IP case law Court of Justice

Referral C-453/21 (X-FAB Dresden, 21 Jul 2021)



1. Is the second sentence of Article 38(3) of Regulation (EU) 2016/679 (General Data Protection Regulation; ‘the GDPR’) to be interpreted as precluding a provision in national law, such as, in the present case, Paragraph 38(1) and (2) in conjunction with the first sentence of Paragraph 6(4) of the Bundesdatenschutzgesetz (Federal Law on data protection; ‘the BDSG’), which makes dismissal of the data protection officer by the controller, who is his employer, subject to the conditions set out therein, irrespective of whether such dismissal relates to the performance of his tasks?
If the first question is answered in the affirmative:
2. Does the second sentence of Article 38(3) of the GDPR also preclude such a provision in national law if the designation of the data protection officer is mandatory not in accordance with Article 37(1) of the GDPR, but only in accordance with the law of the Member State?
If the first question is answered in the affirmative:
3. Does the second sentence of Article 38(3) of the GDPR have sufficient legal basis, in particular in so far as it covers data protection officers that have an employment relationship with the controller?
If the first question is answered in the negative:
4. Is there a conflict of interests within the meaning of the second sentence of Article 38(6) of the GDPR if the data protection officer also holds the office of chairman of the works council established at the controlling body? Must specific tasks have been assigned within the works council in order for such a conflict of interests to be assumed to exist?


Case details on the CJEU website (external link)


Disclaimer