According to § 4f para. 1 Sentence 1 BDSG, public and non-public bodies that collect, process or use personal data automatically must appoint a data protection officer.
In confirmation of the previous case law of the Federal Labor Court, the Ninth Senate decided in its judgment of March 13, 2007 ( 9 AZR 612/05 ) that the provision of the BDSG only regulates the unilateral appointment of a data protection officer. The contractual basis must be separated from this, on the basis of which the person to be appointed undertakes a contractual obligation to take on the task of data protection officer. For an employee, this is usually the employment relationship. If the employee agrees to his appointment, his employment contractual rights and obligations will also be expanded to include the scope of duties of the data protection officer.
The commissioning is generally not covered by the employer’s right of direction. According to § 4f para. 3 sentence 4 first half sentence BDSG, the appointment as data protection officer can be revoked in accordance with Section 626 BGB. If the activity of the data protection officer is part of the employee’s scope of duties under the employment contract, the revocation of the appointment can only be effectively revoked with simultaneous partial termination of the special task owed under the employment contract. The basic contractual relationship and the appointment according to the BDSG are inextricably linked. Partial termination is permitted here as an exception. The special task is not internally related to the other rights and obligations arising from the employment relationship. Their elimination therefore does not lead to a one-sided, significant interference with the order and equivalence structure of the entire employment relationship. The possibility of partial termination is also possible because of the prohibition of discrimination in Section 4f Paragraph. 3 sentence 3 BDSG required. It would constitute a disadvantage if the revocation of the appointment could only be implemented by giving notice of termination or termination of the employment relationship. The entire employment relationship would then be jeopardized solely because of the activity as a data protection officer.