Failure to provide information about personal data can be costly

If an employee of a company wishes to obtain information about their processed personal data and the company fails to comply, this can potentially be costly. In this context, the German Federal Labour Court [Bundesarbeitsgericht, BAG] was also against an obligation to represent and prove the concrete occurrence of damage in the event of a failure to provide information. A final decision by the ECJ is pending, however. We explain what companies need to watch out for in this connection.

Current case law on the claim to information and damages under the GDPR 

With the entry into force of the GDPR 2018, companies were faced with numerous questions concerning the protection of their employees' personal data. Since then, not only does all processing of employees' personal data require approval pursuant to Art. 6 (1) GDPR, but employees are also entitled to request information about the data processed by their employer.

The claim to information pursuant to Art. 15 GDPR includes not only the employee's right to know whether data is being processed, but also which data this involves. Employees can also request from their employer a copy of such personal data (Art. 15 (2) sentence 1 GDPR). In this case, the employing company must provide the information no later than one month after the request (Art. 12 (3) sentence 1 GDPR). If the information is not provided or not provided in a timely manner, the employee has a claim to non-material damages pursuant to Art. 82 (1) GDPR.

In the recent past, the labour courts have increasingly dealt with the questions of whether and to what extent an employer is obligated to provide information, and whether and under what conditions a damage claim exists if such information is not provided.

For example, the Regional Labour Court [Landesarbeitsgericht, LAG] of Hamm ruled on 02 December 2022 (docket No.: 19 Sa 756/22) that a judicial request for information that merely repeats the wording of Art. 15 (1) of the GDPR is inadmissible on grounds of lack of specificity if the employing company has already partially fulfilled the employee's request for information. In this case, namely - according to the LAG Hamm - it would be possible for the employee to specify the request for information.

However, it deemed a possible non-material damage claim pursuant to Art. 82 (1) GDPR to be independent of this. In this context, the Austrian Supreme Court had already referred the question to the European Court of Justice (ECJ) for a preliminary ruling on 15 April 2021. It was to determine whether, besides a violation of provisions of the GDPR, a further prerequisite for awarding damages was that the data subject has suffered damage, or whether the violation of provisions of the GDPR as such sufficed to acknowledge the claim (docket No: C-300/21). The ECJ’s decision is still pending.

In the same year, the BAG also referred a question to the ECJ in this connection, namely whether the plaintiff bears the burden of representation and proof of the existence of non-material damages (BAG, decision dated 26 August 2021 - 8 AZR 253/20). Here as well, we await the response from Strasbourg (docket No. C-667/21).

However, pending the ECJ’s decision, the provisional legal opinion of the BAG is that the violation of the GDPR in itself leads to non-material damages to be compensated and that the existence of actual damage is not relevant (BAG, judgement dated 05 May 2022 - 2 AZR 363/21).

Following the provisional opinion of the BAG, the Labour Court [Arbeitsgericht, ArbG] of Oldenburg recently awarded a plaintiff employee a claim to compensation for their non-material damages in an amount of 500 euros per month (ArbG Oldenburg, judgement dated 09 February 2023 - 3 Ca 150/21). The total damage to be compensated by the employing company was 10,000 euros. The court deemed it unnecessary for the employee to represent and prove the existence of (non-material) damage; the violation of the GDPR itself sufficed. The ArbG Oldenburg also followed the line taken by the BAG with regard to the amount in dispute, namely that the order to pay damages for failing to provide information should have both a preventive and deterrent character.

This legal opinion was not shared by the LAG Hamm, however, which rejected the damage claim of the plaintiff employee in its decision of 02 December 2022 (docket No. 19 Sa 756/22) on grounds that she had not fulfilled her burden of representation and proof of the occurrence of damage. The LAG Hamm justifies its legal opinion by stating that Art. 82 of the GDPR does not constitute a "compensation of punitive damages" that is independent of the existence of a concrete damage. Due to the deviation from supreme court case law, however, the LAG allowed an appeal to the BAG.

Conclusion 

At present, based on the provisional case law of the BAG, we can assume that employees who request information from their employer do not have to prove concrete non-material damage in order to assert a damage claim under Art. 82 (1) of the GDPR. Even though there are individual decisions - such as that of the LAG Hamm – that do not support the BAG’s provisional view, we must ultimately await a final decision of the ECJ before gaining legal certainty. In order to avoid damage claims by employees, companies are therefore still well advised to comply with requests for information by employees within the meaning of Art. 15 (1) of the GDPR.

In this case, however, if the employing company has already (partially) fulfilled the request for information, employees then have an increased obligation in labour court proceedings to provide more specific information when filing their complaint. Accordingly, companies should comply with the request for information to the greatest extent possible in order to increase the procedural requirements. Otherwise, the mere repetition of the wording of Art. 15(1) GDPR is sufficient in the context of the complaint.

Back to list