Court case 3 Ca 77/24 – Court Ruling (Germany, 2024)

The controller was president of a large association of air sports clubs ("the association") and the data subject was an employee of this association. On 11 May 2023, the data subject wrote an email to 24 people, including the controller, in which the data subject addressed, among other things, his health situation and its cause. In her capacity as president, the controller sent a circular to all (almost 10,000) members of the association on 11 June 2023 stating that the data subject - despite being on sick leave since November 2022 - had made unfounded allegations against (among others) the controller. On the 6 June 2023, the controller terminated the employment relationship with the data subject. However, subsequently the controller was voted out of her position as president of the association. The data subject then continued to work for the association as it retracted the termination of employment. The data subject was affected in his daily life at the airport (the location of the association's air sports activities) by the controller's circular. In particular, when the data subject met new people from the numerous airports and clubs affiliated with the association, he was confronted with the controller's circular. The data subject demanded at least €17,000 in non-material damages from the controller for degrading him by publishing sensitive data, namely his illness and its duration. Furthermore, the data subject argued, that the controller gave the impression that the data subject was damaging the association by falsely "calling in sick". The court held, that the data subject is entitled to €10,000 compensation from the controller in accordance with Article 82(1) GDPR. The court found that the controller had violated the lawfulness principle in article 5(1) GDPR and that they had processed special categories under article 9(1) GDPR unlawfully. The court further elaborated that the controller had processed data without consent from the data subject and tha