Judgment;Abstract — ECLI:EU:C:2022:495
Date: 2022-06-22
Language of the case: German
Court formation: First Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Translation C-534/20 – 1 
Case C-534/20 
Request for a preliminary ruling 
Date lodged: 
21 October 2020 
Referring court or tribunal: 
Bundesarbeitsgericht (Germany) 
Date of the decision to refer: 
30 July 2020 
Defendant, counter-applicant, appellant and appellant in the appeal on a 
point of law: 
Leistritz AG 
Applicant, counter-defendant, respondent and respondent in the appeal on a 
point of law: 
LH 
  
BUNDESARBEITSGERICHT (Federal Labour Court) 
[…] 
ORDER 
[…] 
In the cases of 
1. LEISTRITZ AG 
First-name defendant, counter-applicant, first-named appellant and 
appellant in the appeal on a point of law, 
2. to 5. … […] 
v 
EN 
REQUEST FOR A PRELIMINARY RULING OF 30. 7. 2020 – CASE C-534/20 
 
2  
LH 
Applicant, counter-defendant, respondent and respondent in the appeal on a 
point of law, 
the Second Chamber of the Federal Labour Court, further to the hearing of 30 July 
2020 […], orders as follows: [Or. 2]  
I. The Court of Justice of the European Union shall be asked to provide 
an answer to the following questions pursuant to Article 267 of the 
Treaty on the Functioning of the European Union (TFEU): 
1. Is the second sentence of Article 38(3) of Regulation (EU) 
No 2016/679 (General Data Protection Regulation; GDPR) to be 
interpreted as precluding a provision in national law, such as 
Paragraph 38(1) and (2) in conjunction with the second sentence 
of Paragraph 6(4) of the Bundesdatenschutzgesetz (Federal Law 
on data protection; ‘the BDSG’), which declares ordinary 
termination of the employment contract of the data protection 
officer by the data controller, who is his employer, to be 
impermissible, irrespective of whether his contract is terminated 
for performing his tasks? 
If the first question is answered in the affirmative: 
2. Does the second sentence of Article 38(3) GDPR also preclude 
such a provision in national law if the designation of the data 
protection officer is not mandatory in accordance with 
Article 37(1) GDPR, but is mandatory only in accordance with 
the law of the Member State? 
If the first question is answered in the affirmative: 
3. Is the second sentence of Article 38(3) GDPR based on a 
sufficient enabling clause, in particular in so far as this covers 
data protection officers that are party to an employment contract 
with the data controller? 
II. The proceedings in the appeal on a point of law are stayed pending the 
decision of the Court of Justice of the European Union on the request 
for a preliminary ruling. 
Grounds 
A. Subject matter of the main proceedings  
The parties are most recently still in dispute over the validity of the ordinary 
termination of the employment contract that they are party to. 
LEISTRITZ 
 
3 
The applicant worked for the first-named defendant (‘the defendant’) since 
15 January 2018 as the ‘legal team leader’. With a letter dated this day [Or. 3], the 
defendant also designated the applicant as the company data protection officer 
with effect from 1 February 2018. The defendant, a company organised under 
private law, employs over 50 people and was required to designate a data 
protection officer in accordance with the BDSG in the version applicable from 
1 September 2009 until 24 May 2018 (old version) and also in accordance with 
the first sentence of Paragraph 38(1) BDSG in the version applicable from 25 May 
2018 until 25 November 2019. 
The defendant terminated the employment contract ordinarily on 15 August 2018 
by a letter dated 13 July 2018. To validate the termination, it invoked a 
restructuring measure that it says resulted in the redundancy of the applicant. With 
its action, the applicant filed a claim of invalidity of the termination in good time. 
The lower courts upheld the claim. The applicant claims that ordinary termination 
is therefore already proved to be invalid since the applicant, as the data protection 
officer, can only have his employment terminated extraordinarily for a compelling 
reason in accordance with Paragraph 38(2) in conjunction with the second 
sentence of Paragraph 6(4) BDSG. Furthermore, the restructuring measure 
described by the defendant also does not constitute a compelling reason for 
extraordinary termination. The defendant has opposed this by way of the appeal 
on a point of law. 
B. Relevant national law 
I. Federal Data Protection Act in the version applicable from 25 May 2018 
until 25 November 2019 (Bundesgesetzblatt (Federal Law Gazette; BGBl.) 2017 I 
p. 2097). 
1. ‘Paragraph 6 
Position 
[…] 
(4) The dismissal of the data protection officer shall be permitted only 
by applying Paragraph 626 of the Bürgerliches Gesetzbuch (German 
Civil Code) accordingly. The data protection officer’s employment 
shall not be terminated unless there are facts that give the public body 
just cause to terminate without notice. The data protection officer’s 
employment shall not be [Or. 4] terminated for one year after the 
activity as the data protection officer has ended, unless the public body 
has just cause to terminate without notice.’ 
2. ‘Paragraph 38 
Data protection officers of private bodies 
REQUEST FOR A PRELIMINARY RULING OF 30. 7. 2020 – CASE C-534/20 
 
