DATA PROTECTION
EU Court of Justice on DPO's dismissal for just cause and conflict of interest.
On February 9, 2023, the Court of Justice of the European Union issued a preliminary ruling in Case C-453/21 X-FAB Dresden GmbH & Co. KG v FC, following a request from the German Federal Labour Court regarding Articles 38(3) and 38(6) of the GDPR. Specifically, the Labour Court requested the ruling in relation to the dismissal of an employee of X-FAB from the position of internal DPO. The CJEU ruled that the second sentence of Article 38(3) of the GDPR does not preclude national legislation that provides that a Data Controller or Processor may dismiss an internal DPO for cause, even if the dismissal is not related to the performance of that DPO's duties. However, this is possible to the extent that such national legislation does not undermine the achievement of the objectives of the GDPR.
In addition, the CJEU has held that Article 38(6) of the GDPR must be interpreted to mean that a conflict of interest may exist when a DPO is entrusted with other tasks or duties that lead him or her to determine the purposes and means of processing personal data. It is up to the national court to find the existence of the conflict of interest in such cases by assessing all relevant circumstances, including the organizational structure of the Data Controller or Data Processor and their policies on processing.
In addition, the CJEU has held that Article 38(6) of the GDPR must be interpreted to mean that a conflict of interest may exist when a DPO is entrusted with other tasks or duties that lead him or her to determine the purposes and means of processing personal data. It is up to the national court to find the existence of the conflict of interest in such cases by assessing all relevant circumstances, including the organizational structure of the Data Controller or Data Processor and their policies on processing.
