Data Protection Officer - What happens when companies merge?

Pursuant to Section 4f (1) BDSG, public and non-public bodies that process personal data automatically must appoint a data protection officer (DPO). The law does not explicitly regulate whether the office of a DPO remains in place when two public bodies merge and lose their legal capacity. The Tenth Senate has ruled that in the case of a merger of two health insurance funds, the office of the DPO also ends when their legal capacity ceases.

The plaintiff is an employee of an AOK, the first defendant, and was appointed DPO by a legal predecessor in 1997. On 1 January 2008, the legal predecessor merged with another health insurance fund to form the first defendant.) The latter assigned the plaintiff to another job. The plaintiff sought employment as a DPO and, in the alternative, a declaration that the work assigned to him was not appropriate to his position.

The lower courts dismissed the action. The plaintiff's appeal was only partially successful. It was unsuccessful with regard to the employment application. The office of DPO ended when the health insurance fund ceased to exist. The activity of a DPO only became part of the employment contract for the duration of the transfer of the office. A claim to employment as DPO therefore no longer exists against the newly founded first defendant after the end of the office. Furthermore, the Senate referred the case back to the Regional Labour Court to examine whether the newly assigned activity to the plaintiff was appropriate for his office.

Source: Press release of the Federal Labour Court

Goldberg Attorneys at Law
Attorney at Law Michael Ullrich, LL.M. (Information Law)
Specialist attorney for information technology law
E-mail: Info@goldberg.de

Seal