Employee versus Employer – Court Ruling (Germany, 2024)

The data subject was an employee at a company. Him and the employer (controller) had a difficult relationship, after the latter had unsuccessfully tried to let him go for not adequately fulfilling his duties. Then he decided to relocate him in another region, despite the data subject's opposition. On 4 February 22, the data subject submitted a medical certificate for incapacity to work for the period between 4 February and 4 March 2022, due to an injury suffered outside of working hours on that day. The controller suspected a feigned illness and engaged a detective agency to monitor the employee during that period. The investigators observed him in public areas and near his home, recording his physical activities such as shopping, carrying heavy objects, and working on his terrace. When the data subject became aware of it, he filed a case before the court of first instance (Regional Labor Court of Düsseldorf - AG Düsseldorf) seeking compensation for immaterial damages at least €25,000, under Article 82(1) GDPR, for the unlawful processing of his personal data and especially health data. The Labour Court dismissed the claim, holding that the controller had legitimate interest in the surveillance and it was necessary for the exercise of his rights under Article 9(2)(b) GDPR in conjunction with § 26(3) of the German Federal Data Protection Act (BDSG). On the data subject's appeal, the court (Higher Labour Court of Düsseldorf -LAG) overturned the ruling and ordered the controller to pay compensation in the amount of €1,500. Both parties appealed to the Federal Labour Court (BAG). The data subject sought a higher sum while the employer sought dismissal of all damages. The Federal Labour Court dismissed both appeals, upholding the award of €1,500 in damages under Article 82(1) GDPR. First, it found that observing and documenting the data subject’s physical condition, such as his gait and mobility, constituted processing of health data under Article 9(1) GDPR. Se