Judgment — ECLI:EU:C:2023:81
Date: 2023-02-09
Language of the case: German
Court formation: Sixth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Translation C-560/21 – 1 
Case C-560/21 
Request for a preliminary ruling 
Date lodged: 
13 September 2021 
Referring court: 
Bundesarbeitsgericht (Germany) 
Date of the decision to refer: 
27 April 2021 
Applicant, appellant in the first appeal and appellant on a point of law: 
ZS 
Defendant, respondent in the first appeal and respondent in the appeal on a 
point of law: 
Zweckverband ‘Kommunale Informationsverarbeitung Sachsen’ 
KISA, a body governed by public law 
  
BUNDESARBEITSGERICHT (Federal Labour Court) 
[…] 
ORDER 
[…] 
In the case of 
ZS 
applicant, appellant in the first appeal and appellant on a point of law, 
[…] 
v 
Zweckverband (municipal association) ‘Kommunale Informationsverarbeitung 
Sachsen’ KISA, a body governed by public law 
EN 
REQUEST FOR A PRELIMINARY RULING OF 27. 4. 2021 – CASE C-560/21 
 
2  
defendant, respondent in the first appeal and respondent in the appeal on a 
point of law, 
the Ninth Chamber of the Federal Labour Court […] makes the following order: 
I. The following questions are referred to the Court of Justice of the European 
Union for a preliminary ruling pursuant to Article 267 of the Treaty on the 
Functioning of the European Union (TFEU): 
1. Is the second sentence of Article 38(3) of Regulation (EU) 2016/679 
(the General Data Protection Regulation; ‘the GDPR’) to be 
interpreted as precluding a provision of national law, such as, in the 
present case, the first sentence of Paragraph 6(4) of the 
Bundesdatenschutzgesetz (Federal Law on data protection), which 
makes dismissal of the data protection officer by the controller, who is 
his or her employer, subject to the conditions set out therein, 
irrespective of whether such dismissal relates to the performance of his 
or her tasks? 
If the answer to the first question is in the affirmative: 
2. Does the second sentence of Article 38(3) of the GDPR have a 
sufficient legal basis, in particular in so far as the provision covers data 
protection officers who have an employment relationship with the 
controller? 
II. The proceedings in the appeal on a point of law are stayed pending the 
decision of the Court of Justice of the European Union on the request for a 
preliminary ruling. 
Grounds 
A. Subject matter of the main proceedings 
1 The parties are in dispute regarding the applicant’s dismissal as a data protection 
officer. 
2 Since 1 January 2002, the defendant has employed the applicant as an employee in 
the assessment department, most recently as an application consultant. As a 
service provider for municipalities, the defendant implements Federal law and is 
therefore obliged to designate a data protection officer under both Regulation 
(EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard 
to the processing of personal data and on the free movement of such data, and 
repealing Directive 95/46/EC (the General Data Protection Regulation, GDPR; 
OJ 2016 L 119, p. 1) and the Bundesdatenschutzgesetz (Federal Law on data 
protection; ‘the BDSG’). On 27 February 2004, the defendant designated the 
applicant as data protection officer. 
KISA 
 
3 
3 By letter of 15 August 2018, the defendant dismissed the applicant as data 
protection officer with effect from 31 August 2018 on the ground that his 
activities as data protection officer conflicted with his professional activities. The 
defendant submits that, in addition to the applicant’s activity as an application 
consultant, the fact that he is required to process financial data of citizens creates a 
conflict of interest with the duties incumbent on him as data protection officer. 
The applicant takes the position in law that there is no compelling reason that is 
capable of justifying his dismissal. 
4 The lower courts dismissed the applicant’s action, by which he claims that his 
dismissal as data protection officer is ineffective. By his appeal on a point of law, 
the applicant continues to pursue the objective of his action. 
B. Relevant national law 
5 The Federal Law on data protection, in the version applicable from 25 May 2018 
until 25 November 2019 (BGBl. 2017 I, p. 2097), contains, inter alia, the 
following provisions: 
‘Paragraph 6 
Position 
… 
(4) The dismissal of the data protection officer shall be permitted only by 
corresponding application of Paragraph 626 of the Bürgerliches Gesetzbuch 
(German Civil Code).’ 
6 The German Civil Code, in the version published on 2 January 2002 (BGBl. I, 
p. 42, amending p. 2909, and BGBl. 2003 I, p. 738), reads, in extract: 
‘Paragraph 134 
Statutory prohibition 
Any legal act contrary to a statutory prohibition shall be void except as 
otherwise provided by law.’ 
‘Paragraph 626 
Termination without notice for a compelling reason 
(1) The service relationship may be terminated by either party to the 
contract for a compelling reason without complying with a notice period, if 
facts are present on the basis of which the party giving notice cannot 
reasonably be expected to continue the service relationship to the end of the 
notice period or to the agreed end of the service relationship, taking all 
REQUEST FOR A PRELIMINARY RULING OF 27. 4. 2021 – CASE C-560/21 
 
4  
circumstances of the individual case into account and weighing the interests 
of both parties to the contract. 
(2) Notice of termination may only be given within two weeks. The notice 
period commences with the date on which the person entitled to give notice 
obtains knowledge of facts conclusive for the notice of termination. …’ 
C. Relevant provisions of EU law 
7 The GDPR provides, inter alia, as follows: 
‘Article 38 
Position of the data protection officer 
… 
3. The controller and processor shall ensure that the data protection 
officer does not receive any instructions regarding the exercise of those 
tasks. He or she shall not be dismissed or penalised by the controller or the 
processor for performing his [or her] tasks.’ 
D. Need for a ruling from the Court of Justice and clarification of the 
questions referred 
I. Need for a ruling from the Court of Justice of the European Union 
8 The success of the appeal on a point of law brought by the [applicant] hinges on 
the interpretation of EU law. In accordance with the first sentence of 
Paragraph 6(4) of the BDSG, the data protection officer may be dismissed only if 
Paragraph 626 of the BGB is correspondingly applied, that is to say, for a 
compelling reason. Accordingly, the provisions of the BDSG attach stricter 
requirements to the dismissal of the data protection officer than do those under EU 
law. The second sentence of Article 38(3) of the GDPR provides merely that the 
data protection officer is not to be dismissed or penalised by the controller for 
performing his or her tasks. 
9 The applicant’s appeal on a point of law would be well founded under national 
law. On the basis of the grounds set out by the Landesarbeitsgericht (Higher 
Labour Court), the dismissal could not be regarded as effective. The Higher 
Labour Court, once the case has been referred back to it by the present Chamber, 
would be required to review the dismissal of the applicant announced on 
15 August 2018 with a view to determining whether there had been a compelling 
reason for that dismissal within the meaning of the first sentence of 
Paragraph 6(4) of the BDSG, read in conjunction with Paragraph 626 of the BGB. 
KISA 
 
5 
10 The applicability of the first sentence of Paragraph 6(4) of the BDSG, read in 
conjunction with Paragraph 626 of the BGB, depends on whether a provision of a 
Member State which attaches stricter requirements to the dismissal of a data 
protection officer than those under EU law is permissible under EU law, 
particularly the second sentence of Article 38(3) of the GDPR. The present 
Chamber is unable to rule on that question without referring the matter to the 
Court of Justice under Article 267 TFEU. If the first sentence of Paragraph 6(4) 
has to be disapplied due to the primacy of EU law, the applicant’s appeal on a 
point of law would be unsuccessful, since there are no other reasons in the present 
dispute that would lead to the ineffectiveness of his dismissal. 
II. Clarification of the first question referred 
11 The Chamber is unable to determine whether the Member State’s rule in the first 
sentence of Paragraph 6(4) of the BDSG, which, in comparison with the 
provisions of EU law, restricts the possibility to dismiss a company’s data 
protection officer, is applicable alongside the provision in the second sentence of 
Article 38(3) of the GDPR. 
12 1. The national law affords a greater degree of protection against dismissal 
than does EU law. In accordance with the second sentence of Article 38(3) of the 
GDPR, the data protection officer cannot be dismissed or penalised by the 
controller for performing his or her tasks. By contrast, Paragraph 6(4) of the 
BDSG provides that a mandatorily designated data protection officer may be 
dismissed only for a compelling reason (see Paragraph 626 of the BGB), even if, 
as in the present case, the dismissal is not connected with the performance of his 
or her tasks. 
13 2. The GDPR is binding in its entirety and is directly applicable in all 
Member States (Article 99(2) of the GDPR, read in conjunction with the second 
paragraph of Article 288 TFEU). According to the case-law of the Court of 
Justice, in accordance with the principle of the precedence of EU law, provisions 
of the FEU Treaty and directly applicable measures of the institutions have the 
effect, in their relations with the internal law of the Member States, merely by 
entering into force, of rendering automatically inapplicable any conflicting 
provision of national law (CJEU, 4 February 2016, C-336/14, paragraph 52; 
14 June 2012, C-606/10, paragraph 73). The GDPR – like the directive which it 
repealed (Directive 95/46/EC of 24 October 1995 on the protection of individuals 
with regard to the processing of personal data and on the free movement of such 
data (OJ 1995 L 281, p. 31)) – is intended to ensure the free movement of personal 
data between Member States through the harmonisation of national provisions on 
the protection of individuals with regard to the processing of such data (see 
recital 9 et seq. of the GDPR; CJEU, 20 May 2003, C-465/00, C-138/01 and 
C-139/01, paragraph 39). In accordance with the case-law of the Court of Justice, 
more restrictive national provisions could also be impermissible in view of the 
complete harmonisation effected by Directive 95/46/EC (CJEU, 24 November 
2011, C-468/10 and C-469/10, paragraph 29 et seq.). 
REQUEST FOR A PRELIMINARY RULING OF 27. 4. 2021 – CASE C-560/21 
 
