Scope of the right to information under data protection law: Can the employee demand that his or her official e-mails be handed over? (BAG, April 27, 2021 – 2 AZR 342/20)

Employers are now increasingly confronted with claims for information from (former) employees. However, it has not yet been clearly clarified what exactly can be the subject of the right to information and to what extent it must be complied with.

This presents employers with several major challenges:

1. You must find all personal data of the data subject within a short period of time (one month) and, if necessary. prepare.
2. You also only have a short period of time to check which information claims are justified and which are not.
3. Last but not least, you may have to check in individual cases whether business secrets or the interests of third parties are affected by the disclosure.

In particular, the scope of the claim for surrender or transmission of a copy of the data has still not been decided by the highest court. The decisions of several state labor courts in recent years show that there are many open questions:

• What rights to information exist with regard to data from whistleblower systems?
• Can the information be refused with reference to reasons of secrecy? What does the employer have to present?
• When may information be refused with reference to statutory exceptions?
• Is there a claim to information about or surrender of data that must first be restored from backup files? When is the recovery effort unreasonable for the employer?

The German Federal Labor Court (“BAG”) has now, in its ruling of April 27, 2021 (only the court’s press release on the ruling is available so far), dismissed an action brought by an employee against his former employer for the transfer of a copy of data pursuant to Art. 15 para. 3 GDPR in the form of his e-mails sent in the course of his employment. The employee argued that his right to a data copy also included all of his work-related e-mails.

The BAG rejected the claim on the grounds that the claim was too vague. If the e-mails, a copy of which is to be provided, are not designated so precisely that it is undoubted in the enforcement proceedings to which e-mails the condemnation refers, the requirements for the definiteness of the claim are not fulfilled according to. The employee would therefore have to sue for information at the first stage in order to substantiate the request for surrender. The BAG apparently left open the question of whether the e-mails should be released at all.

The specific scope of the rights to information under data protection law thus remains unclear. Employers must therefore expect, not least because of the different legal opinions of the supervisory authorities, that in the end they would actually also have to hand over copies of all e-mails. Employers are therefore strongly advised to,

• Maintain an effective data protection management system and a complete inventory of processing activities in order to be able to fulfill requests for information;
• Do not ignore requests for information from (former) employees, as failure to comply alone can result in fines and claims for damages;

in case of doubt about the scope of the duty to provide information, seek legal advice promptly in order to be able to meet the one-month deadline.