Ex-employee (data subject) – Court Ruling (Germany, 2023)

The data subject was employed by the controller in December 2016. In October 2022, the data subject requested access to their personal data under Article 15 GDPR, which the controller complied with. The data subject then sent another request and set a deadline until 16 October 2022. The controller did not respond by that date, and after multiple reminders and new deadlines, it provided a response that was delayed and incomplete, missing data on storage duration and recipients. The controller later supplemented the information by early December 2022. The data subject claimed that the controller violated its Article 15 GDPR duties by failing to provide timely and complete information, causing immaterial harm (loss of control over data). They sought compensation under Article 82 GDPR. In the previous decision, the lower court awarded €10,000. The controller appealed the decision. First, the court held that a delayed or initially incomplete data access response does not constitute “data processing” as defined in Article 4(2) GDPR. It pointed out that a missed or belated answer is not an active processing act but “non-processing” of data, and thus cannot trigger compensation under Article 82 GDPR, which requires an actual unlawful processing breach. The court also held that an immaterial damage claim must be tied to concrete harmful processing. Generalized assertions like “loss of control” or “frustration” are insufficient and must be proven. As a result, the court amended the first-instance decision and dismissed the data subject’s claim for non-material damages. Revision (appeal) to the Federal Labour Court was permitted.