6  
14 3. In the national legal literature, opinion differs as to whether the GDPR 
allows Member States to attach further conditions to the dismissal of a data 
protection officer. 
15 (a) Some argue that the protection against dismissal afforded by 
Paragraph 38(2) of the BDSG, read in conjunction with the first sentence of 
Paragraph 6(4) thereof, is equivalent to substantive provisions of employment law, 
because, in the case of internal data protection officers, the dismissal is generally 
accompanied by a change to the employment contract, such that the tasks of a data 
protection officer are no longer part of the duties incumbent on him or her […]. In 
accordance with Article 153 TFEU, substantive provisions of employment law are 
not within the legislative competence of the European Union, with the result that a 
conflict with the second sentence of Article 38(3) of the GDPR can be ruled out. 
Furthermore, in the event that a legislative gap needs to be closed, the national 
legislature can rely on the saving clause in respect of employment law in 
Article 88 of the GDPR […]. According to the travaux préparatoires for the 
recast version of the BDSG, the German legislature also proceeded on the 
assumption that Paragraph 6(4) of the BDSG concerns a provision of employment 
law that can be retained in addition to the requirements of the GDPR, in keeping 
with the situation under national law that applied up to 24 May 2018 […]. 
16 (b) By contrast, other opinions expressed in the legal literature point to the 
function of the protection against dismissal which is not employment-law related 
in nature, but is motivated by data-protection law […]. Were this view to be 
followed, a national provision such as Paragraph 6(4) of the BDSG, which 
attaches stricter requirements to dismissal than those under EU law on data 
protection, would be impermissible. 
III. Clarification of the second question referred 
17 If the first question referred is answered in the affirmative, the present Chamber 
wishes to ascertain whether the second sentence of Article 38(3) of the GDPR has 
a sufficient legal basis, particularly in so far as it concerns data protection officers 
who have an employment relationship with the controller. Were it not to have a 
legal basis, the second sentence of Article 38(3) of the GDPR would not preclude 
the national rule in Paragraph 6(4) of the BDSG and the applicant’s appeal on a 
point of law would be successful. 
18 1. In accordance with Article 5(1) and (2) TEU, the European Union is 
subject to the principle of conferral. That principle is fleshed out by Article 2 et 
seq. TFEU. According to Article 5(2) TEU, the European Union is to act only 
within the limits of the competences conferred upon it by the Member States in 
the Treaties to attain the objectives set out therein. 
19 (a) The GDPR was enacted on the basis of Article 16 TFEU in particular (see 
the preamble and recital 12 of the GDPR). However, the wording of the first 
sentence of Article 16(2) TFEU has been understood in some areas of the national 
KISA 
 
7 
legal literature to mean that the legislative competence conferred on the European 
Union by the Treaties is confined only to data protection in cases where data are 
processed by EU institutions, data processing by public bodies when 
implementing EU law, and cross-border data processing […]. The Court of 
Justice’s case-law on Directive 95/46/EC and Article 100a TEC to date has not 
adopted such a narrow understanding (see CJEU, 20 May 2003, C-465/00, 
C-138/01 and C-139/01, paragraph 39 et seq.). 
20 (b) On the other hand, the legal basis for approximating laws in the internal 
market as provided for in Article 114(1) TFEU might be the decisive factor (with 
regard to Directive 95/46/EC and Article 100a TEC, see CJEU, 20 May 2003, 
C-465/00, C-138/01 and C-139/01, paragraph 39 et seq.). However, with regard 
to the second sentence of Article 38(3) of the GDPR and Article 114(2) TFEU, 
that possibility might be precluded by the fact that Article 114(1) TFEU does not 
apply to, inter alia, provisions relating to the rights and interests of employed 
persons. That would be no obstacle if the GDPR did not contain any specific 
intention as regards workers’ rights, but instead only regulated transversal subject 
matter entailing merely automatic consequences on the legal position of 
employees […]. 
21 2. Although the present Chamber does not share the reservations relating to 
the validity of the GDPR that are expressed in the national literature and outlined 
below, it asks the Court of Justice to address them for the purpose of clarifying the 
legal situation under EU law and for reasons of legal clarity. 
22 (a) Some legal commentators take the view that there has been an 
infringement of the principle of subsidiarity under EU law (first subparagraph of 
Article 5(3) TEU) […]. In line with that viewpoint, in a decision of 30 March 
2012 (BR‑ Drucksache (Bundesrat document) 52/12 [decision]), the German 
Bundesrat (Upper Chamber of the Parliament) raised a subsidiarity-related 
objection to the original proposal for the GDPR, on the basis of Article 12(b) 
TEU, read in conjunction with Article 6 of the Protocol on the application of the 
principles of subsidiarity and proportionality of 13 December 2007 (OJ 2007 
C 306, p. 150). 
23 (b) Lastly, in a few isolated instances in the national legal literature, the GDPR 
is considered to be invalid on the ground that it infringes the principle of 
proportionality under the first subparagraph of Article 5(4) TEU […]. 
24 E. […] [matters relating to the national proceedings] 
[…]