The works council chairman cannot be the data protection officer at the same time

Recently, the German Federal Labor Court (Bundesarbeitsgericht,BAG) found two important positions in companies to be incompatible. The works council chairman cannot hold the position of data protection officer at the same time.

The ruling came after the BAG first appealed to the European Court of Justice (ECJ) for clarification. As a result of the February 2023 decision of the ECJ, the BAG has now also ruled on the relevant case.

The opposing positions

Above all, the question revolved around possible conflicts of interest between the position of the works council chairman and the data protection officer in a company.

The tasks of the data protection officer include informing and advising the company on obligations under data protection law. He or she monitors compliance with the GDPR and other data protection regulations. This also includes raising awareness and the training of employees involved in processing operations. He or she also advises on the data protection impact assessment and cooperates with the competent supervisory authority.

The chairman of the works council represents the works council within the framework of the resolutions passed. Among other things, he or she convenes meetings, chairs the meetings and sets the agenda. However, the works council is also involved in decisions on the processing of personal data.

Reasons for incompatibility

Personal data may only be made available to the works council for the purposes provided for by law. The works council decides for itself which personal data it requires from the employer in the context of its statutory tasks and how it subsequently processes them.

The data protection officer, in turn, is engaged to monitor the purposes and means of data processing.

This overlap of tasks can lead to a conflict of interest. At least, so claims the BAG.

Initial facts

The judgment of the BAG was based on the following facts: The plaintiff is the works council chairman of a company and, in this position, is partially exempted from work duties. In 2015, he was appointed data protection officer. This appointment was revoked in 2017 at the request of the Thuringian State Commissioner for Data Protection and Freedom of Information (Thüringer Landesbeauftragten für Datenschutz und Informationsfreiheit). The reason given was the incompatibility of the position with chairmanship of the works council.

The plaintiff took legal action against the revocation. The lower courts agreed with him.

The BAG then submitted a question to the ECJ regarding the interpretation of the GDPR and the German regulations. The European Court of Justice issued its judgment in February of this year.

Ruling of the BAG

On June 6, 2023, the judgment of the BAG was issued. The appeal was successful and the complaint was dismissed.

Chairmanship of the works council typically precludes the performance of duties as data protection officer and usually entitles the employer to dismiss the person from the position of data protection officer.

There is a good cause for dismissal, namely a conflict of interest. The works council decides for itself which personal data it requires and under what circumstances it requires such data from the employer in the exercise of its statutory duties and how it is subsequently processed. This defines the purposes and means of the processing of personal data.

For their part, the data protection officer should be able to monitor the processing of personal data independently. If the same person performs these tasks, they would have to monitor themselves to a certain extent.

In any case, in the prominent position of the works council chairman, there is a conflict of interest according to the BAG, which constitutes good cause for dismissal from the position of data protection officer.

Applicability to today’s legal situation

The decision was still based on old regulations of the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). However, even according to the provisions of the current GDPR and the new version of the BDSG, the conflict of interest between the positions cannot be assessed differently.

Implications for practice

With regard to practice, in comparable situations in companies, the resignation of one of the offices by the incumbent or a dismissal from the post of data protection officer by the controller must be considered.

The BAG did not have to decide whether the conflict of interest can also be assumed for other members of the works council. However, there is a lot to be said for this. After all, the works council chairman is no more involved in decision-making than the other members of the works council. Therefore, similar arguments could be made for a conflict of interest on the part of other members of the works council.