Employee – Court Ruling (Germany, 2024)

On 01 September 1999, the data subject started working for the controller, a medical service responsible for providing health assessments for health insurers. Starting on 22 November 2017, the data subject became unable to work due to illness. Their health insurer ordered an assessment of the data subject's disability on 06 June 2018 due to doubts about their inability to work. This assessment was to be done by the controller, who also happened to be the employer of the data subject. The controller had specific rules in form of a "special case" unit of 36 people in place for this occurrence to prevent preferential treatment or discrimination for its employees. A developed role concept within this unit ensured that the relevant expert assessments were not processed by employees who worked with the person concerned in a department, which was also technically secured with separate storing of key and file. Merging was only possible using a key stored in an encryption library. An employee the data subject was familiar with produced the required assessment report for the controller and the health insurer in cooperation with the data subject's doctor via a phone call. On 01 August 2018, the data subject requested a coworker to check whether an assessment report about them was available in the database and to send a picture of it. The coworker complied. On 15 August 2018, the data subject requested compensation of €20,000 from the controller outside of court, but they denied the claim. The data subject also sought material damages in the second instance by way of a payment and declaratory action, each based on Article 82(1) of the GDPR and § 823(1) of the German Civil Code (BGB) in conjunction with Article 2(1) and Article 1(1) of the Constitutional Law (GG). The controller then expressed an immediate termination on 05 December 2019 and 12 December 2019 respectively. The data subject alleged the controller violated their right to privacy based on Article 82(1) GDPR, saying