Court case 5 Ca 877/23 – Court Ruling (Germany, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court in Germany ruled on a case where a person felt their privacy was violated after a credit agency delayed responding to their data request. The individual claimed they should have received a quicker answer about their personal data. This case shows how important it is for companies to respond promptly to data requests from users.
What happened
The court addressed a complaint about a credit agency's delayed response to a data access request.
Who was affected
The individual who applied for a job at the credit agency and requested access to their personal data was affected.
What the authority found
The court found that the credit agency did not respond 'without undue delay' as required by GDPR, but no damages were awarded.
Why this matters
This case highlights the expectation for companies to respond quickly to data requests. It sets a precedent that could encourage faster responses in the future.
GDPR Articles Cited
National Law Articles
A data subject applied for an open position at a credit agency in 2017. On 18 May 2023, the data subject made an access request under Article 15 GDPR giving the controller a two-week limit to reply. The controller did not respond within the deadline and the data subject reminded the controller of his access request. On 5 June 2023, the controller replied to the request, stating that it did not process any of the data subject’s personal data. The data subject then got back to the controller asking why it took so long to respond to his access request and the controller replied stating that it lawfully replied within the time limit foreseen in Article 12(3) GDPR. Still, the data subject believed that the controller violated Article 12(3) GDPR’s requirement that controllers provide information on data subjects’ requests “without undue delay”. In the data subject’s opinion, the one-month deadline of Article 12(3) GDPR is a maximum deadline; if it wasn’t so, the “without undue delay” would lose its meaning. In the data subject's view, in absence of particular circumstances, this means that controllers should answer within a week. Also, given the simplicity of the access request, the controller in this case should have been able to respect the two-week limit set by the data subject. The data subject claimed to be entitled to immaterial damages under Article 82(1) GDPR, as it suffered a temporary loss of control over his personal data and not knowing whether personal data concerning him were being processed, he could also not know whether the controller was lawfully processing his data or not. The data subject further claimed to have suffered emotional damages. For these reasons, he asked the controller for compensation in the amount of €1,000, which the controller refused to pay. The data subject then filed suit in the Labour Court of Duisburg (Arbeitsgericht Duisburg- ArbG Duisburg) in order to obtain compensation of at least €2,000 from the controller. In its submissi
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 5 Ca 877/23 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 5 Ca 877/23 - Germany (2023). Retrieved from cookiefines.eu
Last updated: