Requirements for the Definiteness of the Right to Information under Data Protection Law

Even if the BAG was able to leave open questions regarding the scope of the claim, the decision makes clear that a claim under data protection law can only be pursued, in and out of court, with a sufficiently specific petition. According to the BAG, a request by an employee to be provided with a copy of his e-mail correspondence and e-mails referring to him by name is not sufficient for the petition to be specific. In this case, it is unclear for the employer which e-mails exactly he has to provide.

Facts

In the aforementioned proceedings, the parties are disputing not only the termination of the employment relationship but also, in particular, the issue of a copy of data pursuant to Article 15 (3) GDPR.
After termination of the employment relationship by the employer, the defendant provided information about the plaintiff's personal data or categories of personal data in accordance with Article 15 (1) GDPR at the plaintiff's request. In addition, the defendant provided the plaintiff with the stored personal data as so-called ZIP files. Nevertheless, the plaintiff further requested that the defendant be ordered to "provide the plaintiff with a copy of his personal data processed by the defendant". According to the defendant, it had fulfilled the claim for a copy because, in addition to the e-mail with encrypted files, it had also provided the respective password.

In the first instance, the action was dismissed because the plaintiff had not sufficiently specified his petition and the petition was too vague.

In the appeal filed by the plaintiff before the Lower Saxony Regional Labor Court, the plaintiff argues that the claim for the issue of a copy pursuant to Article 15 (3) GDPR is sufficiently specific, as it relates to all copies. In its decision of June 9, 2020 - 9 Sa 608/19, the Lower Saxony Regional Labor Court decided that the plaintiff's petition was sufficiently specific, but that there was no further claim, in particular for copies of the complete email correspondence. It justified its decision by stating that the claim for a copy pursuant to Article 15 (3) GDPR cannot go further than the mandatory information on the access right regulated in Article 15 (1) GDPR. A more far-reaching view extending the claim to entire data sets (according to the opinion of the Cologne Higher Regional Court, decision of July 26, 2019, 20 U 75/18) was not convincing.

The appeal filed against this decision before the BAG was unsuccessful on the merits.

BAG’s decision

The BAG already considered the plaintiff's petition for a copy of e-mails to be insufficiently specific pursuant to Art. 253 (2) ZPO (German Code of Civil Procedure) if the e-mails of which a copy is to be provided are not designated precisely enough to leave no doubt in the enforcement proceedings to which e-mails the sentence relates.

Conclusion

It can be observed that employees are increasingly asserting claims for information under data protection law against their employers. As can already be seen from the Lower Saxony Regional Labor Court’s decision in comparison to the Cologne Higher Regional Court’s decision, the claim’s scope and range are treated differently. However, this is where the next danger for the employer lurks. A breach of the duty to provide information may entail a claim for damages due to immaterial impairment of the personal rights.

However, the BAG’s decision provided insight into the specific requirements to be met when formulating a claim under data protection law. Therefore, if (former) employees assert a claim for information under data protection law either in or out of court, employers are recommended to first carefully check (or have checked) whether the employee has formulated his or her request for data disclosure precisely enough.