DSGVO / Damages and Employee Data Protection - Judgment of ArbG Düsseldorf dated March 5, 2020, ref. no. 9 Ca 6557/18

GDPR / compensation and employee data protection

GDPR

The Düsseldorf Labor Court has awarded an employee a claim for compensation for his non-material damage under Article 82(1) of the GDPR after his former employer failed to provide him with complete and timely information under Article 15 of the GDPR (Düsseldorf Labor Court, judgment of March 5, 2020 - 9 CA 6557/18).

What was it about?

The parties disputed before the Düsseldorf Labor Court about the provision of disclosures, information and copies as well as compensation under the GDPR. After termination of the employment relationship, the plaintiff asserted claims for damages against the former employee, a company with its registered office in Düsseldorf, due to incomplete and delayed data disclosure according to Art. 15 GDPR and in this context demanded damages in the total amount of EUR 143,482.81. Among other things, the plaintiff demanded information as to whether his personal data had been processed by the defendant and by other persons or companies, as well as various other issues named in the statement of claim, and the surrender of a copy of the personal data processed by the defendant.

The Düsseldorf Local Court awarded the plaintiff damages of EUR 5,000.00 in this connection.

Legal background

According to § 15 DSVGO the data subject shall have the right to obtain confirmation from the controller as to whether personal data concerning him or her are being processed and, where this is the case, the data subject shall have the right to obtain information about such personal data and the information referred to in Section 15(1)(a) - (h). In cases where material or immaterial damage has been caused due to a breach of the GDPR, the person has a claim for damages against the controller or the processor.

According to the Düsseldorf Labor Court, the plaintiff was entitled to such damages in the amount of EUR 5,000.00. In the present case, the defendant had not complied with the requirements of Art. 15 para. 1 subpara. 1, subpara. 2 lit. a, b in conjunction with Art. 12 Par. 1, 3 E. violated and thus impaired the plaintiff's right to information. Due to the months-long delayed, then insufficient information, the plaintiff had been in the dark and the examination had first been denied to him and then only possible to a limited extent, whether and how the defendant had processed his personal data, according to the Düsseldorf Labor Court.

The employee had suffered non-material damage because of this. According to Recital 146 of the GDPR the controller or processor shall compensate for damage suffered by a person as a result of processing that does not comply with this Regulation. The concept of damage is to be interpreted broadly in the light of the case law of the Court of Justice and in a way that is fully consistent with the objectives of this Regulation. In particular, there would be no de minimis threshold that would lead to the denial of a claim for damages under Art. 81 para. 1 DSGVO leads to. The severity of the non-material damage is decisive for the justification of the liability according to Art. 82 para. 1 DSGVO irrelevant and only affects the amount of the claim.

The court has quantified the non-material damage of the plaintiff in the present case at EUR 5,000.00. Thus, the court states in the reasons for the decision with recital 146 of the GDPR:

"The affected person should receive full and effective compensation for the harm suffered. Violations must be effectively sanctioned for E. to work, which is achieved primarily through damages in deterrent amounts."

Outlook and consequences

The decision is not yet final and has since been assigned the case number 14 Sa 294/20 at the Düsseldorf Regional Court. If the ruling is upheld or if other national courts follow the Düsseldorf judges, the ruling will represent a decision of unimagined scope for employee data protection and bring about a considerable leverage effect in favor of employees. It can be assumed that the assertion of non-material damage claims under Art. 82 para.1 DSGVO in the context of termination of employment relationships, with which employees will attempt to effectively enforce and prepare their own claims in the event of termination or other termination of the employment relationship.

Whether there is a need for action on your part as an employer with regard to DSGVO compliance or whether it makes sense for you as an employee to assert a corresponding claim for damages, requires an examination by a lawyer experienced in data protection and employment law.