Germany: Dismissal for a breach of GDPR
In a recent case, a director of a German company was dismissed without notice for violating his duties by forwarding internal company emails containing personal and sensitive company information, to his external private email address.Â
The director challenged the validity of the termination without notice.
The Court held:
The termination was valid by reference to the GDPR alone – sending the emails to a private account amounted to unlawful processing of personal data. The Court regarded this a serious breach of the privacy duty, as the private server did not meet the required security standards.
However, the private storage of the information was not, in this case at least, sufficient to constitute a breach of the director’s legal and contractual confidentiality obligations to the company, because there had been no disclosure to third parties.
It is critical that employers ensure that employees are fully aware of their obligations under the GDPR, as well as their obligations of confidentiality generally.
This is high level general update only. Legal advice should be obtained on specific circumstances.