Court case 2 Ca 4416/23 – Court Ruling (Germany, 2024)

The data subject applied for a job position at the controller. As his application was rejected, the data subject wanted to know the reasons for the rejection and requested from the controller a copy of his personal data under Article 15 GDPR. However, the controller only provided a printout of the stored data to the data subject. Subsequently, the data subject filed a complaint against the controller before the labour court in Düsseldorf ("Arbeitsgericht Düsseldorf"), seeking all information about recipients of his personal data, reasons for rejection of his job application, and a copy of all of his personal data. The data subject also requested €6,000 for non-material damages under Article 82 GDPR. During the course of the proceedings, the first three claims were settled as the controller provided the requested information in the written statement. The monetary compensation was reduced to €2,000. The data subject still claimed non-material damages because the controller failed to provide access under Article 15 GDPR without undue delay and in any event within one month, which resulted in a loss of control over his data. The data subject was also massively annoyed that the controller did not properly fulfil his right to access. The court dismissed the data subject's claim for monetary compensation under Article 82(1) GDPR as he was unable to demonstrate either non-material damage or the causal nexus between the violation of the GDPR and the damage. The court took into account the CJEU judgements in case C-667/21 - Krankenversicherung Nordrhein and C-687/21 - Saturn Electroand held that Article 82(1) GDPR is not about punitive damages for a violation of the GDPR. It merely fulfils a compensatory function as a genuine claim for damages. Therefore, a claim for damages would require a violation of the law as well as damage caused as a result of the violation of the law. Thus, there must also have been negative consequences for the person to claim damages. The court took into account the CJEU judgement in C-687/21- Saturn Electro and held that damage must be a sufficiently justified and demonstrable fear and that the mere assertion of a "loss of control" is not sufficient. The court further held that the burden to prove existence of such damage lies upon the data subject. But as the data subject had not provided any evidence to sufficiently and specifically set out the factual prerequisites of damage and causality, his claim was dismissed.