Employee has no right to email copies in the context of issuing a data copy pursuant to Art. 15 (3) GDPR

Employees have a claim against their employer for information about all personal data processed by the employer (Art. 15 (3) sent. 1 GDPR). This right includes, among other things, information about the purposes of processing, the recipients of the data and the storage period. In accordance with the General Data Protection Regulation, the employer must also provide the employee with a copy of the data.

However, the scope of the right to information and the right to receive a data copy, which has been completely redesigned by the introduction of the General Data Protection Regulation, has not yet been clarified by case law. In particular, the scope of the data copies causes major problems in practice, especially in the context of employment relationships. Almost all documents that are created, processed and stored in the context of employment relationships contain personal data. This also applies, for example, to e-mails sent and received by employees. Does this therefore mean that the employee may be entitled to a (complete) copy of the e-mails sent and received? What about personal data of third parties that may be contained in these e-mails? So far, the highest court has not yet defined the scope of the claim.

Now, for the first time, the issue was brought before the Federal Labor Court and the second senate had the opportunity to rule on it on April 27, 2021.The case was about an employee (business lawyer) who had been dismissed during his probationary period and took legal action against his dismissal. As a data protection officer, he enjoyed special protection against dismissal, comparable to the protection against dismissal enjoyed by a member of the works council (§ 6 (4) sent. 2 BDSG – German Federal Data Protection Regulation). In addition to asserting protection against dismissal, he asserted a claim for information under Article 15 of the GDPR regarding the personal data stored by the employer that concerned him. He also demanded copies of this data. On June 26, 2019, the Hamelin Labor Court dismissed the employee’s (additional) claim for a copy of the data. However, the Lower Saxony State Labor Court then partially upheld the employee’s appeal on June 9, 2020. It assumed that the plaintiff had a right to be provided with a copy of his personal data, namely to all data which the employee had requested to be provided with. However, according to the Lower Saxony State Labor Court, this right to a copy of the data does not extend to the requested copies of his e-mail correspondence or other e-mails that mention him by name. The Lower Saxony State Labor Court does not consider these to be personal data within the meaning of Art. 15 of the GDPR, because Art. 15 of the GDPR refers to data which are “the main subject of processing”, i.e. which provide a certain degree of information about the data subject. According to recital 63 to the GDPR, the data controller, i.e. here the employer, may request a specification of the requested information or processing operations by the data subject, i.e. the employee, if large amounts of information about the data subject are processed but, according to the Lower Saxony State Labor Court, does not have to make copies indiscriminately. In addition, the right to information is limited to such documents that are not already available to the person requesting the information. However, the employee is already aware of his or her own e-mail correspondence and for this reason alone is not entitled to be provided with copies. Moreover, it must not be forgotten that e-mails may also contain personal data of third parties to which the employee is in no way entitled and the disclosure of which may violate the rights of third parties. In this case, the employer would have to check each individual e-mail and, if necessary, purge it of such data.

The Federal Labor Court rejected the employee’s appeal as inadmissible. However, this was for purely procedural reasons, as the claim was not sufficiently specific.

The clarification by the highest court regarding the scope of the claim for a data copy which everybody was hoping for has therefore not occurred. However, the Federal Labor Court has clarified that a request which merely repeats the wording of the GDPR does not comply with the principle of certainty from § 253 (2) No. 2 ZPO (German Code of Civil Procedure). Rather, the documents, such as e-mails, of which a copy is to be provided, must be designated in the request so precisely that in any enforcement proceedings that may be required, it is beyond doubt as to which specific documents the obligation to provide information relates. In the event that such a specific request cannot (yet) be made because, for example, it is unclear which specific documents are held by the employer, the request can be asserted in court by way of a step-by-step action pursuant to § 254 ZPO (German Code of Civil Procedure). In this case, the employee must first assert a claim for information and then formulate a concrete request for surrender once the information has been provided.

Thus, employers still cannot refer to a Federal Labor Court ruling on the scope and restriction of the right to information under applicable data protection regulations. Against this background, they can and should draft a restriction of the right to information in compliance with the legal requirements of the GDPR. In this respect, the GDPR offers some leeway for drafting, which can and should be used without restriction. Employers might therefore want to not take information claims lightly, but actively shape these requests.