A decision by the Higher Regional Court of Munich shows that forwarding business emails to a private email account constitutes a violation of the General Data Protection Regulation and can even justify extraordinary termination, in this case of an executive board service contract.
According to Section 626 Paragraph 1 of the German Civil Code (BGB), the employment relationship can be terminated for good cause without observing a period of notice if there are facts which, in the individual case and after weighing up the interests of both contracting parties, make the continuation of the employment relationship until the expiry of the period of notice unreasonable.
Forwarding emails as an important reason
The Higher Regional Court affirmed this in the case in question and considered the forwarding of company-related emails, some of which contained sensitive personal data, to be an important reason for termination. The plaintiff sent the emails from his work email account and put his private email address on “CC”.
Although the plaintiff did not violate the confidentiality obligation under company law incumbent upon him as a member of the board of directors by forwarding the emails to himself, he did at least violate a duty of care incumbent upon him, particularly as a member of the board of directors. In this respect, forwarding the emails to the plaintiff’s private account and storing them there constituted processing within the meaning of the General Data Protection Regulation, which was not covered by the consent of the persons concerned and was also not justified by a legitimate interest.
Violation of data protection
The Higher Regional Court stressed that not every violation of the GDPR per se is sufficient grounds for termination, but if emails containing “sensitive data” are forwarded to a private email account in violation of data protection regulations, extraordinary termination may be justified. In the present case, the emails contained, for example, bank inquiries under money laundering law, employee commission claims (…), salary statements of a former CEO (…), etc. It also had to be taken into account that the forwarding was not an isolated case, but rather several emails were forwarded.
The company cannot be expected to forward such data from the company or from third parties.
Conclusion:
In times when data protection is regularly exaggerated in everyday life, it makes sense to think carefully about what you communicate and with which media.
The author is a partner at the law firm Dittmann & Hartmann in Mayen