4  
(1) In addition to Article 37(1)(b) and (c) of Regulation (EU) 
2016/679, the controller and processor shall designate a data protection 
officer if they generally continuously employ at least ten persons 
dealing with the automated processing of personal data. If the 
controller or processor undertake processing subject to a data 
protection impact assessment pursuant to Article 35 of Regulation 
(EU) 2016/679, or if they commercially process personal data for the 
purpose of transfer, of anonymised transfer or for purposes of market 
or opinion research, they shall designate a data protection officer 
regardless of the number of persons employed in processing. 
(2) Paragraph 6(4), (5) second sentence, and (6) shall apply; 
however, Paragraph 6(4) shall apply only if designating a data 
protection officer is mandatory.’ 
In the first sentence of Paragraph 38(1) BDSG in the version applicable since 
26 November 2019, the number of employees has been increased from ‘ten’ to 
‘20’. 
II. German Civil Code (BGB) in the version published on 2 January 2002 
(Federal Law Gazette I p. 42, amending p. 2909 and Federal Law Gazette 2003 I 
p. 738): 
1. ‘Paragraph 134 
Statutory prohibition 
Any legal act contrary to a statutory prohibition shall be void except as 
otherwise provided by law.’[Or. 5] 
2. ‘Paragraph 626 
Termination without notice for a compelling reason 
(1) The service relationship may be terminated by either party to the 
contract for a compelling reason without complying with a notice 
period, if facts are present on the basis of which the party giving notice 
cannot reasonably be expected to continue the service relationship to 
the end of the notice period or to the agreed end of the service 
relationship, taking all circumstances of the individual case into 
account and weighing the interests of both parties to the contract. 
(2) Notice of termination may only be given within two weeks. The 
notice period commences with the date on which the person entitled to 
give notice obtains knowledge of facts conclusive for the notice of 
termination. […]’ 
LEISTRITZ 
 
5 
III. Kündigungsschutzgesetz (Law on protection against termination of contract; 
‘the KSchG’) in the version promulgated on 25 August 1969 (Federal Law 
Gazette I, p. 1317), last amended by Article 4 of the Law of 17 July 2017 (Federal 
Law Gazette I, p. 2509): 
‘Paragraph 1 
termination of contracts without social justification 
(1) The termination of an employee's employment contract where the 
employment contract has continued for more than six months without 
interruption with the same business or undertaking shall be void where 
it lacks social justification. 
(2) Termination of contract lacks social justification where it is not 
based on reasons connected with the character or conduct of the 
employee or on serious constraints affecting the company that make it 
impossible to retain the employee’s post in that company. […]’ 
C. Relevant provisions of EU law 
Regulation (EU) No 2016/679 of 27 April 2016 on the protection of natural 
persons with regard to the processing of personal data and on the free movement 
of such data, [Or. 6] and repealing Directive 95/46/EC (General Data Protection 
Regulation, GDPR; OJ 2016 L 119, p. 1). 
1. ‘Article 37 
Designation of the data protection officer 
[…] 
4. In cases other than those referred to in paragraph 1, the controller 
or processor or associations and other bodies representing categories of 
controllers or processors may or, where required by Union or Member 
State law shall, designate a data protection officer […].’ 
2. ‘Article 38 
Position of the data protection officer 
3. The controller and processor shall ensure that the data protection 
officer does not receive any instructions regarding the exercise of those 
tasks. He or she shall not be dismissed or penalised by the controller or 
the processor for performing his tasks. […]’ 
3. ‘Article 88 
REQUEST FOR A PRELIMINARY RULING OF 30. 7. 2020 – CASE C-534/20 
 
6  
Processing in the context of employment 
1. Member States may, by law or by collective agreements, provide 
for more specific rules to ensure the protection of the rights and 
freedoms in respect of the processing of employees’ personal data in 
the employment context, in particular for the purposes of the 
recruitment, the performance of the contract of employment, including 
discharge of obligations laid down by law or by collective agreements, 
management, planning and organisation of work, equality and diversity 
in the workplace, health and safety at work, protection of employer’s 
or customer’s property and for the purposes of the exercise and 
enjoyment, on an [Or. 7] individual or collective basis, of rights and 
benefits related to employment, and for the purpose of the termination 
of the employment relationship. 
[…]’ 
D. Necessity for a ruling from the Court of Justice and discussion of the 
questions referred 
I. Necessity for a ruling from the Court of Justice 
1. In accordance with national law, the termination of 13 July 2018 would be 
invalid under Paragraph 38(2) in conjunction with the second sentence of 
Paragraph 6(4) BDSG and Paragraph 134 BGB and there would be no grounds for 
the defendant’s appeal. The extraordinary termination of the employment contract 
of an employee who is simultaneously the designated data protection officer can 
only be valid if a compelling reason exists in accordance with Paragraph 626 
BGB. The defendant only carried out ordinary termination, however.  
2. According to the Chamber’s understanding, the applicability of 
Paragraph 38(2) in conjunction with the second sentence of Paragraph 6(4) 
depends on whether a provision of a Member State, which attaches stricter 
requirements to the termination of a data protection officer’s employment contract 
than those under EU law, is permissible under EU law, particularly the second 
sentence of Article 38(3) GDPR. The Chamber is unable to rule on the matter 
without requesting a ruling from the Court of Justice under Article 267 TFEU. On 
the other hand, if Paragraph 38(1) and (2) in conjunction with the second sentence 
of Paragraph 6(4) BDSG must be disapplied due to the primacy of EU law 
(second sentence of Article 38(3) GDPR in particular), the defendant’s appeal 
would be successful. With the grounds stated by the Landesarbeitsgericht (Higher 
Labour Court), it was unable to regard the termination as invalid.  
LEISTRITZ 
 
7 
II. Explanation of the first question referred  
1. The Chamber is unable to assess unequivocally whether the Member State’s 
rules that place a restriction on the ability to terminate the employment contract of 
a company data protection officer [Or. 8] compared with EU rules are applicable 
alongside the rule in the second sentence of Article 38(3) GDPR. 
2. In accordance with the second sentence of Article 38(3) GDPR, the data 
protection officer cannot be dismissed or penalised by the data controller for 
performing his tasks (the Chamber understands ‘dismissed’ to refer to a 
prohibition of termination). In contrast, Paragraph 38(1) and (2) in conjunction 
with Paragraph 6(4) BDSG provides that a mandatorily designated data protection 
officer may only be dismissed for a compelling reason (see Paragraph 626 BGB) 
and his employment contract may likewise only be terminated for a compelling 
reason, even if the dismissal or termination, as in the present case, is not 
connected with performance of his tasks. Where a mandatorily designated data 
protection officer is simultaneously employed to work for the data controller or 
processor, national law also provides for protection against termination, as well as 
protection against dismissal, in that employment relationship. Such protection 
continues to exist for one year after the date of any dismissal, and applies 
independently of whether or not the designation of a data protection officer is 
mandatory in accordance with Article 37(1) GDPR and the employee has acquired 
general protection from termination under national law (Paragraph 1(1) KSchG). 
The Chamber also points out that no compelling reason for dismissal is deemed to 
exist under national law where data protection in a company is supposedly 
guaranteed in the future by an external data protection officer as the result of a 
reorganisation […] [national case-law]. 
3. The GDPR is binding in its entirety and is directly applicable in all Member 
States (Article 99(2) GDPR in conjunction with Article 288(2) TFEU). According 
to the case-law of the Court of Justice, in accordance with the principle of the 
primacy of EU law, provisions of the Treaty on the Functioning of the European 
Union and directly applicable measures of the institutions have the effect, in their 
relations with the internal law of the Member States, merely by entering into 
force, of rendering automatically inapplicable any conflicting provision of 
national law [Or. 9] (judgments of 14 June 2012, ANAFE, C-606/10, 
EU:C:2012:348, paragraph 73, of 4 February 2016, Ince, C-336/14, 
EU:C:2016:72, paragraph 52). The intention of the GDPR is the same as the 
Directive it repealed (Directive 95/46/EC of 24 October 1995 on the protection of 
individuals with regard to the processing of personal data and on the free 
movement of such data (OJ 1995 L 281, p. 31)), namely to ensure the free 
movement of personal data between Member States through the harmonisation of 
national provisions on the protection of individuals with regard to the processing 
of such data (see recital 9 et seq. GDPR, and judgment of 20 May 2003, 
Österreichischer Rundfunk and Others, C-465/00, EU:C:2003:294, paragraph 39). 
In accordance with the case-law of the Court, more restrictive national provisions 
could also be impermissible in view of the complete harmonisation effected by 
REQUEST FOR A PRELIMINARY RULING OF 30. 7. 2020 – CASE C-534/20 
 
