GDPR / compensation and employee data protection

According to § 15 DSVGO the data subject shall have the right to obtain confirmation from the controller as to whether personal data concerning him or her are being processed and, where this is the case, the data subject shall have the right to obtain information about such personal data and the information referred to in Section 15(1)(a) - (h). In cases where material or immaterial damage has been caused due to a breach of the GDPR, the person has a claim for damages against the controller or the processor.

According to the Düsseldorf Labor Court, the plaintiff was entitled to such damages in the amount of EUR 5,000.00. In the present case, the defendant had not complied with the requirements of Art. 15 para. 1 subpara. 1, subpara. 2 lit. a, b in conjunction with Art. 12 Par. 1, 3 E. violated and thus impaired the plaintiff's right to information. Due to the months-long delayed, then insufficient information, the plaintiff had been in the dark and the examination had first been denied to him and then only possible to a limited extent, whether and how the defendant had processed his personal data, according to the Düsseldorf Labor Court.

The employee had suffered non-material damage because of this. According to Recital 146 of the GDPR the controller or processor shall compensate for damage suffered by a person as a result of processing that does not comply with this Regulation. The concept of damage is to be interpreted broadly in the light of the case law of the Court of Justice and in a way that is fully consistent with the objectives of this Regulation. In particular, there would be no de minimis threshold that would lead to the denial of a claim for damages under Art. 81 para. 1 DSGVO leads to. The severity of the non-material damage is decisive for the justification of the liability according to Art. 82 para. 1 DSGVO irrelevant and only affects the amount of the claim.

The court has quantified the non-material damage of the plaintiff in the present case at EUR 5,000.00. Thus, the court states in the reasons for the decision with recital 146 of the GDPR:

"The affected person should receive full and effective compensation for the harm suffered. Violations must be effectively sanctioned for E. to work, which is achieved primarily through damages in deterrent amounts."