A (data subject) – Court Ruling (Germany, 2025)

The data subject was employed by a company (the controller) for one month in 2016. In 2022 the data subject filed a request, asking for information about any ongoing processing of his data. The controller responded but the data subject considered the response to be incomplete: in the data subject’s view, the response did not provide sufficient details about the completeness of the copied provide to them, the duration of the data storage, and the specification of the recipients of the data. After some back-and-forth, the controller eventually provided the information he requested, two months after the initial request. The data subject asked the controller for monetary compensation for the delay. After the controller refused, the data subject sued the controller with the Labour Court, claiming damages under Article 82(1) GDPR. Specifically, the controller claimed that he suffered non-material damages over a week-long loss of control over his personal data, due to the controller's delayed response. The Labour Court awarded €10,000 in damages but the controller appealed the decision. Later, the Regional Labour Court overruled the decision and rejected the damage claim. In turn, the data controller challenged the appeal before the Federal Labour Court- Germany’s court of last instance for labour cases. Before this Court, the data subject claimed that a delay in responding to an access request, in and of itself, constitutes a loss of control over one’s data and gives rise to a claim for non-material damages under Article 82(1) GDPR. The Court upheld the appealed decision and denied damages. In particular, the Court held that the controller’s delay in responding to an access request, does not, in and of itself, constitute a loss of control (and, therefore, does not necessarily cause non-material damage). The Court used the case law of the EU Court of Justice as a starting point. With regards to the compensation of non-material damage, the CJEU held that a loss of control of control over one’s data is, in and of itself, non-material damage and therefore compensable under Article 82CJEU, Case C-200/23, Agentsia po vpisvaniyata, 4 October 2024, margin number 150 (available [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62023CJ0200 here]).. However, a merely hypothetical risk of data misuse, cannot, in itself, lead to compensationCJEU, Case C-687/21, MediaMarkt Saturn, 25 January 2024, margin number 68 (available here).. On this basis, the Federal Court of Labour held that data subjects can claim non-material damages over the loss of control over their data and the negative feelings caused by such loss of control. This was also true for a short-term loss of control that did not result in data misuse (as in the case at hand). However, the Court also held that in order to claim damages, data subjects must prove the loss of control. To this end, it is not enough for a data subject to simply claim that a GDPR violation created a hypothetical risk for data misuse. Rather, the data subject needs to prove that there was a concrete risk that their data would be misused. In other words: in order to claim non-material damages over loss of data control, data subjects need to prove that the loss of control actually occurred. This means proving that they had objectiveWith regard to the objective nature of this criterion, the Court referenced its own case law. See BAG July 25, 2024 - 8 AZR 225/23, margin number 33 and June 20, 2024 - 8 AZR 124/23, margin number 15. and well-founded reasons to worry about data misuse (again, regardless of whether their data were actually misused). In the case at hand, the data subject merely claimed that the controller’s response was late and that he suffered a negative emotional situation as a result of the delay. However, he did not claim that there was a risk of data misuse or prove the existence of this risk. The Court therefore rejected his damage claim.