A (data subject) – Court Ruling (Germany, 2025)

The data subject was employed by a company (the controller) for one month in 2016. In 2022 the data subject filed a request, asking for information about any ongoing processing of his data. The controller responded but the data subject considered the response to be incomplete: in the data subject’s view, the response did not provide sufficient details about the completeness of the copied provide to them, the duration of the data storage, and the specification of the recipients of the data. After some back-and-forth, the controller eventually provided the information he requested, two months after the initial request. The data subject asked the controller for monetary compensation for the delay. After the controller refused, the data subject sued the controller with the Labour Court, claiming damages under Article 82(1) GDPR. Specifically, the controller claimed that he suffered non-material damages over a week-long loss of control over his personal data, due to the controller's delayed response. The Labour Court awarded €10,000 in damages but the controller appealed the decision. Later, the Regional Labour Court overruled the decision and rejected the damage claim. In turn, the data controller challenged the appeal before the Federal Labour Court- Germany’s court of last instance for labour cases. Before this Court, the data subject claimed that a delay in responding to an access request, in and of itself, constitutes a loss of control over one’s data and gives rise to a claim for non-material damages under Article 82(1) GDPR. The Court upheld the appealed decision and denied damages. In particular, the Court held that the controller’s delay in responding to an access request, does not, in and of itself, constitute a loss of control (and, therefore, does not necessarily cause non-material damage). The Court used the case law of the EU Court of Justice as a starting point. With regards to the compensation of non-material damage, the CJEU held that a loss of control