Law firm – Court Ruling (Germany, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a law firm must provide a client with all personal data, including manual files, after a dispute over access rights. The court found the client's request was not time-barred and that a GDPR violation alone doesn't automatically mean damages are owed. This case highlights the importance of fulfilling data access requests fully and promptly.
What happened
A law firm failed to provide a client with a complete copy of their personal data, including manual files.
Who was affected
The client of a law firm who requested access to their personal data.
What the authority found
The court decided the client was entitled to all personal data, but no damages were awarded as the client didn't suffer a significant disadvantage.
Why this matters
This ruling emphasizes that companies must provide complete data access, including manual records, and that not every GDPR violation results in compensation. Businesses should ensure they have processes to handle data access requests comprehensively.
GDPR Articles Cited
The data subject is a client of a law firm, acting as a controller. The controller sued the data subject for payment of attorney's fees. The data subject counterclaims for their right of access pursuant to Article 15 GDPR, in particular to provide a copy of the personal data pursuant to Article 15(3) GDPR, as well as their right to receive compensation for damages suffered pursuant to Article 82 GDPR. The controller is of the opinion that it already provided the data subject with a copy of personal data as all incoming and outgoing documents were sent to the data subject without undue delay. Furthermore, it claimed that there is only a right to copies of those data that contain concrete information about the data subject. The controller also believes that the claim is time-barred. According to the data subject, the controller did not provide a copy of all personal data. The right to a copy of the personal data also includes a copy of the manual files of the controller. The data subject claims that they are entitled to the payment of damages suffering for the delayed and still incomplete provision of the personal data. The court held that the data subject is entitled to claim for the controller to receive a copy of all personal data including a copy of personal data contained in the manual files. Since the counterclaim was served to the controller on 4 February 2021 and thus before the expiry of a standard limitation period of three years, calculated from the entry into force of the GDPR, the claim cannot be time-barred. The court further held that the data subject is not entitled to claim compensation for the delayed right of access. The violation of the GDPR alone is not sufficient to trigger a claim for damages. Rather, the data subject affected by a data protection violation must have suffered a noticeable disadvantage. There must be an objectively comprehensible impairment of personal interests that carries a certain weight and of a certain significance. It
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Law firm in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Law firm - Germany (2021). Retrieved from cookiefines.eu
Last updated: