German Federal Labour Court limits GDPR access to compliance reports

The German Federal Labour Court (BAG) has clarified the scope of information rights under Article 15 of the General Data Protection Regulation (GDPR). The court ruled that an employee's right to access information is limited to the specific personal data processed, rather than granting an automatic right to receive entire documents, such as compliance reports.

In the case at hand, a manager requested full copies of two compliance reports prepared by a law firm following whistleblower complaints regarding her leadership behavior. These reports contained allegations, witness statements, and legal evaluations. While the plaintiff argued for full disclosure under the GDPR, the court determined that the right to access does not equate to a broad right of document inspection.

The ruling emphasizes that employers are not required to hand over complete documents unless it is strictly necessary to make the personal data understandable or to allow the effective exercise of rights guaranteed by the GDPR. This decision provides greater legal certainty for employers regarding the protection of trade secrets and the privacy of whistleblowers and witnesses.