Group-wide data transmission

In its ruling of December 14, 2021 (17 Sa 1185/20), the Fedarl Labor Court (LAG) of Hamm decided that an employee is entitled to injunctive relief and non-material damages in the amount of 2,000 Euros if the employer violates the requirements of the GDPR by transferring data within the group that is not necessary for the performance of the employment relationship.

Facts

The ruling of the LAG Hamm is based on the following facts: The plaintiff is employed in a clinic which is part of a clinic group. The shareholder of the individual clinic companies has as its corporate purpose the assumption and guarantee of the management of hospital operating companies and service companies active in the hospital sector. The shareholder assumes tasks of organization, management and personnel controlling in the clinic group, but is not a personnel department or personnel administration unit of the defendant or other group clinics. The defendant has its own personnel department. In turn, another company is active in the group for IT issues.

The shareholder of the defendant has a right of approval with regard to the hiring of employees with a certain annual income and with regard to the conclusion of target agreements with this group of employees. In order to prepare a target agreement with the plaintiff, the defendant provided the shareholder with comprehensive information on the plaintiff's personal data - despite reservations under data protection law.

The plaintiff is seeking an injunction against the transfer of the data and appropriate damages for the non-material loss, the amount of which is expressly left to the discretion of the court hearing the case, but at least 10,000 Euros. The Labor Court granted the majority of the claim and ordered the defendant to cease and desist and to pay damages of 2,000 Euros. The appeals lodged by both parties were unsuccessful.

Reasons for decision

In the opinion of the Court of Appeal, the defendant was not able to rely on a justification for the data transfer. In particular, the requirements of Section 26 of the Federal Data Protection Act (BDSG) as a more specific provision to Article 6 (1) (b) of the GDPR as well as Article 6 (1) (f) GDPR were not met in the case in dispute. Personal data of employees may be processed for purposes of the employment relationship if this is necessary for the decision on the establishment of an employment relationship or, after the establishment of the employment relationship, for its implementation or termination or for the exercise or fulfillment of the rights and obligations of the employees' interest representation resulting from a law or a collective wage agreement, a works agreement or a service agreement (collective agreement). For the performance of the employment relationship, processing of personal data is required thereafter if and to the extent that the employer requires the data processing in order to fulfill its lega obligations and to be able to assert the rights which are regulated with regard to the employment relationship in statutory provisions, collective agreements and individual agreements with the employee. The data transfer in dispute was not necessary for the performance of the employment relationship with the plaintiff. The shareholder is not a personnel department or personnel administration unit of the defendant. All accounting and personnel administration processes relating to the plaintiff's employment are carried out without her involvement. The employment relationship also has no other reference to the group.

Similarly, the requirements of Art. 6 (1) (f) of the GDPR are not met. The transfer of the data was not necessary in its concrete form. According to the LAG, the plaintiff's salary data could have been transmitted in pseudonymized form.

Considering and weighing all circumstances of the individual case, the court of appeal also considers the damages in the amount of 2,000 euros to be appropriate. In this respect, the court also considered the fact that the defendant had initially resisted the transfer of data and had even obtained a legal opinion on the issue in dispute.

Notes for practice

The rising number of data protection-related information claims and claims for damages, as well as the increasing willingness of supervisory authorities to impose fines on companies for data protection violations, should be sufficient signals for employers to take data protection seriously in their business practice. In an unusually detailed decision, the LAG Hamm has now ruled that an intra-group transfer of employee data is not justified across the board under Art 6 (1) lit f of the GDPR. The court deals intensively with the balancing of interests and also with Recital 48, stating that blanket references to the legal justifications for data transfers are not sufficient, but that a detailed examination of the actual conditions is required. The call for group privilege in the context of data protection law is likely to become louder again in the wake of the ruling.