The General Data Protection Regulation (GDPR) has, among other things, created comprehensive information rights for employees concerning the personal data stored about them by the employer. The employer has to provide the desired information within one month of hire date or request date?. The Labor Court of Düsseldorf ruled on March 5, 2020 (Ref.: 9 Ca 6557/18) regarding the right to information under Sec. 15 GDPR.
The underlying case was about the claims of an employee who had left the company. He demanded information about the data related to him. Since the former employer only fulfilled its obligation to give information hesitantly and also incompletely, the former employee asserted claims for damages. He demanded damages in the amount of an annual salary of over EUR 140,000.
Employer Obliged to Give Information
The Labor Court of Dusseldorf awarded the plaintiff a claim for damages. But the amount of EUR 5,000 was significantly lower than the former employee’s claim.
In addition, the court found that the former employer has to disclose information on
- the purposes for which the personal data of the plaintiff were processed
- the categories of personal data to be processed.
The court further stated that the information must be precise, transparent, comprehensible, easily available and in clear, simple language. Simple generalities and phrases were not sufficient. The information must instead be complete, concrete and detailed. If data have been transferred to other companies or authorities, further processing of the data by third parties is no longer subject to the employer’s obligation to give information.
Non-Material Damage Due to Violation of the Obligation to Give Information
As a result of the breach of the obligation to give information, the employee suffered non-material damage. Because of the fact that he was informed late and insufficiently, he was not able to examine the handling of his personal data. Therefore, he was entitled to damages under Article 82 GDPR. The court referred to the fact that the definition of non-material damage was to be interpreted broadly.
The damage is to be fully and effectively compensated to the data subject. Moreover, the amount of damages has to be dissuasive so that infringements can be effectively sanctioned.
The amount of the damages should take into account, among other things, the financial strength of the company. In the above-mentioned case, it was also taken into account in favor of the company that the infringements were only committed negligently. In the end, the Labor Court of Dusseldorf came to a claim for damages in the amount of EUR 5,000. This resulted from EUR 500 for each of the first two months of delayed information and EUR 1,000 for each of the three further months of delay as well as EUR 1,000 for two content defects. Thus, the court remained clearly below the employee’s claim.
The Labor Court of Dusseldorf allowed the appeal.
The ruling shows that employers need to take the implementation of the GDPR seriously. Violations can be expensive, even if the plaintiff was clearly unsuccessful with his demand. For this reason, it is advisable even for small and medium-sized companies to develop a data protection management system that also contains routines for handling requests for information from (former) employees but also from third parties. This will save time and reduce the effort for the company in such cases.