8  
Directive 95/46/EC (judgment of 24 November 2011, ASNEF, C-468/10 and 
C-469/10, EU:C:2011:777, paragraph 29 et seq.). 
4. The legal position of EU law has been assessed in different ways in the 
national literature. 
a) The predominantly held view is that the special protection from termination 
of contract under Paragraph 38(2) in conjunction with the second and third 
sentences of Paragraph 6(4) BDSG concerns substantive employment-law 
provisions in relation to which the EU has no legislative competence in 
accordance with Article 153 TFEU, which rules out a conflict with the second 
sentence of Article 38(3) GDPR. Furthermore, the national legislature is supported 
by the opening clause of Article 88 GDPR relating to employment law in the 
event that any legislative gap needs to be closed […] [citation of legal literature]. 
According to the materials accompanying the new version of the BDSG, the 
German legislature obviously also assumed that Paragraph 6(4) BDSG concerns 
an employment-law provision that can be retained in addition to the requirements 
of the GDPR in keeping with the situation under national law that applied up to 
24 May 2018 […][citation of sources]. 
b) The opposing view assumes that the connection between protection from 
termination under employment law and the data protection officer’s position is 
unlawful under EU law with regard to private bodies, certainly in so far as it [Or. 
10] concerns a data protection officer to be mandatorily designated in accordance 
with Article 37(1) GDPR. Keeping a data protection officer employed 
permanently once designated would give rise to economic pressure […] [citation 
of legal literature]. The question is also raised as to whether the special protection 
from termination of contract for an internal data protection officer even falls under 
the scope of Article 88(1) GDPR at all. 
III. Explanation of the second question referred 
1. If the first question referred is answered in the affirmative, the Chamber 
wishes to know whether EU law, particularly the second sentence of Article 38(3) 
GDPR, then precludes any further protection from termination under national law, 
if the designation of a data protection officer is only mandatory in accordance 
with the law of the Member State, but is not mandatory in accordance with 
Article 37(1) GDPR. 
2. It could be possible to interpret EU law in such a way that any primacy of 
the second sentence of Article 38(2) GDPR only exists in relation to data 
protection officers designated mandatorily in accordance with EU law, since the 
rule could only be regarded as complete to that extent. The conditions under 
which the designation of a data protection officer is mandatory are provided for in 
different ways in Article 37(1) GDPR and in Paragraph 38(1) BDSG and do not 
correspond. In the main proceedings to date, the lower court only established that 
the applicant was designated mandatorily as a data protection officer in 
LEISTRITZ 
 
