A recent case(1) from Germany clarifies the status of a Data Protection Officer (“DPO”), and the relationship between the GDPR and national provisions. The case, which was decided in the First Chamber of the CJEU on 22 June 2022, cannot be challenged.

The case relates to Article 38(3) of the General Data Protection Regulation (“GDPR”) on the protection and independence of a DPO. According to the Court of Justice of the European Union (“CJEU”),

“[Article 38(3) GDPR] must be interpreted as not precluding national legislation which provides that a controller or a processor may terminate the employment contract of a data protection officer, who is a member of his or her staff, only with just cause, even if the contractual termination is not related to the performance of that officer’s tasks, in so far as such legislation does not undermine the achievement of the objectives of [the GDPR].”