Case C-560/21, Privacy:

ZS – v – Zweckverband ‘Kommunale Informationsverarbeitung Sachsen’ KISA, a body governed by public law, reference lodged by the Bundesarbeitsgericht (Germany) on 13 September 2021

Is the second sentence of Article 38(3) of Regulation (EU) 2016/679 (the General Data Protection Regulation; ‘the GDPR’) to be interpreted as precluding a provision of national law, such as, in the present case, the first sentence of Paragraph 6(4) of the Bundesdatenschutzgesetz (Federal Law on data protection), which makes dismissal of the data protection officer by the controller, who is his or her employer, subject to the conditions set out therein, irrespective of whether such dismissal relates to the performance of his or her tasks?
If the answer to the first question is in the affirmative: 2Does the second sentence of Article 38(3) of the GDPR have a sufficient legal basis, in particular in so far as the provision covers data protection officers who have an employment relationship with the controller?