Court case 3 Ca 150/21 – Court Ruling (Germany, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a fireworks company violated GDPR by not providing a former employee with his personal data when requested. The employee was awarded €10,000 in damages for the company's failure to comply with GDPR's access requirements. This case highlights the importance of responding promptly to data access requests.
What happened
The company failed to provide the former employee with his personal data for 20 months after he requested it.
Who was affected
The former employee of the fireworks company who requested access to his personal data.
What the authority found
The court found that the company violated GDPR by not fulfilling the employee's data access request, awarding him €10,000 in damages.
Why this matters
This ruling emphasizes the need for companies to promptly respond to data access requests under GDPR. It serves as a reminder that failing to do so can lead to significant financial penalties.
GDPR Articles Cited
This case relates to an employment dispute between a fireworks company, the controller, and a former employee; the data subject. The data subject was initially a managing director of the company and, later on, a sales manager. The company imported fireworks and sold them to re-sellers who then sell these fireworks to ‘end-users’. While being employed by the company, the data subject also ran his own business outside of work, selling the fireworks directly to these 'end-users'. The employment dispute between the parties concerned two main issues: the payment of incentive-based bonuses; and a post-contractual non-competition clause. The data subject sought to recoup unpaid bonuses, while the controller argued that the data subject’s actions, in running this business outside of work, violated the post-contractual non-competition clause; a claim the data subject refuted as there was an agreement in place that they were allowed to engage in this business while they were an employee of the company. During this dispute, the data subject submitted an Article 15 GDPR access request in order to obtain personal data held by the company concerning him. The controller refused to provide this information, and the data subject did not receive it until 20 months later, when the controller disclosed the documents as part of the lawsuit. The data subject claimed that their former employer had violated Articles 12 and 15 GDPR, by failing to respond to the request, and sought non-material damages in the amount of €10,000; calculated as €500 for every month the controller failed to respond. With regards to the data protection aspect of this case, the court held in favour of the data subject, finding that the controller had violated Article 15 GDPR, and its obligations under Article 12 GDPR. The court found that the data subject was entitled to €10,000 in non-material damages, as Aricle 82(1) GDPR allows for such damages and that a violation of the GDPR itself is sufficient for compens
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 3 Ca 150/21 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 3 Ca 150/21 - Germany (2023). Retrieved from cookiefines.eu
Last updated: