Case C-453/21, X-FAB Dresden: Judgment of the Court (Sixth Chamber) of 9 February 2023 (request for a preliminary ruling from the Bundesarbeitsgericht — Germany) — X-FAB Dresden GmbH & Co. KG v FC (Reference for a preliminary ruling — Protection of natural persons with regard to the processing of personal data — Regulation (EU) 2016/679 — Article 38(3) — Data protection officer — Prohibition on dismissing data protection officer for performing his or her tasks — Requirement for functional independence — National legislation prohibiting the dismissal of a data protection officer without just cause — Article 38(6) — Conflict of interests — Criteria)
Date: 2023-02-09
Institutions: Court of Justice
Subjects: conflict of interest, data protection, data-processing law, dismissal, employer, labour relations, personal data








C_2023112EN.01000401.xml










27.3.2023   


EN


Official Journal of the European Union


C 112/4






Judgment of the Court (Sixth Chamber) of 9 February 2023 (request for a preliminary ruling from the Bundesarbeitsgericht — Germany) — X-FAB Dresden GmbH & Co. KG v FC
(Case C-453/21, (1) X-FAB Dresden)
(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Regulation (EU) 2016/679 - Article 38(3) - Data protection officer - Prohibition on dismissing data protection officer for performing his or her tasks - Requirement for functional independence - National legislation prohibiting the dismissal of a data protection officer without just cause - Article 38(6) - Conflict of interests - Criteria)
(2023/C 112/04)
Language of the case: German

Referring court

Bundesarbeitsgericht

Parties to the main proceedings


Applicant: X-FAB Dresden GmbH & Co. KG

Defendant: FC

Operative part of the judgment







1.


The second sentence of Article 38(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as not precluding national legislation which provides that a controller or a processor may dismiss a data protection officer who is a member of staff of that controller or processor solely where there is just cause, even if the dismissal is not related to the performance of that officer’s tasks, in so far as such legislation does not undermine the achievement of the objectives of that regulation.










2.


Article 38(6) of Regulation 2016/679 must be interpreted as meaning that a ‘conflict of interests’, as provided for in that provision, may exist where a data protection officer is entrusted with other tasks or duties, which would result in him or her determining the objectives and methods of processing personal data on the part of the controller or its processor, which is a matter for the national court to determine, case by case, on the basis of an assessment of all the relevant circumstances, in particular the organisational structure of the controller or its processor and in the light of all the applicable rules, including any policies of the controller or its processor.






(1)  OJ C 490, 6.12.2021.