Liability of the Data Protection Officer

The data protection officer does not bear responsibility of his or her own for compliance with data protection law (on this, see tasks). He or she may, however, be liable for a breach of his or her own tasks under Article 39 GDPR. This page classifies the possible routes to liability. In practice, liability rarely materializes because the data protection officer has no power to issue instructions or to take decisions.

1. Overview

1.1 No responsibility, but liability of one's own

Responsibility for compliance with the GDPR lies with the controller (Article 5(2) and Article 24 GDPR), not with the data protection officer. The data protection officer is not a guarantor with a duty to supervise and is not liable for the controller's compliance with data protection law. He or she may, however, be liable where he or she breaches his or her own tasks under Article 39 GDPR, for example by giving incorrect advice. Four directions are to be distinguished here: liability towards the data subject, internal liability towards the controller or the processor, in each case separately for the internal and the external data protection officer, and criminal and administrative fine responsibility.

1.2 No compensation under Article 82 GDPR

The special right to compensation under Article 82 GDPR lies only against the controller and the processor. The data protection officer is neither the one nor the other; he or she does not determine the purposes and means of the processing (Article 4(7) GDPR). No claim under Article 82 GDPR can therefore be asserted against him or her (Landshut Regional Court (LG Landshut), judgment of 6 November 2020, 51 O 513/20). Only the general rules of civil liability remain applicable.

2. Liability towards the data subject

2.1 No contractual liability

There is no contract between the data subject and the data protection officer, so that a contractual obligation to pay damages is ruled out. A contract with protective effect for third parties is likewise ruled out, because the data subject is already sufficiently protected vis-a-vis the controller through Article 82 GDPR.

2.2 Tort liability and the lack of causation

What may come into consideration are claims in tort for infringement of the general right of personality (§ 823(1) of the German Civil Code (BGB)), for breach of a protective statute (§ 823(2) BGB in conjunction with Articles 38 and 39 GDPR) and for intentional damage contrary to public policy (§ 826 BGB). In practice, such claims usually fail on the causation establishing liability: the data protection officer has no power whatsoever to issue instructions to the controller, so that an infringement of the data subject's rights can only rarely be traced directly back to his or her conduct.

Whether the data protection officer occupies a position of guarantor for the prevention of data protection infringements is disputed, but the question may be left open: monitoring means ascertaining and assessing, not actively intervening in the processing; under Recital 97 GDPR, the data protection officer merely assists in monitoring internal compliance. A wrongful omission of his or her monitoring or information activity is therefore hardly ever the direct cause of an infringement of a protected legal interest.

What thus remains as a serious possibility is above all liability for active, culpable incorrect advice: where the processing operations that later cause the damage are submitted to the data protection officer for advice and he or she advises incorrectly in breach of the required standard of care, liability may come into consideration. For the internal data protection officer as an employee, that liability is additionally limited by the liability privilege for work-related activities (on which see immediately below).

3. Internal liability towards the controller or the processor

3.1 Internal data protection officer

The employed data protection officer is liable to his or her employer like any other employee under the principles governing liability for work-related activities (internal allocation of damage within the business):

• In the case of slight negligence, he or she is not liable.
• In the case of ordinary and gross negligence, he or she is liable on a proportionate basis; contributory negligence on the part of the employer reduces the claim (§ 254 BGB).
• In the case of intent that extends also to the damage, or in the case of atypical, excessive conduct, he or she is liable in full.

That privileged treatment also applies to a group data protection officer who has an employment relationship with only one company of the group but acts for several affiliated companies. The principles do not apply to data protection officers of public bodies who hold civil servant status; they are liable to their employing public authority under § 75 of the German Federal Civil Servants Act (BBG) and the corresponding provisions of the laws of the German federal states for intent and gross negligence.

3.2 External data protection officer

The external data protection officer does not enjoy that privileged treatment. Under the service contract he or she is in principle liable without limitation under the general rules, that is to say already for slight negligence (§ 280 BGB, depending on the case in conjunction with § 282 BGB). What is required is a valid obligation, a breach of duty, responsibility for that breach, damage, and causation between the breach of duty and the damage. Here too, contributory negligence on the part of the controller may reduce the liability, for example where the controller breaches its duties of support under Article 38(2) GDPR. The more extensive liability is not infrequently an argument in favor of the external solution.

3.3 Limitation of liability, insurance and documentation

The liability risk can be limited:

• by professional indemnity insurance taken out by the data protection officer,
• by an indemnity against liability in the internal relationship with the controller, which, however, does not protect against claims by data subjects and is of no avail if the controller becomes insolvent,
• in the case of the external data protection officer, by a contractual limitation of liability according to the degree of fault and as to amount, provided that it covers the damage typically foreseeable under this type of contract (on the contractual points, see contract with an external data protection officer).

Irrespective of this, the data protection officer should document his or her communication with the controller and the processor in order to be able to demonstrate, in the event of a dispute, that he or she has performed his or her tasks in accordance with his or her duties.

4. Criminal and administrative fine responsibility

The addressees of the administrative fine provisions of Article 83 GDPR and of the criminal and administrative fine provisions of §§ 42 and 43 of the German Federal Data Protection Act (BDSG) are exclusively the controller and the processor. Direct application to the data protection officer is ruled out because he or she exerts no influence on the operational processing.

The data protection officer does, however, render himself or herself independently criminally liable where he or she discloses without authorization a secret belonging to another which became known to him or her in that capacity at a person bound by professional secrecy (§ 203(4) StGB; imprisonment of up to one year or a fine). In addition, participation in criminal offenses may come into consideration, for example aiding and abetting through unlawful advice by which he or she facilitates a criminal data protection infringement on the part of the controller or the processor. The duties of secrecy and confidentiality by which the data protection officer is bound are set out under secrecy and confidentiality.