In Belgium, there is currently no specific protection for DPOs against dismissal. However, DPOs can rely on CLA no. 109 concerning manifestly unreasonable dismissal and argue that they were dismissed due to their DPO role. If a judge rules that there is a manifestly unreasonable dismissal, the employer can be condemned to an indemnity of between three and 17 weeks’ salary. The amount depends on the degree of manifest unreasonableness of the dismissal. There is no case law to date on the dismissal of a DPO.

In Cyprus we have not yet had a court case concerning a DPO dismissal. However, according to Cyprus employment legislation, an unfairly dismissed employee always has the right to ask for reinstatement and/or compensation, though reinstatement is very rarely granted by the courts. That said, if a DPO were dismissed for doing their job, reinstatement may be more readily granted by the courts, especially if the DPO had also acted in accordance with the Whistleblowing Directive ((EU) 2019/1937), which was recently transposed into Cyprus law. The Cyprus Whistleblowing Law implementing the directive (Law 6(1)/2022) specifically provides that an employee who is unfairly dismissed for reporting a matter can ask to be reinstated and the courts will grant this remedy. Therefore, where a DPO advises an organisation on certain aspects of data protection compliance and this also falls under the Whistleblowing Law’s scope then we expect that in the event the DPO is unfairly dismissed, the right to reinstatement could be claimed successfully.

Article 38(3) has not been specifically implemented in Czech law and there are no specific court decisions on it. Czech law provides very strict rules relating to employee dismissal and Article 38(3) makes the process even more complicated, thus we highly recommend collaboration with DPOs to be based on a commercial service contract.

In Denmark, there has been not been any specific implementation of GDPR Article 38(3) and there is no case law or guidance from courts or the DPA on the matter yet.

In France, to date the enforceability of the principle set out by Article 38(3) of the GDPR according to which ‘the DPO shall not be dismissed or penalised by the controller or the processor for performing his/her tasks’ has been confirmed by the French Ministry of Labour in an official ministerial response dated 7 February 2019 with an important reserve (available in French).

This ministerial response confirms that this principle is directly enforceable in France and that on this ground DPOs benefit from a “broad protection” in the performance of their tasks. However, it also clearly specifies that DPOs are not conferred the status of ‘protected employees’ within the meaning of French labour laws. ‘Protected employee’ status in France is granted to certain limited categories of employees, such as staff representatives, for whom a dedicated procedure in the event termination of employment, and specific sanctions in the event of wrongful dismissal apply.

To our knowledge, this topic has not given rise to notable case law to date in France. As a result, to date, under French law, particular vigilance must be observed in the event of a dismissal involving a DPO, however no specific legal protection applies concerning DPOs. From a French labour law perspective, the potential risk in the event of a breach of Article 38(3) of the GDPR would only be, beyond the GDPR risk, that the DPO could potentially claim for additional damages for the loss suffered (at the judge’s discretion).

German regulation on the DPO is stricter than the regulation in the GDPR. In Germany, the DPO can only be dismissed from his or her position for cause; this special position also affects the employment relationship. This means ‘ordinary’ termination of a DPO’s employment relationship is excluded. There is also a one-year ban on ordinary termination of the employment relationship after the employee ceases to act as DPO.  This deviation from the GDPR is currently being examined by the European Court of Justice to determine if this stricter regulation is allowed.

At the time of writing, no court decisions relevant to Article 38(3) of the GDPR have been issued in Greece. L. 4624/2019 which incorporated the GDPR into Greek law provides for the protection of DPOs against unfair dismissal when employed in the public sector, where the designation of a DPO is mandatory. This means the DPO must not be dismissed or sanctioned by the controller or processor for having performed his or her duties. Furthermore, the termination of the DPO’s employment contract or the revocation of the delegation of his/her duties, where the DPO is also an employee of a public authority, is only permitted for good cause. After the termination of his or her employment contract as a DPO, s/he may not be dismissed for one year, unless the public authority has good cause to terminate the employment.

In the private sector, the designation of DPO is not obligatory, except when sensitive personal data is processed, and there are not, to date, particular provisions protecting the DPO in the event of unfair dismissal other than those generally applying in such cases.

GDPR has direct effect in Ireland and any Irish specific legal requirements are provided for under the Data Protection Act 2018. There are no additional national rules that apply that are specific to the dismissal of DPOs outside of the GDPR and existing Irish unfair dismissal legislation.

While there have not been any cases before the Irish courts to date on the dismissal of DPOs, the Irish Data Protection Commission (IDPC) issued a decision in 2021 regarding the independence of the DPO in an Irish government department (the Department of Employment Affairs and Social Protection). This decision followed an IDPC own-volition inquiry into whether the DPO was involved in the amendment of the department’s privacy statement in a proper and timely manner in accordance with a

Article 38(1) and whether the DPO was instructed contrary to Article 38(3) in the exercise of his tasks. This inquiry was on foot of a complaint from a privacy group, Digital Rights Ireland, that alleged there had been ‘serious interference’ with the independence of the DPO. The issue related to how the department had responded to a media query about a reference to the use of biometric data in the department’s privacy statement. The IDPC ultimately determined that the department had not breached Article 38; however this highlights how seriously the IDPC views the provisions of Article 38. As part of the inquiry, the IDPC reviewed email chains between various people within the department and interviewed the DPO to determine what exactly had taken place that led to the privacy statement being amended.

The Lithuanian Law on Legal Protection of Personal Data does not provide for any specific exceptions in relation to the status of DPOs. Thus, if the DPO is an employee, s/he will be protected the same way as any other employee. In a similar case relating to a dismissal in Lithuania, the DPO would be entitled to severance pay. The severance pay varies from one to six monthly salaries depending on the length of his or her employment.

We are not aware of any legal proceedings in relation to DPO dismissals in Lithuania. The majority of labour disputes are settled in a mandatory out-of-court procedure, the Labour Dispute Commission, whose decisions are confidential.

Given that the GDPR has direct effect in the Netherlands, Article 38(3) is not converted into local law. It is treated the same as other protections against dismissal Dutch law provides, such as protection against dismissal for members of the Works Council or trade union membership: if the reasons for dismissal are in any way connected to membership (or to the activities of the employee as a DPO), the employee cannot be fired. There is no case law on this matter in the Netherlands yet.

Slovak Data Protection law does not provide any extra protection for the DPO other than that already provided by the GDPR. However, a DPO may claim their termination was invalid according to the Labour Code in court, for example, for fake redundancy. If the court decides that there was no reason for dismissal, the DPO´s employment continues and s/he may receive wage compensation up to a maximum of three years’ wages for the period during which s/he did not work.

There has not been any case law from the Labour Court involving dismissal of a DPO. It is therefore not possible to assess how the court would interpret Article 38(3) of the GDPR. But, in Sweden, it is possible to claim reinstatement and the employee does not have to have a certain position in order to do so.

Under UK GDPR Article 38(3), DPOs in the UK must not be dismissed or penalised for performing their duties i.e., a DPO cannot be dismissed for providing data protection advice that the data controller does not agree with. Despite this provision, there is no further legislation in the UK to give effect to protections for UK DPO’s. The GDPR does not provide specific penalties for breaches of this Article so is likely to follow the two-tier fine system.