A (data subject) – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a former employee could not claim damages for a delay in receiving information about their personal data. This is important because it clarifies that just having to wait for a response does not automatically mean someone has lost control over their data. The court ultimately denied the claim for damages.
What happened
A former employee sued their company for damages due to a delay in responding to their request for personal data.
Who was affected
The former employee who requested information about their personal data from their previous employer.
What the authority found
The court held that the delay in responding to the access request did not constitute a loss of control over personal data, so no damages were awarded.
Why this matters
This case sets a precedent that delays in data access requests may not always lead to claims for damages. It reminds businesses to respond promptly but also clarifies the limits of liability.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The data subject was employed by a company (the controller) for one month in 2016. In 2022 the data subject filed a request, asking for information about any ongoing processing of his data. The controller responded but the data subject considered the response to be incomplete: in the data subject’s view, the response did not provide sufficient details about the completeness of the copied provide to them, the duration of the data storage, and the specification of the recipients of the data. After some back-and-forth, the controller eventually provided the information he requested, two months after the initial request. The data subject asked the controller for monetary compensation for the delay. After the controller refused, the data subject sued the controller with the Labour Court, claiming damages under Article 82(1) GDPR. Specifically, the controller claimed that he suffered non-material damages over a week-long loss of control over his personal data, due to the controller's delayed response. The Labour Court awarded €10,000 in damages but the controller appealed the decision. Later, the Regional Labour Court overruled the decision and rejected the damage claim. In turn, the data controller challenged the appeal before the Federal Labour Court- Germany’s court of last instance for labour cases. Before this Court, the data subject claimed that a delay in responding to an access request, in and of itself, constitutes a loss of control over one’s data and gives rise to a claim for non-material damages under Article 82(1) GDPR. The Court upheld the appealed decision and denied damages. In particular, the Court held that the controller’s delay in responding to an access request, does not, in and of itself, constitute a loss of control (and, therefore, does not necessarily cause non-material damage). The Court used the case law of the EU Court of Justice as a starting point. With regards to the compensation of non-material damage, the CJEU held that a loss of control
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for A (data subject) in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. A (data subject) - Germany (2025). Retrieved from cookiefines.eu
Last updated: