Court case 9 Sa 73/21 – Court Ruling (Germany, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that an employee's request to access personal data on a USB drive was not valid because the data belonged to the company. The court also decided that a warning given to the employee should be erased since their employment had ended. This case emphasizes the importance of understanding data ownership in employment situations.
What happened
The court denied an employee's request for access to data on a USB drive, stating the data was company property.
Who was affected
The employee who was warned for storing confidential company information on a USB drive.
What the authority found
The court found that the employee had no right to access the data on the USB drive as it contained confidential company information.
Why this matters
This case highlights the need for clarity on data ownership and access rights in the workplace. Employers should ensure that their data policies are clear to avoid disputes.
GDPR Articles Cited
The data subject was employed by the controller, a company. After an alleged disciplinary offence, the data subject got a warning signed by the owner (and only shareholder) of the company. In particular, the letter stated that the data subject stored confidential information about the company on a USB pen drive. The owner of the company had found the USB and confiscated it. The data subject asked for access to their personal data, including the content of the USB, claiming ownership over the latter. They also asked the warning to be erased under Article 17 GDPR. Finally, the data subject claimed their right to compensation for damages suffered as a consequence of the unlawful processing. The owner declared that data originally stored on the USB were backed up and erased from the pen drive. They refused to grant access to the data and to delete the warning. The court of first instance rejected the data subject’s claims. No erasure under Article 17 GDPR could be asked to the controller, as the employment relationship between the parties had meanwhile expired. Article 15 GDPR was not applicable either, since the data subject did not own the content of the USB, namely the confidential information unlawfully collected from the company. Therefore, there was no right to compensation pursuant to Article 82 GDPR. The data subject appealed the decision before the Regional Labour Court of Baden-Württemberg (Landesarbeitsgericht Baden-Württemberg, LAG Bade-Württemberg) Concerning the right to erasure of the data subject, the court overturned the first instance judgement. The court noted that a warning was no longer necessary after the termination of the employment contract between the data subject and the controller. Therefore, Article 17(1)(a) GDPR applied. Concerning the right to access, the court clarified that the case at issue was a case of co-controllership. The employer (the company) was clearly controller within the meaning of Article 4(7) GDPR. However, the owner th
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 9 Sa 73/21 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 9 Sa 73/21 - Germany (2023). Retrieved from cookiefines.eu
Last updated: