Court case 11 Sa 808/23 – Court Ruling (Germany, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court ruled that a housing company violated privacy rules by not responding to a job seeker's requests for access to their personal data. The court granted the job seeker access but denied their claim for damages. This case illustrates the need for companies to respond to data requests promptly.
What happened
The housing company failed to respond to a job seeker's repeated requests for access to their personal data.
Who was affected
The job seeker, who applied for a position at the housing company, was affected by the lack of response to their data requests.
What the authority found
The court found that the housing company violated privacy rules by not providing the requested information under GDPR.
Why this matters
This ruling reinforces the importance of timely responses to data access requests. Companies should be aware that failing to respond can lead to legal consequences and loss of trust.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 22 March 2026.
Processing notes: authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject, a job seeker with over ten years of experience in debt and accounts management, applied twice for a position at a housing company (the controller) on 3 August 2022 and 3 December 2022. The controller did not respond to either application. On 18 May 2023, the data subject requested access to his personal data under Article 15 GDPR. After receiving no response, he sent reminders on 3 June 2023 and 18 June 2023, with deadlines of 17 June 2023 and 28 June 2023. The controller still did not respond. The data subject then filed a lawsuit at the Labour Court Düsseldorf ("Arbeitsgericht Düsseldorf - AG Düsseldorf") seeking a copy of his data, information on all the recipients to whom his personal data was disclosed to, and €5,000 in non-material damages. The first instance court ruled partially in favour of the data subject, granting the access request but denying the claim for non-material damages. The court held that a violation of Article 15(1) GDPR always means a loss of control and cannot be considered as the damage itself. Therefore, the court found that the data subject did not demonstrate any non-material damage entitling him to compensation. The data subject then appealed this decision at the Regional Labour Court Düsseldorf ("Landesarbeitsgericht Düsseldorf - LAG Düsseldorf"), adjusting his claim to €2,500 in non-material damages. First, the court held that the controller violated Article 15 GDPR in conjunction with Article 12(3) GDPR by not providing information on the data subject's personal data, its processing purposes, and the recipients of the personal data to the data subject after repeated requests. Second, the court determined whether the violation under Article 15 GDPR gave rise to a claim for compensation for material and non-material damage under Article 82(1) GDPR. The court held that Article 82(1) GDPR should not be interpreted too narrow. The court took into account that some case law take the view that violations under Artic
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 11 Sa 808/23 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
7 March 2024
Authority
DPA AGDsseldorf
About this data
Cite as: Cookie Fines. Court case 11 Sa 808/23 - Germany (2024). Retrieved from cookiefines.eu
Last updated: