Judgment;Summary — ECLI:EU:C:2023:79
Date: 2023-02-09
Language of the case: German
Court formation: Sixth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Summary C-453/21 – 1 
Case C-453/21 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
21 July 2021 
Referring court: 
Bundesarbeitsgericht (Germany) 
Date of the decision to refer: 
27 April 2021 
Defendant, appellant in first appeal and appellant on a point of law: 
X-FAB Dresden GmbH & Co. KG 
Applicant, respondent in first appeal and respondent in the appeal on a point 
of law: 
FC 
  
Subject matter of the main proceedings 
Dismissal of the applicant as data protection officer on the ground that he was 
both chairman of the works council and data protection officer at the defendant 
company. Whether an incompatibility exists between those functions and 
therefore ‘good’ cause justifying dismissal. Whether the stricter wording of the 
conditions for dismissal under national law are compatible with EU law. 
Subject matter and legal basis of the request for a preliminary ruling 
Interpretation of EU law, in particular Article 38 of Regulation (EU) 2016/679; 
Article 267 TFEU. 
Questions referred for a preliminary ruling 
1. Is the second sentence of Article 38(3) of Regulation (EU) 2016/679 
(General Data Protection Regulation; ‘the GDPR’) to be interpreted as precluding 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-453/21 
 
2  
a provision in national law, such as, in the present case, Paragraph 38(1) and (2) in 
conjunction with the first sentence of Paragraph 6(4) of the 
Bundesdatenschutzgesetz (Federal Law on data protection; ‘the BDSG’), which 
makes dismissal of the data protection officer by the controller, who is his 
employer, subject to the conditions set out therein, irrespective of whether such 
dismissal relates to the performance of his tasks? 
If the first question is answered in the affirmative: 
2. Does the second sentence of Article 38(3) of the GDPR also preclude such a 
provision in national law if the designation of the data protection officer is 
mandatory not in accordance with Article 37(1) of the GDPR, but only in 
accordance with the law of the Member State? 
If the first question is answered in the affirmative: 
3. Does the second sentence of Article 38(3) of the GDPR have sufficient legal 
basis, in particular in so far as it covers data protection officers that have an 
employment relationship with the controller? 
If the first question is answered in the negative: 
4. Is there a conflict of interests within the meaning of the second sentence of 
Article 38(6) of the GDPR if the data protection officer also holds the office of 
chairman of the works council established at the controlling body? Must specific 
tasks have been assigned within the works council in order for such a conflict of 
interests to be assumed to exist? 
Provisions of EU law relied on 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation), Article 37 (‘Designation of the 
data protection officer’), Article 38 (‘Position of the data protection officer’), 
Article 88 (‘Processing in the context of employment’). 
Provisions of national law relied on 
Bundesdatenschutzgesetz (Federal Law on Data Protection, ‘the BDSG’), 
Paragraph 6 (‘Position’) in Part 1, Chapter 3 (‘Data protection officers at public 
bodies’), Paragraph 38 (‘Data protection officers at non-public bodies’). 
Bürgerliches Gesetzbuch (German Civil Code; ‘the BGB’), Paragraph 626 
(‘Dismissal without notice for good cause’) 
X-FAB DRESDEN 
 
3 
Betriebsverfassungsgesetz (Law on the constitution of the works council, ‘the 
BetrVG’), Paragraph 26 (‘Chairman [of the works council]’) 
Succinct presentation of the facts and procedure in the main proceedings 
1 The parties are in dispute regarding the applicant’s dismissal as data protection 
officer. The applicant has an employment relationship with the defendant. He is 
released from some of his work obligations in order to perform his duties as 
chairman of the works council established at the defendant. 
2 With effect from 1 June 2015, the defendant, together with its parent company, 
and its other subsidiaries based in Germany each separately designated the 
applicant as data protection officer. By simultaneously designating the applicant 
as data protection officer for all group companies based in Germany, the intention 
was to establish a uniform standard of data protection group-wide. 
3 At the instigation of the state officer for data protection and freedom of 
information with jurisdiction over the defendant’s parent company, the defendant 
and the three other group companies based in Germany each revoked the 
designation of the applicant as data protection officer with immediate effect by 
separate letters dated 1 December 2017. 
4 Following the entry into force of the GDPR, the defendant and the three other 
group companies also took the precautionary measure of dismissing the applicant 
from his position as data protection officer pursuant to the second sentence of 
Article 38(3) of the GDPR by separate letters dated 25 May 2018, citing 
operational reasons. 
5 By his action, the applicant claimed that his legal position as company data 
protection officer remained unchanged. 
6 The defendant took the view that there was a risk of conflicts of interest if the 
applicant were to act as both data protection officer and chairman of the works 
council. This gives rise to incompatibility between the two offices, resulting in 
good cause for the applicant’s dismissal. 
7 The lower courts upheld the action. By way of its appeal on a point of law, the 
defendant seeks to have the action dismissed. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
8 The successful outcome of the appeal on a point of law depends on the 
interpretation of EU law. Pursuant to Paragraph 38(2) in conjunction with the first 
sentence of Paragraph 6(4) of the BDSG, the data protection officer may only be 
dismissed if Paragraph 626 of the BGB is appropriately applied, that is to say for 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-453/21 
 
