CJEU: DPO contract can only be terminated for ‘just cause’

German provisions requiring ‘just cause’ for the termination of the employment of a Data Protection Officer are in principle compatible with the GDPR. By Bartholomäus Regenhardt of Cooley LLP.

A recent case(1) from Germany clarifies the status of a Data Protection Officer (“DPO”), and the relationship between the GDPR and national provisions. The case, which was decided in the First Chamber of the CJEU on 22 June 2022, cannot be challenged.

The case relates to Article 38(3) of the General Data Protection Regulation (“GDPR”) on the protection and independence of a DPO. According to the Court of Justice of the European Union (“CJEU”),

“[Article 38(3) GDPR] must be interpreted as not precluding national legislation which provides that a controller or a processor may terminate the employment contract of a data protection officer, who is a member of his or her staff, only with just cause, even if the contractual termination is not related to the performance of that officer’s tasks, in so far as such legislation does not undermine the achievement of the objectives of [the GDPR].”

Continue Reading

International Report subscribers, please login to access the full article


If you wish to subscribe, please see our subscription information.