Schalast | News

Recent developments on Data Subject Access Requests (DSARs) under Art. 15 GDPR in particular in the employment context in Germany

10.01.2025

It has become more and more common for employees (in particular if they face a dismissal) to file data subject access requests (DSARs) under Art. 15 GDPR (General Data Protection Regulation) asking for the details of the processing of their personal data at the employer.

 

The right to make DSARs is undoubtedly important in our digital age. However, these requests also pose significant challenges for employers, which in certain situations they may consider disproportionate. This is in particular the case when considering the vast amount of employee data that is naturally processed by employers - much of which holds little importance - and on the other hand, some of the employees’ intention to make such requests.

Often the pursuit of DSARs in Germany takes place for example in the form of side claims within dismissal protection actions in front of labor courts. They are also not seldomly used by employees to strengthen their position when negotiating an agreement with the employer regarding the ending of the employment relationship. It is currently being speculated by employment law practitioners that around one in every three dismissal protection actions might contain a supplementary DSAR claim. As more and more employees file DSARs, more and more courts will provide valuable jurisprudence and case law in this regard.

Taking a closer look at that already available case law creates a picture which is to some extent enlightening but at the same time does not contain that many black and white answers.

There are for example court decisions which deem it as sufficient for individuals/employees to use the exact wording of Art. 15 GDPR when submitting a DSAR within court proceedings. Other courts, however, have decided that a copy-and-pasting of that sort results in an undefined claim and have therefore rejected respective claims due to its inadmissibility (for example Federal Labor Court, judgment of 16 December 2021, 2 AZR 235/21, as well as Regional Labor Court of Saxony, judgment of 17 February 2021, 2 Sa 63/20). The Federal Labor Court held that a respective claim that merely repeats the text of Art. 15 GDPR is generally not suitable for settling a specific dispute between the parties with legal effect. Respective claims therefore need to be specified in detail instead of a simple copy-and-pasting of the statutory provision, otherwise they run the significant risk of being rejected by the court.

Another important aspect lately discussed in regard to procedural DSAR claims is the one on ‘abuse of law’. It was held for example by the same Regional Labor Court of Saxony that there is no valid claim if the individual is not pursuing his data protection rights granted under the GDPR but is instead doing so for extraneous purposes, such as an attempt to gather data and information useful for the assertion of other non-data protection related claims. It is therefore very important for employers to note what the claimant brings forward as his reason and purpose for the DSAR claim.

Other recent and important case law deals with the question of whether Art. 15 para. 3 GDPR gives an explicit right to receive one-to-one copies of the documents containing the personal data or whether the data controller (e.g. the employer) is entitled to provide it in another format as long as the personal data contained in such documents is being provided. There have been quite divergent court decisions on this lately. However, the European Court of Justice held that the term ‘copy’ does not relate to a document as such, but to the personal data which it contains and which must be complete (European Court of Justice, judgment of 4 May 2023, C-487/21). Accordingly, the right to obtain copies of entire documents is only given if the provision of such a one-to-one copy is essential in order to enable the data subject to exercise effectively the rights conferred on him or her by the GDPR.

Last but not least, a rather key preliminary question has also been subject to court decisions in the past, namely whether the one-month deadline (under Art. 12, para. 3, s. 1 GDPR) for responding to DSARs actually starts to run if a person submitting the request on behalf of the data subject (for example an attorney) has not provided sufficient evidence of the authorization by the data subject to do so. In this regard both the Higher Regional Court of Stuttgart and the District Court of Berlin-Mitte have looked at the question of whether an attorney submitting a DSAR for his/her client has to provide an (original) power of attorney document in order to start that one-month deadline (Higher Regional Court of Stuttgart, judgment of 31 March 2021, 9 U 34/21 and District Court of Berlin-Mitte, judgment of 29 July 2019, 7 C 185/18). The courts came to the conclusion that a respective power of attorney document needed to be provided in order to initiate the running of the deadline.

 

It can be summarised that DSARs (in particular by employees towards their employers) will surely continue to be an increasing area of dispute between the two parties of the relationship and by that keep German courts as well as data protection officers dealing with such requests also busy in the future. The more court decisions we see, the clearer the picture should become on both the employee’s data protection rights and the employer’s interests not to be obliged to make unmanageable efforts to satisfy such requests.