Bar Court of Appeal for North Rhine-Westphalia (AGH NRW), judgment of 12 March 2021, 1 AGH 9/19

1. Overview

A fully qualified lawyer worked as an internal and external data protection officer and applied for admission to the bar as in-house counsel (Syndikusrechtsanwältin). At issue was whether the activity of a data protection officer involves legal advice of the kind characteristic of the legal profession and whether the legal advisory tasks may be performed at all without infringing the German Legal Services Act (RDG).

Reference: AGH NRW, judgment of 12 March 2021, 1 AGH 9/19

2. Data protection advice as a permitted legal service

The Bar Court of Appeal proceeded on the basis that the tasks assigned to the data protection officer by Article 39(1) GDPR involve, to a defining extent, the legal examination of the individual case and therefore legal services within the meaning of § 2(1) RDG. In the court's view, however, those services are permitted by another statute within the meaning of § 1(3) RDG: Article 39 GDPR assigns to the data protection officer a sufficiently specific field of tasks and thereby at the same time permits him or her to provide legal advice within that field. No separate registration under the RDG is required for those statutory tasks.

3. Significance in practice

The decision concerns the licensing requirement for external data protection officers under the RDG. It supports the view that the statutory tasks of the data protection officer may be performed without a separate license under the RDG. The reach of that entitlement has not, however, been conclusively settled: on the opposing view, the activity of an external data protection officer may exceed the threshold of an ancillary service not requiring a license (§ 5(1) RDG) as soon as complex legal questions outside data protection law also have to be answered in the individual case. A ruling by the highest courts is still awaited.