An unnecessary data transfer within a corporate group can give rise to both a claim for injunctive relief and a claim for damages against the employer, so ruled the Higher Labour Court (Landesarbeitsgericht, LAG) Hamm (Case No.: 17 Sa 1185/20).
The facts
The initial scenario for the legal dispute decided by the Higher Labour Court of Hamm was the transfer of plaintiff´s personal data by her employer, the defendant. The plaintiff had been working in a clinic of the defendant, a hospital operator, since 1 October 2018. The employment contract agreed between the parties stipulated that the plaintiff’s personal data could only be processed for the purposes of the employment relationship.
However, the defendant transferred the plaintiff´s personal data to another company, a so-called service company, within the group of companies, the hospital group, which owned the defendant. This service company was responsible for organising the management and personnel controlling of the hospital group, yet it was neither a personnel administration body nor was the personnel department located there. Instead, the defendant had its own personnel department.
Based on a query by the service company in the context of an “association-wide personnel management”, the defendant provided the service company with an overview of the employees with a gross annual salary of more than EUR 80,000. The intention of the survey was to make the remuneration practice for non-tariff employees with high salaries uniform and consistent throughout the hospital group. The data set transmitted included the salary data, the personnel number, the surname and first name, the group company where she works in the hospital and also the plaintiff’s private address.
The plaintiff brought an action against this before the Bochum Regional Court and requested the deletion of the transmitted data, as well as payment of damages for the non-material damage suffered pursuant to Art. 82 (1) of the GDPR.
In addition, the plaintiff filed another lawsuit against her employer at the Herne Labour Court (Case No.: 1 Ca 982/19). Here, the plaintiff demanded that the defendant refrain from disclosing her personal data to the service company and compensation for the non-material damage suffered.
Current judgements on the GDPR
Read our regular reviews of data protection law rulings to stay up to date!
Two judgements and appeal proceedings
Deletion and compensation
On 12 February 2020, the Bochum Regional Court granted the plaintiff’s request for cancellation and ordered the service company and the defendant jointly and severally to pay damages in the amount of EUR 8,000.
The court of appeal (OLG Hamm, judgement of 31 August 2021, Case No.: I-9 U 56/20) changed the amount of the claim for damages to EUR 4,000 and ordered the service company to pay alone.
Injunction and non-material damages
The Herne Labour Court ordered the defendant to cease and desist (it granted an injunction) and to pay damages in the amount of EUR 2,000 (judgement of 15 July 2020, Case No.: 1 Ca 982/19).
The Higher Labour Court (LAG) Hamm dismissed the defendant’s appeal and the plaintiff’s cross-appeal against the decision of the Labour Court of Herne. In its reasoning, the LAG stated that the plaintiff was entitled to injunctive relief against the transfer of her data to the service company pursuant to §§ 1004 (1) BGB, 823 (2) S. 1 BGB (Bürgerliches Gesetzbuch, German Civil Code) in conjunction with Art. 5 (1) (a) Var. 1, 6 (1) GDPR, as the cited articles were protective laws within the meaning of § 823 (2) S. 1 BGB and the transfer of the data constituted a violation of the GDPR. According to the LAG, the transfer of the data lacks the necessary legal basis according to Art.6 (1) (a) to (f) GDPR. The LAG emphasises above all that there is no consent and a transfer cannot be based on § 26 BDSG (Bundesdatenschutzgesetz, Federal Data Protection Act). The LAG also rejects a transfer based upon a legitimate interest.
A legitimate interest in the transfer of personal data within a group of companies can be assumed for internal administrative purposes. In its ruling, the LAG states that in principle a legitimate economic interest of both the defendant and the service company in the transfer of the plaintiff’s salary data for the purpose of comparing salaries in order to standardise salaries across the group can be assumed. However, the LAG also states that the transmission of the data in its concrete form was not necessary. Rather, the plaintiff’s salary data could have been transmitted in pseudonymised form.
The purpose of the data transfer was to obtain an overview of the current salary structure of the employees in the group. The legal basis according to Art. 6 (1) (f) GDPR only allows data processing on the basis of legitimate interest if there is no other equally effective means available. In the present case, it would have been sufficient to achieve the objective – the overview of the current salary structure of the employees in the group of companies – if only the salary data had been transmitted.
By transmitting more data than necessary to the service company, the defendant also violated the principle of data minimisation (Art.5 GDPR) in the opinion of the LAG.
In addition, the LAG emphasised in its ruling that the plaintiff had not been informed in advance about the transfer of her personal data pursuant to Art. 13 (3) GDPR. Thus, the plaintiff was not given the opportunity to comment and consequently the transparency requirement (Art. 5 (1) (a) Var. 3 GDPR) was not complied with. The applicant did not have the opportunity to exercise its right to object under Art. 21 of the GDPR due to the failure to inform.
Assessment in terms of data protection law
With its ruling, the LAG clarifies that even within a group of companies, the transfer of data is not possible without a legal basis. A so-called group privilege, which can be assumed in principle, is foreign to data protection law. The so-called small group privilege derived from Recital 48 GDPR provides for a privilege within a company group exclusively for data processing for internal administrative purposes.
In addition, there must always be a legal basis for the transfer. Since consent is not practicable in such cases due to the legal consequences, a transfer is regularly justified based on an overwhelming group interest according to Art. 6 (1) (f) GDPR or for the implementation of the employment relationship. It must be possible to read the latter necessity into the employment contract. The LAG’s ruling also makes it clear that the legal basis for data processing in the employment relationship under § 26 BDSG must be handled restrictively and does not apply across the board to all processing of employees’ personal data.
The court rightly rejects the legitimisation of the data transfer on the basis of the group privilege according to Recital 48 justifying a legitimate interest according to Art. 6 (1) (f) GDPR.
Conclusion
The ruling is a good example of the fact that the existence of an overriding legitimate interest cannot be assumed across the board under the pretext of considerations of usefulness and convenience. As is often misunderstood in practice, the group transfer pursuant to Art. 6 (1) (f) of the GDPR also requires a substantiated weighing. In particular, the general principles of Art. 5 GDPR are decisive. Assuming this, the defendant would also have been in a position to consider the principle of data minimisation and possibly also to include technical measures such as pseudonymisation in the decision process. The judgment would thus probably have turned out differently and the original purpose would even have been realisable.
