Facts and background of the proceedings
In the case decided by the Federal Labor Court under file number 8 AZR 209/21, the focus was on the requirements and limitations of an employer’s duty to provide information pursuant to Article 15 of the General Data Protection Regulation (GDPR). The case concerned an employee who, after termination of his employment, requested information from his former employer regarding which personal data had been processed during his employment. In addition, the plaintiff requested copies of the relevant documents.
The specific dispute revolved around the scope of the information the employer is required to provide while complying with data protection law. In particular, it was disputed to what extent copies of documents can be requested and whether there is an obligation to present all internal correspondence, emails, and notes relating to the employee.
Legal considerations regarding the right of access under Article 15 GDPR
Scope of the duty to provide information under the GDPR
Article 15 GDPR grants data subjects the right to comprehensive information on the data stored about them as well as the right to receive a copy of this data. What is crucial is how far-reaching this duty to provide information is and how detailed the information must be. This is of significant importance in employment law practice, as sensitive and extensive data collections on employees are often maintained.
Case law has repeatedly emphasized that providing information does not mean the data subject must be given unrestricted access to all documents existing within the company. Rather, it is always necessary to differentiate between personal data that must be disclosed pursuant to the right of access, and other documents which are not subject to this claim—particularly when the documents contain only internal assessments or notes that relate to the employee only indirectly.
Limits and protection interests
When assessing the scope of the right of access, it is also important to consider the protection of other affected persons and legitimate corporate interests, such as trade secrets or internal business processes. The GDPR itself stipulates that the rights and freedoms of third parties must be taken into account (see Article 15(4) GDPR).
The Federal Labor Court has further emphasized that the right of access must not result in the employer being forced to disclose every item of correspondence, every memo, or every internal communication without any limitation. Instead, the decisive factor is whether and to what extent certain documents actually contain “personal data” that are covered by the right of access. In each individual case, it must be examined whether the relevant data are significant to the applicant and whether there are overriding interests of third parties.
Requirements for the provision of document copies
The question of the extent to which copies of documents can be requested is of great practical relevance for both employers and employees. Providing copies may be justified, in particular, when the relevant documents are largely available in an automated form or can otherwise be provided in a simple organizational manner. However, according to the Federal Labor Court’s interpretation, the provision of “all” documents, notes or emails stored within the company is not simply covered by the GDPR.
An obligation to provide copies generally requires that there is a specific connection to the request for information and that the respective documents actually contain personal data. According to the case law of the highest courts, blanket requests for the provision of documents meet their limits, especially if this would lead to disproportionate effort in reviewing very extensive files.
Classification and significance for practice
Implications for employees and companies
The decision of the Federal Labor Court highlights the considerable importance of a balanced approach to requests for information in employment relationships. Companies are required to review their processes so that, on the one hand, they fulfill the legitimate claims of former and current employees for transparency, but on the other hand, also safeguard company interests and the data protection rights of third parties.
Employees, in turn, can infer from the decision that their right of access is not unlimited but must be exercised according to the purpose of the right and within the framework of statutory provisions.
Practical implementation and challenges
Especially with regard to the processing and storage of personal data, it is advisable to regularly evaluate existing documentation and archiving processes. The legal complexity of such requests for information generally requires careful individual examination, taking into account both the requirements of data protection law and operational and organizational matters.
Conclusion
The decision of the Federal Labor Court (8 AZR 209/21) provides further clarification on the scope of rights of access under the GDPR in employment relationships and underscores the necessity of a nuanced examination of the respective interests involved. The employer’s duty to provide information is far-reaching, but is subject to limitations—among others, the principle of proportionality, as well as the protection of third-party rights and company interests.
Notice for companies and employees
If questions arise regarding the scope and implementation of access rights under the GDPR in the context of existing or terminated employment relationships, individual legal advice can support an effective approach to the statutory requirements. The team at MTR Legal is available to companies and individuals for confidential and solution-oriented advice as part of its practice.
Source: Federal Labor Court, Judgment of 16.2.2023 – 8 AZR 209/21
