Is a data protection officer specially protected against termination?

The European Court of Justice has just dealt with this question in a case about the German rules on the protection of data protection officers (DPOs). The General Data Protection Regulation contains rules on the protection of DPOs. It appears, for example, from article 38 of the regulation that DPOs may not be dismissed for carrying out their duties.

The regulation thus provides independent protection of DPOs terms of employment, although in Danish law it must be assumed that, for example, the rules of the Employers’ and Salaried Employees’ Law on unfair dismissal will provide protection in the same case. The rule is aimed at ensuring the DPO the necessary security and independence when performing the DPO task.

The case in Germany

In a decision from June this year (case C-534/20, Leistritz, dated 22 June 2022), the European Court of Justice has ruled on the issue of the protection of a German DPO who was terminated by his employer. In German law, it appears that a DPO can only be terminated without notice in exceptional cases and with a “good reason”.

The dispute was between a private workplace and an employee who acted as DPO. The termination occurred against the background of restructuring in the department to which the employee was assigned. However, the employee claimed that as a DPO he enjoyed special protection under German law.

The German rules go beyond the framework of the General Data Protection Regulation. The European Court of Justice, therefore, had to decide whether Germany had to introduce rules for dismissal that were stricter than the rules of the regulation.

Since the regulation basically constitutes total harmonisation, the EU countries must, as a starting point, implement the rules in national law in accordance with the regulations’ rules.

If it appears from the regulation, the individual country can adopt separate rules, which must not, however, conflict with EU law or endanger the purpose of the regulation.

The European Court of Justice determined that the intention of the regulation’s protection of the DPO is not to pursue an employment law purpose, but only relates to data protection. Thus, the German rules were in line with the regulation, pursuing the data protection objective.

What are the rules in Denmark?

Denmark does not have special rules on the protection of DPOs, as they do in Germany. DPOs in Denmark is therefore protected by the labour market’s general rules on e.g., unfair dismissal to the extent that these apply to the DPO’s employment.

It cannot be denied that special rules will also be introduced in Denmark that will equate the protection of the DPO with the protection that we find, for example, in the Working Environment Law’s provisions on the protection of employee-elected working environment representatives.

If you have questions about the protection of data protection officers or other questions related to the subject, please do not hesitate to contact our employment law specialists Attorney Julie Flindt Rasmussen or Attorney David Bar-Shalom.