4  
good cause. This means that the provisions of the BDSG make the dismissal of the 
data protection officer subject to stricter conditions than EU law. 
9 Under national law, the applicant’s dismissal of 1 December 2017 would be 
inadmissible pursuant to Paragraph 4f of the BDSG (in the version in force until 
24 May 2018) due to a lack of good cause. 
10 The question of whether the dismissal of 25 May 2018 is ineffective due to an 
infringement of Paragraph 38(2) in conjunction with the first sentence of 
Paragraph 6(4) of the BDSG depends on whether, pursuant to the second sentence 
of Article 38(3) of the GDPR, a Member State rule that makes the dismissal of the 
data protection officer subject to stricter conditions than EU law is permitted. If it 
were necessary to disregard Paragraph 38(2) in conjunction with Paragraph 6(4) 
of the BDSG owing to the primacy of EU law, the defendant’s appeal on a point 
of law would be successful. 
11 However, if the Court of Justice considers the conditions for dismissal set out by 
the BDSG to be consistent with EU law, it must be further clarified whether the 
offices of chairman of the works council and data protection officer of a company 
may be held by one and the same person or whether this leads to a conflict of 
interests within the meaning of the second sentence of Article 38(6) of the GDPR. 
If a conflict of interests were to exist under EU law, this would impact the 
assessment of whether there was good cause to dismiss the applicant. 
The first question referred 
12 National law affords a greater degree of protection against dismissal than EU law. 
A dismissal may take place only for good cause. 
13 Opinion differs as to whether the GDPR allows Member States to make the 
dismissal of the data protection officer subject to further conditions. Some argue 
that the protection against dismissal afforded by Paragraph 38(2) in conjunction 
with the first sentence of Paragraph 6(4) of the BDSG is equivalent to substantive 
provisions of employment law, because, in the case of internal data protection 
officers, the dismissal is generally accompanied by a change to the employment 
contract. Pursuant to Article 153 TFEU, substantive provisions of employment 
law are not within the legislative power of the European Union, meaning that 
there is no incompatibility with the second sentence of Article 38(3) of the GDPR. 
The opposing viewpoint assumes that the greater degree of protection against 
dismissal under national law would be contrary to EU law with regard to non-
public bodies, in so far as it concerns data protection officers whose designation is 
mandatory pursuant to Article 37(1) of the GDPR. 
X-FAB DRESDEN 
 
5 
The second question referred 
14 If the first question is answered in the affirmative, the referring court would like to 
ascertain whether EU law must be interpreted to the effect that the second 
sentence of Article 38(3) of the GDPR takes priority only with regard to data 
protection officers whose designation is mandatory under EU law, as that 
provision can be regarded as exhaustive only in that respect. 
15 Article 37(1) of the GDPR and Article 38(1) of the BDSG set out different 
conditions under which the designation of a data protection officer is mandatory. 
Thus, the protection against dismissal under Paragraph 38(2) in conjunction with 
the first sentence of Paragraph 6(4) of the BDSG could continue to apply to data 
protection officers whose designation is mandatory only under national law, in 
addition to the provision set out in the second sentence of Article 38(3) of the 
GDPR. 
16 It must also be clarified how the second part of the first sentence of Article 37(4) 
of the GDPR (‘where required by Union or Member State law, shall designate a 
data protection officer’) is to be understood in this context. The wording allows an 
interpretation to the effect that where the designation of a data protection officer is 
mandatory under the law of a Member State, such designation is also mandatory 
pursuant to the GDPR. If the second part of the first sentence of Article 37(4) of 
the GDPR were to be interpreted in this manner (in the event that the first question 
referred is answered in the affirmative), the protection against dismissal afforded 
under national law would be inadmissible, even if the designation of the data 
protection officer were mandatory not under Article 37(1) of the GDPR, but only 
under national law. 
The third question referred 
17 If the first question referred is answered in the affirmative, the referring court 
wishes to ascertain whether the second sentence of Article 38(3) of the GDPR has 
sufficient legal basis, particularly in so far as it concerns data protection officers 
who have an employment relationship with the controller. 
18 The GDPR is enacted on the basis of Article 16 TFEU in particular. The referring 
court understands that EU rules on the processing of data by private individuals 
could only be enacted on the basis of the principle of the ‘free movement of 
[personal] data’ referred to in the final part of the first sentence of Article 16(2) 
TFEU. 
19 On the other hand, the legal basis enabling the approximation of laws in the 
internal market pursuant to Article 114(1) TFEU could be relevant. However, 
recourse to Article 114(1) TFEU to provide such legal basis could be precluded, 
with regard to the second sentence of Article 38(3) of the GDPR, by the provision 
contained in Article 114(2) TFEU. This is because Article 114(1) TFEU does not 
apply, inter alia, to provisions relating to employed persons’ rights and interests. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-453/21 
 
