Employee excess: when the employee becomes the (GDPR) controller

March 25, 2025

Categories:

Compliance, Data protection in Germany

Is a police officer who carries out a database query without official cause a controller within the meaning of the General Data Protection Regulation (GDPR)? The Stuttgart Higher Regional Court has examined this question in detail - and has come to a clear conclusion. Why employee excess can be really expensive.

Police officer uses police information system for private purposes

The affected Police officers had access to the police information system "POLAS" at the police station. This is used to store and retrieve personal data on suspects, accused persons and other relevant persons as part of police investigations.

On March 2, 2021 at around 1:41 a.m., the officer used his work computer to retrieve information about a colleague who was in custody at the time. In doing so, the officer was not acting for official reasons, but out of private interest, which he was aware of. According to the findings of the local court, the officer had specifically searched for personal and criminally relevant data of his colleague without any official reason.

The incident was uncovered by internal control mechanisms, whereupon the responsible department initiated an investigation. As a result, the officer was charged by the Stuttgart District Court with intentional and unlawful Processing of personal data pursuant to Art. 83 para. 1, 2, 5 lit. a GDPR sentenced to a fine of 1,500 euros. The police officer lodged an appeal against this decision.

Reading tip: Data protection risks for customer portfolio data

Employee excess: employees as the responsible party

The Stuttgart Higher Regional Court dealt in detail with the question of whether a police officer who retrieves data on his own authority is a data controller within the meaning of the GDPR can be seen as a result.

The court first established that the civil servant had knowingly and intentionally carried out a database query that was not part of his official duties. In this context, the OLG emphasized that the civil servant had exceeded his official powers and thus acted outside of his professional role. The civil servant had therefore acted outside of official control. His query was therefore not attributable to the police's official area of responsibility.

The Senate based its decision on the so-called "employee excess theory". This describes that employees who act on their own authority and without instructions personal data process, as independent Responsible persons within the meaning of Art. 4 No. 7 GDPR apply. The court emphasized that personal responsibility in such cases arises from the fact that the employee has the authority to decide on the purpose and means of the Processing decides.

The OLG Stuttgart followed the Guidelines of the European Data Protection Board (EDPB). These state that employees as Responsible persons apply if they personal data for private purposes and without official instructions.

The judges rejected the view that a special regulation was needed for assaults by employees, pointing out that responsibility for such acts arises directly from the GDPR would result. The police officer could also not invoke a privileged exception, as his actions were neither attributable to the employer nor covered by official instructions.

The OLG considered the fine of 1,500 euros to be appropriate and dissuasive. In particular, the civil servant had acted with intent and in deliberate disregard of his duties. In conclusion, the court emphasized the importance of consistent sanctions in the event of data protection violations in order to ensure the data protection obligations set out in Art. 83 para. 1 GDPR to achieve the required deterrent effect.

Fine after employee excess

The decision of the Higher Regional Court of Stuttgart makes it clear that data protection violations do not have to be attributed exclusively to an institution or a company. They can also give rise to individual responsibility on the part of employees. In particular, employees who, on their own authority and without official cause, access personal data The court is of the opinion that those who access the data act on their own responsibility and can be held directly accountable.

In its decision, the court expressly confirmed the so-called "employee excess theory". According to this legal interpretation, an employee who deliberately and intentionally acts outside of his or her official duties is no longer bound by the instructions of his or her employer and becomes a responsible person within the meaning of Art. 4 No. 7 GDPR. This classification means that Affected parties not only face disciplinary or labor law consequences for violations, but can also be fined.

The decision of the Higher Regional Court of Stuttgart thus clarifies the question of responsibility for data protection violations by individuals and shows that data protection violations are not solely the responsibility of the organization as an individual. responsible be borne by the authorities. For companies and public authorities, this means that they must train and sensitize their employees even more intensively in the area of data protection, as the attribution of misconduct to individuals can have considerable financial and legal consequences.

The imposition of a fine of EUR 1,500 also illustrates the deterrent effect that data protection violations can have on individual data subjects. Responsible persons should have. This reflects the intention of the GDPRto effectively sanction data protection violations and achieve a deterrent effect.

Recommendations for practice

With this in mind, organizations should consider the following measures:

Training and sensitization: Regular employee training on data protection law and the consequences of unlawful data processing is essential.
Technical and organizational measures: Access to sensitive databases should be strictly regulated and documented. Technical precautions such as logging mechanisms and access controls can help to prevent unauthorized data queries.
Internal guidelines and control mechanisms: Clear internal guidelines on data processing and effective monitoring of compliance with these guidelines are essential.

The decision of the Higher Regional Court of Stuttgart underscores the need for consistent punishment of data protection violations in order to ensure that the rights set out in Art. 83 para. 1 GDPR to implement the demand for "effective, proportionate and dissuasive" sanctions.

Source: Decision of the Higher Regional Court of Stuttgart of 25.02.2025 (2 ORbs 16 Ss 336/24)

Our tip: Ailance™ sets new standards in integrated risk management and can be easily adapted to your company's requirements. Get in touch with us and we will show you what is possible with Ailance™.
☎️ +49 (228) 926165-100
📧info@2b-advice.com