9 
accordance with Paragraph 38(1) BDSG. Determining whether or not such a 
requirement also existed in accordance with Article 37(1) GDPR may require 
further findings. 
3. Clarification is also required regarding how to understand the second semi-
clause of the first sentence of Article 37(4) GDPR. In any case, the wording of the 
standard allows for the interpretation that a data protection officer who is 
mandatorily designated in accordance with the law of a Member State is therefore 
also mandatorily designated in the sense of the GDPR. According to the provision 
in EU law, the controllers ‘shall’ [Or. 11] designate a data protection officer, 
where required by the law of the Member State. If the second semi-clause of the 
first sentence of Article 37(4) GDPR is to be interpreted in this way, protection 
from termination as it exists under national law would be impermissible, in so far 
as the first question referred is answered in the affirmative, even if the designation 
of the data protection officer is only mandatory under national law, but not 
mandatory in accordance with Article 37(1) GDPR. 
IV. Explanation of the third question referred 
1. If the first question referred is answered in the affirmative, the Chamber 
wishes to know whether the second sentence of Article 38(3) GDPR is based on a 
sufficient enabling provision, particularly in so far as it covers data protection 
officers who have an employment relationship with the data controller, or whether 
there are obstacles to its validity due to the absence of such an enabling provision. 
2. The European Union is subject to the principle of conferral in accordance 
with Article 5(1) and (2) of the Treaty on European Union. This is specified in 
greater detail by Article 2 et seq. TFEU. In accordance with this Article, the 
European Union is to act only within the limits of the competences conferred upon 
it by the Member States in the Treaties to attain the objectives set out therein. 
a) The enactment of the GDPR is based on Article 16 TFEU in particular (see the 
preamble and recital 12 of the GDPR). According to the Chamber’s 
understanding, provisions in EU law concerning data processing by private 
individuals could only be enacted on the basis of the term ‘free movement of 
[such] data’ in the last semi-clause of the first sentence of Article 16(2) TFEU. 
However, the wording of the first sentence of Article 16(2) TFEU has been 
understood in some of the national literature to mean that the powers to legislate 
that were granted to the EU in the Treaty are only restricted to data protection 
where data is processed by Union institutions, data processing by public bodies 
when implementing Union law, and cross-border data processing […] [citation of 
legal literature]. The previous case-law of the Court of Justice [Or. 12] on 
Directive 95/46/EC and Article 100a TEC did not adopt such a narrow 
understanding (see judgment of 20 May 2003, Österreichischer Rundfunk and 
Others, C-465/00, EU:C:2003:294, paragraph 39 et seq.).  
REQUEST FOR A PRELIMINARY RULING OF 30. 7. 2020 – CASE C-534/20 
 
10  
b) On the other hand, the enabling clause on approximation of laws in the internal 
market in accordance with Article 114(1) TFEU could be the determining factor 
(on Directive 95/46/EC and Article 100a TEC, see judgment of 20 May 2003, 
Österreichischer Rundfunk and Others, C-465/00, EU:C:2003:294, paragraph 39 
et seq.). However, recourse to Article 114(1) TFEU as the basis for competence in 
relation to the second sentence of Article 38(3) GDPR could be prevented by 
Article 114(2) TFEU, in accordance with which Paragraph 1, among others, does 
not apply to provisions relating to the rights and interests of employed persons. 
This would not form any obstacle if the GDPR did not contain any specific 
reference to a target group in relation to workers’ rights, but instead only a 
provision on an interdisciplinary matter with mere unintended side effects on the 
legal position of employees […] [citation of legal literature]. 
3. Even though the Chamber does not share the reservations expressed in the 
national literature and below in relation to the validity of the GDPR, it asks the 
Court of Justice to examine these for the purpose of clarifying the legal status of 
EU law and for reasons of legal certainty. 
a) Some of the literature assumes a breach of the subsidiarity principle of EU 
law (first subparagraph of Article 5(3) TEU) […] [reference to legal literature]. In 
keeping with this viewpoint, the German Bundesrat (Upper House of Parliament), 
in a decision dated 30 March 2012 […] [reference], raised a subsidiarity-related 
objection to the original draft of the GDPR under Article 12(b) TEU in 
conjunction with Article 6 of the Protocol on the application of the principles of 
subsidiarity and proportionality of 13 December 2007 (OJ 2007 C 306, p. 150). 
b) Lastly, the GDPR is considered in some isolated cases in the national 
literature to be invalid on the grounds of a breach of the principle of 
proportionality in the first subparagraph of Article 5(4) TEU […] [citation of legal 
literature]. [Or. 13]  
[…] 
[…] [Stay of proceedings]  
[…] [Signatures]