Court case 11 Sa 808/23 – Court Ruling (Germany, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court ruled that a housing company violated privacy rules by not responding to a job seeker's requests for access to their personal data. The court granted the job seeker access but denied their claim for damages. This case illustrates the need for companies to respond to data requests promptly.
What happened
The housing company failed to respond to a job seeker's repeated requests for access to their personal data.
Who was affected
The job seeker, who applied for a position at the housing company, was affected by the lack of response to their data requests.
What the authority found
The court found that the housing company violated privacy rules by not providing the requested information under GDPR.
Why this matters
This ruling reinforces the importance of timely responses to data access requests. Companies should be aware that failing to respond can lead to legal consequences and loss of trust.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The data subject, a job seeker with over ten years of experience in debt and accounts management, applied twice for a position at a housing company (the controller) on 3 August 2022 and 3 December 2022. The controller did not respond to either application. On 18 May 2023, the data subject requested access to his personal data under Article 15 GDPR. After receiving no response, he sent reminders on 3 June 2023 and 18 June 2023, with deadlines of 17 June 2023 and 28 June 2023. The controller still did not respond. The data subject then filed a lawsuit at the Labour Court Düsseldorf ("Arbeitsgericht Düsseldorf - AG Düsseldorf") seeking a copy of his data, information on all the recipients to whom his personal data was disclosed to, and €5,000 in non-material damages. The first instance court ruled partially in favour of the data subject, granting the access request but denying the claim for non-material damages. The court held that a violation of Article 15(1) GDPR always means a loss of control and cannot be considered as the damage itself. Therefore, the court found that the data subject did not demonstrate any non-material damage entitling him to compensation. The data subject then appealed this decision at the Regional Labour Court Düsseldorf ("Landesarbeitsgericht Düsseldorf - LAG Düsseldorf"), adjusting his claim to €2,500 in non-material damages. First, the court held that the controller violated Article 15 GDPR in conjunction with Article 12(3) GDPR by not providing information on the data subject's personal data, its processing purposes, and the recipients of the personal data to the data subject after repeated requests. Second, the court determined whether the violation under Article 15 GDPR gave rise to a claim for compensation for material and non-material damage under Article 82(1) GDPR. The court held that Article 82(1) GDPR should not be interpreted too narrow. The court took into account that some case law take the view that violations under Artic
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 11 Sa 808/23 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 11 Sa 808/23 - Germany (2024). Retrieved from cookiefines.eu
Last updated: