Delayed disclosure of data – employee's claim for damages

Pursuant to Article 15 (1) of the GDPR (General Data Protection Regulation – Datenschutzgrundverordnung), employers are obliged to provide information to employees at their request as to whether personal data have been processed and, if so, which data are involved.

In order for an affected individual to obtain knowledge of the possible processing of his or her own data, a request from that person is required. This request is increasingly being made by those affected in the context of a dismissal protection suit in order to raise the pressure on the employer.

The judgement of the Oldenburg Labour Court

The case underlying the judgement of the Oldenburg Labour Court of 9 February 2023 (Cf. 3 Ca 150/21), a (former) employee asserted such a claim for information pursuant to Article 15 (1) of the GDPR. In addition to this disclosure claim regarding confirmation and information on the processing of personal data, a copy of the respective data was also demanded (Article 15 (3) GDPR). Without doubt, both entitlements were given, but they were denied by the employer. In the subsequent lawsuit, in which the employer provided some of the requested documents after 20 months, the employee now also claimed compensation for immaterial damages. In this way, he thereby claimed compensation for the previous refusal to provide information.

The Oldenburg Labour Court granted the plaintiff employee non-material damages in the amount of EUR 10,000. Various factors were decisive for this: (1) The employer should have fulfilled the claim pursuant to Article 12(3) of the GDPR within one month at the latest. (2) The plaintiff had a particular interest in obtaining the information due to the scope of the data requested. (3) The violation of the GDPR as such already results in a claim for damages. And (4) the GDPR does not require the employee to specify the damage or its amount. In this regard, the Oldenburg Labour Court refers to the case law of the Federal Labour Court, according to which the claim for damages under Article 82 (1) of the GDPR has a preventive character. Compared to other verdicts, however, the amount of damages is unusually high.

Employers should comply with any claim for information within one month of receiving the request

The fact that the responsible party must pay damages in the event of delay or even refusal of providing the requested information is not a novelty. Rather the opposite: This is unequivocally regulated by the claim for damages according to Article 82 of the GDPR. The only unusual aspect of the judgement is the extent of the compensation. Ultimately, however, it is based in particular on the defendant's extensive delay. If the defendant had not refused to provide the justified information over a period of one and a half years, the damages to be compensated could not have accumulated to the sum of EUR 10,000. The claimant's estimate of damages (EUR 500 per month of refusal of information) does not appear disproportionate. This judgement thus illustrates the preventive function of the regulation and urges that the requirements and entitlements of the GDPR should not be ignored under any circumstances and that any breaches should be remedied in a timely manner.

In contrast, disregarding justified claims for a longer period of time, can, as has been shown, go hand in hand with substantial damage payments. Especially against the background that the amount of the claim for damages does not have to be explained in detail by the employee and serves the purpose of prevention, extensive payments appear to be possible.