EFTA Court Judgment on GDPR Article 38(3) and DPO Dismissal Case
The EFTA Court has issued its judgment in Case E-5/25 concerning the dismissal of a data protection officer (DPO) at the University of Liechtenstein. The case arose after the university introduced new employment rules in December 2020 that prohibited holding a part-time DPO role alongside a qualification-based academic position. The DPO, who worked 50% as a DPO and 30% as a postdoctoral researcher, was dismissed in 2021 due to this policy change. The DPO contested the dismissal, arguing it lacked just cause under Article 38(3) of the GDPR and Article 7(4) of the Liechtenstein Data Protection Act.
The Princely Supreme Court sought clarification on whether the dismissal complied with the GDPR. The EFTA Court ruled that the GDPR does not prevent national laws from permitting the dismissal of a DPO without just cause, as long as the dismissal is unrelated to the DPO’s performance of their statutory duties and does not compromise the GDPR’s objectives. This means that the protection against dismissal under the GDPR is not absolute but depends on the context and reasons for termination.
The Court also clarified that the term “dismissal” under Article 38(3) of the GDPR is broad, covering not only the formal termination of an employment contract but also other situations that prevent the DPO from fulfilling their role. This interpretation ensures comprehensive protection of the DPO’s position, regardless of the specific form of termination.
Finally, the Court emphasized that the GDPR does not itself specify the legal consequences of an unlawful dismissal. It is the responsibility of national courts to interpret and apply national law in a way that remedies breaches of EEA law, including unlawful dismissals of DPOs. This ruling highlights the importance of national legal frameworks in enforcing data protection rights effectively.
