Court case 6 SLa 116/26 – Court Ruling (Germany, 2026)

The data subject had applied for a secretary position in a human resources consulting company (the controller) in January 2025. He later filed a lawsuit claiming he had been discriminated against in the recruitment process on the basis of his gender and his disability. In October 2025, the data subject amended his lawsuit to include a claim for non-material damages of at least €1,000 under Article 82 GDPR. He claimed to have lost the control of his personal data as the controller had submitted a screenshot of the data subject’s Facebook profile to the court as an attachment to its answer to the lawsuit without first informing him of the collection and processing of his data in accordance with Article 14 GDPR. The court of first instance issued a default judgment where it dismissed the damages claim on 14 October 2025, as the data subject failed to appear before the court. This outcome was upheld in a final decision in January 2026: the court of first instance held that the data subject had voluntarily made the personal data at issue available for viewing by an unlimited number of people on his Facebook profile. Therefore, he had not suffered a significant loss of control over his personal data. The data subject appealed this decision to the Cologne Higher Labour Court in February 2026. The higher labour court dismissed the data subject’s claim for damages under Article 82 GDPR. First, the court held that the controller had not fully complied with its obligations under Article 14 GDPR – it had not provided the data subject the contact information of its data protection officer, specified the categories of personal data being processed, or explicitly identified the legitimate interests pursued. While the court found that there had been a violation of Article 14 GDPR, it also pointed out that a GDPR infringement alone could not give rise to a claim for damages. According to the court, the data subject had not suffered non-pecuniary damage in the present case. He had not lost control over his personal data or been reduced to a mere object of data collection, as he had made a voluntary decision to make the personal data at issue publicly available by setting this information to “public” on his own Facebook profile. The court held that this was not comparable to a Google search, where information that the data subject themselves has not chosen to publish could also have been made available by third parties.