Court case 10 Sa 443/21 – Court Ruling (Germany, 2021)

The data subject worked as a cook for over 20 years for the controller. In 2019, the data subject requested detailed information in accordance with Article 15 GDPR after he had received a warning from the controller and was transferred. The request concerned these two processes. The controller did not comply with the request. The defendant claimed before the Labour Court of Berlin that, since he had remained in the dark about essential factors of the data processing, he was entitled to damages pursuant to Article 82 GDPR. He argued that a claim for damages in the amount of €250 per month per infringement was appropriate because the infringement had lasted for more than 16 months. As a result of the months-long delay in providing information, he had been prevented from assessing whether and how the defendant had been processing his personal data. The Labour Court of Berlin dismissed the action insofar as it was relevant to the appeal. It held that it was unclear what the exact aim of the data subject's access request had been. With his appeal, the data subject pursued a claim of damages in the amount of at least €8,000 by the controller. The Regional Labour Court of Berlin-Brandenburg partly upheld the claim. It granted the data subject damages in the amount of €2,000. It held that information was not given correctly as requested and that the controller should have regarded Article 15 GDPR in full. Contrary to the first instance court's opinion, the data subject had sufficiently specified his access request. The controller had neither indicated whether and, if so, to which persons or bodies it had disclosed or would disclose the transfer process, nor when or according to which criteria the data would be deleted. Nor did the controller indicate the existence of the data subject's rights pursuant to Articles 12 et seqq. GDPR. The court concluded that it was indeed so obvious that this information was missing that the controller could have ascertained what the data subject was asking it to do by simply looking at the text of Article 15(1) GDPR. The court further agreed with the data subject that he had suffered damages. It held that a non-material claim for damages exists irrespective of whether a materiality threshold has been reached in the case of violations of the provisions of the GDPR. Since the controller had not sufficiently fulfilled its obligation to provide information in terms of content, the data subject had not obtained sufficient knowledge about the processing of his personal data. In this respect, a loss of control had occurred and the possibility of reviewing the lawfulness of the processing of his personal data had been made impossible or difficult for him. The court found damages in the amount of €1,000 per incompletely answered request for information. It emphasised that the enforcement of the GDPR also relied on a deterrent effect of claims for damages. Therefore, the awarded damages should encourage the controller to comply with the relevant requirements.