- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
The Federal Republic of Germany – Court Ruling (Germany, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Federal Court of Justice ruled that the Federal Republic of Germany unlawfully processed personal data of an employee. This case is significant as it clarifies that losing control over personal data can lead to claims for damages.
What happened
The court found that the Federal Republic of Germany unlawfully allowed State employees to access personal data without proper justification.
Who was affected
An employee whose personal data was accessed by State employees without lawful grounds.
What the authority found
The court held that the employee lost control over their data due to unlawful access, which could warrant compensation.
Why this matters
This ruling reinforces the idea that individuals can seek damages for loss of control over their personal data, even when confidentiality obligations exist.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
Processing notes: national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Until 2019, personnel files for an unnamed federal institute in Hannover were managed by the employees of the State of Lower Saxony. An employee of the Institute (the data subject) objected to this practice several times and eventually filed a complaint with the DPA. Additionally, the data subject sued the Federal Republic of Germany. In her lawsuit, the data subject claimed that the processing of personal data by the employees of the State of Lower Saxony was unlawful and cause non-material damage. The Federal Republic conceded that the processing of personal data was unlawful but contested the claim for damages. The Regional Court and the Higher Regional Court both rejected the claim for damages. In particular, the Court of Appeal rejected the claim for two reasons. First, personal data was transmitted to State employees under an obligation of confidentiality. For this reason, the data subject did not lose control of their data. Second, the Court held that even if a loss of control had occurred in the case at hand, the mere loss of control over personal data did not, in itself, constitute a form if immaterial damage. The Federal Court of Justice reversed the Higher Regional Court’s findings on the damages. Throughout the ruling, the Court consistently referred to the case law of the EU Court of JusticeThe Court referred to numerous cases. See for instance: CJEU C-456/22, Gemeinde Ummendorf, 14 December 2023 (available [https://curia.europa.eu/juris/document/document.jsf?docid=280630&doclang=en here]): C-687/21, MediaMarktSaturn, 25 January 2024 (available [https://curia.europa.eu/juris/document/document.jsf?docid=282062&doclang=en here]). First, the Court held that the data subject lost control of their data due to the unlawful access of State employees. In this regard, the Court held that the fact that the State employees were under an obligation of confidentiality, did not exclude a loss of control. However, the Court held that these confidentiality obligation
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for The Federal Republic of Germany in DE
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
11 February 2025
Authority
DPA OLGCelle
About this data
Cite as: Cookie Fines. The Federal Republic of Germany - Germany (2025). Retrieved from cookiefines.eu
Last updated: