Privacy & Information Security Law Blog

Two recently-published German court decisions have clarified German employee data protection law. The decisions validate the independence of works councils in determining how to comply with data protection law and clarify when unused employee email accounts can be deleted.

In the first court decision, the Federal Labor Court of Germany held that a business cannot prescribe the manner in which its works council must comply with German data protection law. Rather, a works council may determines independently how it chooses to comply. For example, a business’ internal rules on information technology usage may not apply to the works council itself since the works council may decide to create and follow its own information technology usage rules. Overall, this decision further strengthens the position of German works councils.

The second decision concerns the deletion of old email accounts. In this case, the Higher Regional Court of Dresden held that a business may only delete an old account once the former account holder no longer has any interest in the account data. For example, if an employee uses his work email account to receive private emails, he may continue to have an interest in the account data (e.g., with respect to those private emails) after his employment ends. Therefore, businesses should exercise due caution in deleting the email accounts of former employees as they may be liable for damages for deleting emails in which the employee retains an interest.