Court case 13 K 278/21 – Court Ruling (Germany, 2023)

The data subject was a federal civil servant who applied for assistance from the controller, the German Federal Administrative Office. The data subject attached to his application 13 copies of receipts with special categories of personal data – in particular information about his health. The receipts included nine invoices and statements from various specialist doctors in 2019, detailing the individual services provided and, in some cases, including diagnostic information, along with four prescriptions for medications. The controller should have returned the copies to the data subject, but due to an administrative error, the data subject received the copies concerning a third person and the data subject´s receipts were also accidentally sent to a third person. After the controller got back the receipts from the third person, they were eventually sent to the data subject. Due to this error, health data of the data subject was disclosed to a third person, without any legal ground. This violated the data subject's general right of personality and his right to informational self-determination. Therefore, the data subject claimed €3,000 as compensation for damages pursuant to Article 82(1) GDPR. The court found the disclosure unlawful as occurred in violation of Article 9(1) GDPR. In the quantification of damages the court ruled the following. First, there was nothing to indicate that the data were made known to other persons, other than the known (wrong) recipient. In this respect, it could be assumed that the risk of further dissemination of the data subject's health data by the third party did not materialize. The controller immediately demanded the return of the receipts from the third party and returned them to the data subject after it had noticed the incorrect dispatch. Further, the court held that the incorrect dispatch of the aid vouchers was only due to simple negligence; the court did not find any gross negligence or intent in the unlawful disclosure. Finally, there was also no risk of repetition. According to the controller, the misdirection was a one-time exceptional case. The controller also changed the way it handles the documents sent in. The aid notifications were now sent without supporting documents and all supporting documents provided were now destroyed in the aid office in line with data protection requirements. A violation of Article 9 GDPR similar to the present case was thus ruled out for the future. In addition, the court noticed how the controller called in the responsible data protection officer. For this reasons, the court set the compensation at €1,000.