Andersen

Employers face far-reaching sanctions for data protection violations under the General Data Protection Regulation (GDPR). On the one hand, the competent data protection authority can impose a fine of up to EUR 20 million or 4% of the company's total annual turnover worldwide. In addition to this sanction, employees can also claim damages and compensation against the employer (Art. 82 GDPR). This is increasingly occupying the German labor courts.

In the following, we will first briefly present the requirements of Article 82 of the GDPR. We will then discuss several court decisions from the years 2020 and 2021 and conclude by showing you what you as an employer should pay attention to in order to behave in a data protection-compliant manner.

What's at issue?

If employers commit data protection violations (e.g., due to unlawful data processing or unanswered requests for information from employees), they must compensate their employees for both material and non-material damages pursuant to Art. 82 GDPR. A quantifiable material damage of the data subject (e.g., loss of profit) will generally be excluded. However, according to the prevailing opinion of the (labor) courts, the concept of immaterial damage due to an infringement of personality rights is to be interpreted broadly.[1] Thus, according to the recitals of the GDPR, non-material damage to be compensated can be considered, for example, in the case of discrimination, identity theft, damage to reputation or other significant economic or social disadvantages.[2] In view of this, labor courts regularly uphold claims for damages by employees due to data protection breaches by the employer and order the employer to pay appropriate damages.

What have the courts decided lately?

The Münster Labor Court[3] upheld the claim for damages for pain and suffering brought by an employee (a so-called post-doc coordinator) against her employer, a university. The reason for the employee's action was that the university used photos of her in the context of a marketing campaign although she had not signed a declaration of consent submitted to her beforehand. The Labor Court concluded that the use of the photos in the absence of the employee's written consent constituted a breach of data protection. For this reason, the court ordered the university to pay compensation for pain and suffering in the amount of EUR 5,000.00. This corresponds to approximately one gross monthly salary of the employee.

According to a decision of the Düsseldorf Labor Court[4], an employer who was several months late in[5] providing his employee with information on the personal data he processed also had to pay compensation for pain and suffering in the amount of EUR 5,000. In addition, the employer failed to inform him of the purposes of processing and the categories of personal data stored about him. In its judgment, the Labor Court emphasized that non-material damage was not only present in "obvious cases", but that the concept of damage should be interpreted broadly. The severity of the non-material damage was irrelevant for the establishment of liability. This only affects the amount of the claim.

The Higher Labor Court (LAG) Hamm[6] also awarded an employee damages after the employer provided only rudimentary answers to a request for information by the employee in a separation situation. However, in determining the amount of the damages for pain and suffering, the court took into account the (litigation) conduct of the employee. The court doubted that the employee only asked for information for the purpose of controlling the data processing, because he had not pursued this "persistently". Therefore, it only awarded damages in the amount of EUR 1,000.00.

However,[7] according to a ruling of the Higher Labor Court Cologne, legal fees do not constitute recoverable damage within the meaning of Article 82 GDPR. The Higher Labor Court of Cologne clarified that the labor law cost regulation in Section 12a of the German Labor Court Act (ArbGG) is not superseded by the liability rules of the GDPR. The cost regulation in Section 12a ArbGG states that both parties have to bear their own (extra-) judicial costs (e.g., lawyer's fees). The consequence of this special cost regulation under labor law is that the losing party in a labor court case, unlike in a civil court case, only has to bear the court costs, but not the lawyer's fees of the other party.

What should you do as an employer or company?

Although the GDPR has been in force for almost three years, in our experience there is still potential for improvement in many companies. Employers should be aware of the requirements and obligations resulting from the GDPR and check whether there are weak points and/or potential for improvement in the company. The fact that doing nothing is not a solution is made clear not only by the increasing claims for damages by employees, but also most recently by the penalty notice against Deutsche Wohnen SE in the amount of EUR 14.5 million.[8] In the opinion of the data protection authority, Deutsche Wohnen SE had failed to delete archived and redundant (old) tenant data despite prior reprimand. However, Deutsche Wohnen SE is taking legal action against the fine notice. It is therefore still open whether the penalty notice will be upheld.

Please do not hesitate to contact us if you have any questions.

[1] The European Court of Justice will in all likelihood have to decide within the framework of a so-called preliminary ruling procedure whether the data protection infringement must exceed a certain materiality threshold (cf. BVerfG, order of 14 January 2021, ref.: 1 BvR 2853/19).

[2] See recital 146 of the GDPR.

[3] ArbG Münster, BeckRS 2021, 13039.

[4] ArbG Düsseldorf, NZA-RR 2020, 409.

[5] Employers have one month, in exceptional cases a maximum of three months, to provide information (Article 15(3) of the GDPR).

[6] LAG Hamm, NZA-RR 2021, 517. 

[7] LAG Cologne, BeckRS 2020, 31543.

[8] Cf. Deutsche Wohnen SE press release of 5 November 2019, available at: https://www.deutsche-wohnen.com/ueber-uns/presse-news/pressemitteilungen/deutsche-wohnen-geht-gegen-bussgeldbescheid-der-berliner-beauftragten-fuer-datenschutz-und-informationsfreiheit-vor; beck-aktuell news release of 6 November 2019, becklink 2014613.