Court case Az. 8 AZR 209/21 – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled on a case involving an employee whose personal data was improperly uploaded to a cloud system during a software test. The court decided that the employee's data was not necessary for testing purposes. This case is significant as it reinforces the need for companies to limit data processing to what is strictly necessary.
What happened
The court ruled that the company improperly processed the employee's personal data beyond what was allowed during a software testing phase.
Who was affected
An employee whose personal information, including salary and address, was uploaded to a cloud system without proper justification.
What the authority found
The court found that the company violated data protection rules by processing personal data that was not needed for the testing of the software.
Why this matters
This ruling emphasizes the importance of data minimization in business practices. Companies should be cautious about the data they collect and ensure it aligns with their stated purposes.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The data subject is an employee of the controller, a Germany-based company, belonging to an international Group whose parent company is based in the US. In 2017, the Group introduced a new cloud-based HR software for testing, as a new uniform personnel information management system throughout the group. The provisional agreement for the new software stipulated that its use for personnel administration during the test period was prohibited and that and only certain personal data could be used at that point like surname, first name, date of joining the Group, place of work, business telephone number. Contrary to the agreement, the controller uploaded the data subject’s, salary information, private residential address, date of birth, marital status, social security number, nationality and his tax ID to the Group’s cloud which were processed there till 2019. The data subject filed a case before the Labour Court claiming that the processing of real personal data was not necessary for testing purposes but rather so-called dummy test data was sufficient for the test phase. In any case, the controller processed data beyond what was permitted in the agreement. He claimed compensation in non material damages in the amount of €3,000. The Labour Court (ArbG Ulm) dismissed the action and the Regional Labor Court (LAG Baden-Württemberg) dismissed the data subject’s appeal. In 2022, the data subject further appealed this judgement before the Federal Labour Court. The Federal Labour Court, requested a preliminary ruling from the CJEU on legal questions concerning the interpretation of Article 88(1) GDPR in connection with agreements for the purposes of employment pursuant to the Federal Data Protection Act (BDSG) Section 26 para. 4 Federal Data Protection Act (BDSG). The CJEU ([https://curia.europa.eu/juris/liste.jsf?language=de&jur=C,T,F&num=C-65/23 C-65/23]) stated that that national rules adopted for the processing of personal data in the employment context must comply
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case Az. 8 AZR 209/21 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case Az. 8 AZR 209/21 - Germany (2025). Retrieved from cookiefines.eu
Last updated: