On February 9, 2023, the Court of Justice of the EU (“CJEU”) released two separate rulings on the dismissal of data protection officers (“DPOs”) under the German Federal Data Protection Law (“German DPL”) (C-453/21 and C-560/21).  The main question in both cases was whether Section 6(4) of the German DPL which permits the dismissal of a DPO with “just cause” is compatible with the GDPR.  In short, the CJEU (i) found that the provision was compatible with the GDPR because EU member states can use “just cause” as a threshold for dismissal as long as this does not undermine the objectives set for DPOs under the GDPR, and (ii) clarified the criteria EU member states should take into account to determine whether there is a conflict of interest.

The CJEU rulings concerned DPOs who were employed at German companies and dismissed “for just cause” from their respective DPO positions due to conflicts of interest concerns.  In one case, the DPO was simultaneously chair of the company’s works council.  In the other case, there was a perceived incompatibility with the DPO’s other professional responsibilities at the company (which the judgment does not disclose).  Importantly, the DPOs had not been dismissed because of the way they performed their duties and tasks as a DPO.

The term “just cause” is used in the German Civil Code to refer to situations where it cannot be reasonably expected for the employment contract to continue as normal, i.e., until the end of the notice period or until the agreed termination date, taking into account all the circumstances of the individual case and weighing the interests of both parties.  This requirement goes beyond the provision in Article 38(3) GDPR, which provides that the DPO “shall not be dismissed or penalized by the controller or the processor for performing his tasks.”

The CJEU decided that EU member states could require that DPOs be dismissed for “just cause”, insofar as these laws do not undermine the objectives set for DPOs under the GDPR.  The CJEU also held that a law would undermine the GDPR’s objectives if it would prohibit controllers and processors from dismissing DPOs who no longer have the professional qualifications required to perform their duties or whose duties are not in accordance with those of the GDPR.

As for whether there was a conflict of interest, the CJEU decided that it was for the national courts to decide whether such a conflict existed taking into account “all the relevant circumstances, in particular the organizational structure of the controller or its processor and in light of all the applicable rules, including any policies of the controller or its processor.”  That said, the CJEU stated that a DPO cannot be entrusted with tasks or duties that would result in him or her determining the objectives and methods of processing personal data on the part of the controller or its processor.  This role would place the DPO in a position of conflict of interest.

In our previous blogpost, we highlighted the EDPB’s decision to investigate the designation and role of DPOs in their 2023 Coordinated Enforcement Action.  We expect more decisions about DPOs this year.

*                      *                      *

Covington’s Data Privacy and Cybersecurity Practice will continue to monitor CJEU cases and report on any relevant Court decisions or Advocate General opinions.