Court case Az. 8 AZR 209/21 – Court Ruling (Germany, 2025)

The data subject is an employee of the controller, a Germany-based company, belonging to an international Group whose parent company is based in the US. In 2017, the Group introduced a new cloud-based HR software for testing, as a new uniform personnel information management system throughout the group. The provisional agreement for the new software stipulated that its use for personnel administration during the test period was prohibited and that and only certain personal data could be used at that point like surname, first name, date of joining the Group, place of work, business telephone number. Contrary to the agreement, the controller uploaded the data subject’s, salary information, private residential address, date of birth, marital status, social security number, nationality and his tax ID to the Group’s cloud which were processed there till 2019. The data subject filed a case before the Labour Court claiming that the processing of real personal data was not necessary for testing purposes but rather so-called dummy test data was sufficient for the test phase. In any case, the controller processed data beyond what was permitted in the agreement. He claimed compensation in non material damages in the amount of €3,000. The Labour Court (ArbG Ulm) dismissed the action and the Regional Labor Court (LAG Baden-Württemberg) dismissed the data subject’s appeal. In 2022, the data subject further appealed this judgement before the Federal Labour Court. The Federal Labour Court, requested a preliminary ruling from the CJEU on legal questions concerning the interpretation of Article 88(1) GDPR in connection with agreements for the purposes of employment pursuant to the Federal Data Protection Act (BDSG) Section 26 para. 4 Federal Data Protection Act (BDSG). The CJEU ([https://curia.europa.eu/juris/liste.jsf?language=de&jur=C,T,F&num=C-65/23 C-65/23]) stated that that national rules adopted for the processing of personal data in the employment context must comply