X-FAB Dresden (C-453/21): When Do Other Duties Make a DPO Conflicted?
When they decide purposes and means. The EU Court of Justice held that a conflict of interest exists where a DPO’s other tasks lead them to determine the purposes and means of processing, a case-by-case question for the national court. Member States may also give DPOs stronger dismissal protection.
Case Summary
| Court | Court of Justice of the European Union |
|---|---|
| Case | C-453/21, X-FAB Dresden GmbH & Co. KG v FC |
| Referred by | Germany’s Federal Labour Court |
| Judgment | 9 February 2023 |
| Fine | None (preliminary ruling on interpretation) |
| Provisions | Art. 38(3) and 38(6) |
Background
X-FAB’s DPO, appointed in 2015, also chaired the local works council and was vice-chair of the central works council. At the request of the Thuringian data protection authority, X-FAB and its group companies dismissed him as DPO. He challenged the dismissal, and the lower German courts sided with him (Hunton Andrews Kurth).
What the Court Decided
The judgment sets out Recital 97 in its legal context (judgment). Member States may give DPOs stronger dismissal protection, such as a “just cause” rule, provided it doesn’t undermine the GDPR’s objectives. A conflict of interest exists where other tasks lead the DPO to determine the purposes and means of processing. Whether that applies is a case-by-case assessment for the national court (Reed Smith). The court took a similar line on dismissal protection in C-534/20 (Leistritz) in June 2022.
Timeline
Amber marks the decisive decision or ruling.
| Date | Event |
|---|---|
| X-FAB appoints the employee as DPO | |
| Germany’s Federal Labour Court refers questions to the CJEU | |
| The Court of Justice rules in C-453/21 |
Assess the conflict question before appointing, not after. Once a DPO is in post, national dismissal protection can make it much harder to unwind a poor appointment.
Frequently Asked Questions
When does a DPO have a conflict of interest?
According to the CJEU in C-453/21, where other tasks lead the DPO to determine the purposes and means of processing. Whether that applies is a case-by-case assessment for the national court.
Can Member States make it harder to dismiss a DPO?
Yes. The Court held that Member States may give DPOs stronger dismissal protection, such as a “just cause” rule, provided it doesn’t undermine the GDPR’s objectives.
Why does X-FAB matter for Recital 97?
The judgment sets out Recital 97 in its legal context when interpreting the independence and conflict rules in Article 38.
Appointing or replacing a DPO? Get the conflict check done first, while it’s still easy to change course.
Sources
- CJEU, Case C-453/21 X-FAB Dresden GmbH & Co. KG v FC, judgment of 9 February 2023 (copy hosted by the Hellenic DPA)
- Hunton Andrews Kurth, CJEU clarifies rules on conflict of interest in relation to DPO role
- Reed Smith, CJEU rules on DPO conflicts of interest under the GDPR
- Simmons & Simmons, on C-534/20 (Leistritz)