6  
However, this would be no obstacle if the GDPR did not contain any specific 
intention as regards employed persons’ rights, but merely automatic 
consequences, including as regards the legal position of employees. 
The fourth question referred 
20 If the first question referred is answered in the negative, it must be clarified 
whether there is a conflict of interests within the meaning of the second sentence 
of Article 38(6) of the GDPR if the data protection officer also holds the office of 
chairman of the works council established at the controlling body. If an 
incompatibility between the function of the data protection officer and the office 
of the chairman of the works council were to exist under EU law, there would also 
be good cause under Paragraph 38(2) in conjunction with the first sentence of 
Paragraph 6(4) of the BDSG justifying dismissal of the data protection officer. 
21 Pursuant to Article 37(5) of the GDPR, the data protection officer is designated on 
the basis of professional qualification and, in particular, expert knowledge of data 
protection law and practices and the ability to fulfil the tasks of the data protection 
officer. Pursuant to Article 38(6) of the GDPR, it is possible in principle for the 
data protection officer to fulfil other tasks. However, it is vital to ensure that there 
are no conflicts of interests. In particular, a conflict of interests must be assumed 
to exist if the data protection officer were required to monitor himself or herself 
(as part of his or her other duties) or if the independence of the data protection 
officer were compromised. 
22 The question whether the office of data protection officer is compatible with that 
of a member or chairman of a works council is the subject of differing views 
under national law. 
23 The case-law of the Bundesarbeitsgericht (Federal Labour Court) has so far 
assumed that there is no fundamental incompatibility between the two functions. 
The fact that the company data protection officer has monitoring and supervisory 
powers vis-à-vis the employer does not generally mean that a member of the 
works council is unfit for such a remit. The employer’s legal status is not unduly 
prejudiced by the fact that it is faced with a data protection officer who 
simultaneously exercises the rights of the works council under the BetrVG. 
24 The referring court takes the view that this assessment cannot be altered by the 
fact that, in the present case, the data protection officer is not just a ‘simple’ 
member of the works council, but rather the chairman. The chairman of the works 
council is first and foremost a member of that works council, just like the other 
members of that body. The power of representation granted to the chairman of the 
works council by the first sentence of Paragraph 26(2) of the BetrVG only applies 
to resolutions adopted by that works council. The referring court thus considers 
that the office of chairman of the works council does not have an increased 
potential for conflicts of interest compared to ‘simple’ members of the works 
council. 
X-FAB DRESDEN 
 
7 
25 The contrary view, which is expressed in the legal literature, does acknowledge 
the risk of a conflict of interests. According to that view, there is a conceptual risk 
that the member of the works council may, as a result of his or her dual role, be 
prepared to compromise on data protection in order to achieve other objectives or 
will focus unduly on protecting employed persons’ data to the detriment of the 
other activities of a data protection officer. It is further claimed that a conflict of 
interests may result from the fact that the data protection officer must also 
exercise his or her supervisory and monitoring powers vis-à-vis the works council. 
26 If the data protection officer were granted supervisory and monitoring powers vis-
à-vis the works council in principle, it would need to be clarified whether that fact 
alone results in a conflict of interests precluding the dual function. 
27 The referring court takes the view that any handling of personal data within the 
context of other activities does not preclude a person holding the office of data 
protection officer. On the contrary, a conflict of interests presupposes an increased 
level of responsibility for data processing operations. The data protection officer 
cannot hold a position within an organisation that has as its purpose the 
determination of the purposes and the means of the processing of personal data 
(see Article 29 Data Protection Working Party WP 243, p. 19). 
28 It must be clarified whether that assessment is transferable to the activity of the 
works council, that is to say not whether the mere mandate of the works council 
and the corresponding handling of personal data, the purpose of which is 
determined by the BetrVG, are on their own sufficient to assume the existence of 
a conflict of interests precluding designation as data protection officer, but rather 
whether the person in question must have been assigned a particular function 
within the works council. By way of example, incompatibility with the position 
and function of the data protection officer could be assumed only if the data 
protection officer were also the member of the works council responsible for 
processing the works council’s electronic data, meaning that he or she would have 
to monitor himself or herself in that regard.