Significant compensation claims by employees in case of GDPR infringements

Art. 82 (1) of the GDPR stipulates a claim for non-material damages if a data controller breaches its obligations under the GDPR. A case recently decided by Düsseldorf Labor Court (ArbG Düsseldorf, March 5, 2020 – 9 Ca 6557/18) underlines that this provision can also have an impact on the employment relationship and can lead to considerable compensation obligations of the employer. A former employee had asserted various requests for information concerning his employee data on his employer. The employer not only responded to these requests for information belatedly, but also, in part, insufficiently. The Düsseldorf Labor Court did not discover a particularly serious breach. Nor did the employee suffer any particular damage. Nevertheless, the Düsseldorf Labor Court awarded the employee a claim for compensation for non-material damages in the amount of EUR 5,000.

The Düsseldorf Labor Court ruled that the claim was not tied to a particular severity of the breach of obligations. The court argued that the concept of compensation was to be interpreted in a sense which would best serve the objectives of the GDPR. Accordingly, the court did not require any particular significance of the infringement. Also of interest is, that the amount of compensation was linked to the actual financial strength of the employer. According to the argumentation of the Düsseldorf Labor Court, financially strong companies are likely to be exposed to higher amounts of compensation claims than companies that are in a weak economic position.

But what consequence does the ruling have for employers? Due to the density of regulations and the strict requirements of GDPR, employers are already faced with almost insurmountable tasks. For example, requests for information under data protection law pursuant to Art. 15 GDPR not only have to be answered usually within a month, the answers also have to comply with all the requirements of Art. 15 GDPR in terms of content.

If the ruling of the Düsseldorf Labor Court is upheld, employers would be exposed to a claim concerning compensation for immaterial damages for every breach of obligations concerning the time and content requirements of GDPR, however minor it might be. This claim would no longer have any further requirements, since even the slightest breach of obligations would justify a claim for compensation under Art. 82 (1) GDPR.

The lawsuit is currently in the appeal stage before the Düsseldorf Higher Labor Court (14 Sa 294/20). It therefore remains to be seen how the Düsseldorf Higher Labor Court will rule on the case. Due to the decision of the Düsseldorf Labor Court, employers should, however, already consider how they can introduce automated processes for answering the impending requests for information from their employees in a timely and content-oriented manner. This is the only way to proactively counteract the otherwise threatening claims for compensation and avoid risks. We remain alert and will inform you about the further progress of the appeal proceedings …

Dr. Tobias Brors, LL.M. und Sebastian Krumnack