CJEU Clarifies Whether Data Protection Officers Can Perform Other Roles Or Be Dismissed

On February 9, 2023, the Court of Justice of the European Union ruled in two decisions (C-453/21 and C-560/21) that a data protection officer (DPO) may have other duties within their role if there is not a conflict of interest. The CJEU also found that national provisions that allow for the dismissal of a DPO with "just cause" are compatible with the General Data Protection Regulation because member states can use "just cause" as a threshold for dismissal if this does not undermine the objectives set for DPOs under the GDPR.

The CJEU's decisions were given in cases about preliminary rulings from the German Federal Labor Court, where in one case the DPO was dismissed because he was also the chair of the works council, and in the other case because of a perceived incompatibility of the DPO's role with other professional responsibilities at the company. In both cases, the DPOs were not dismissed for reasons relating to the performance of their duties and tasks as a