ruling repeatedly that the employer (as a data controller) setting a limit where the required “efforts of the controller [i.e. the employer] are grossly disproportionate to the claimant’s interest in performing the access request” (Labour Court Düsseldorf, 5 March 2020 – 9 Ca 6557/18). It appears that the employee may need to provide a sufficiently specified list of the emails to be provided (under the access claim Art. 15 para. 3 GDPR) so that the employer can identify the relevant copies to be provided to the employee. Nevertheless, it remains to be seen whether and when the Federal Labour Court provides clarity on how to deal with a sufficiently specified procedural claim requesting access to copies. For the time-being, it remains whether the Federal Labour Court provides additional explanations in the grounds of its decision.