The right to information in the employment relationship

Data protection aspects play a major role in the employment relationship and are also becoming increasingly important in labour court disputes. On the one hand, this concerns the question of whether breaches of data protection regulations lead to the inadmissibility of evidence in court proceedings. On the other hand, employees and their lawyers are increasingly focussing on the right to information under data protection law. Its fulfilment involves considerable effort for the employer and possibly provides the employee with information that is helpful in legal disputes with their employer.

Right to information according to Art. 15 GDPR

The employee's right to information about their personal data is set out in Art. 15 para. 1 of the General Data Protection Regulation ("GDPR"). In addition to information about the processed data, the employee is also entitled to a copy of the processed data (Art. 15 para. 3 GDPR). Employers are obliged to fulfil the claim in full within one month of the employee asserting it at the latest.

Limitation of the right to information by the Federal Labour Court

As the employer usually stores large amounts of information about the employee, it is hardly possible for the employer to provide complete information about all processed data - at least with reasonable efforts. The Federal Labour Court helps the employer to fulfil the right to a copy: The employee must specify the data requested and name it specifically. The Federal Labour Court derives this from Recital 63 of the GDPR, according to which, when processing large amounts of information, the controller may require the applicant to specify which information or processing operations the request for information relates to.

Refusal of the right to information only possible in exceptional cases

According to the case law of the Federal Labour Court, the employer may exceptionally refuse the employee's request for information. This is the case if the request was made abusively or excessively frequently. However, this does not apply to cases in which the employee uses their right to information for motives unrelated to data protection or if providing the requested information about the data causes the employer significant efforts.

The employer can also refuse a request for information if the rights of third parties or the confidentiality of information conflict with the request. This includes, in particular, business secrets of the employer or customers, but also data and information that is subject to attorney-client privilege. In all cases, the employer has the burden of proof and must explain the specific circumstances that prevent the disclosure of information.

Courts are reluctant to grant immaterial damages

If the employer does not comply with the request for information, the employee may be entitled to non-material damages in accordance with Art. 82 para. 1 GDPR. However, courts are reluctant to grant such a claim for damages in line with the case law of the European Court of Justice (“ECJ”). The ECJ has ruled (judgement of 4 May 2023, C-300/21) that there is no materiality threshold for the assertion of a claim for damages. On the other hand, the ECJ has emphasised that overcompensation must be avoided and that mere violations of the provisions of the GDPR are not sufficient to justify a claim for damages. Persons affected by a breach of the GDPR must therefore demonstrate that the failure to provide information has led to non-material damage within the meaning of Art. 82 GDPR. The Baden-Württemberg Regional Labour Court (judgement of 27.07.2023, Ref. 3 Sa 33/22) does not consider the plaintiff's submission that he was deprived of his rights and freedoms to control his personal data to be sufficient. His statements were “a mere empty formula without any substantive substance”, which does not include a statement of even minor concrete non-material damage. "Mere annoyance" on the part of the data subject is not sufficient.

Fines possible

Nevertheless, employers should take the right to information seriously. After all, employees could complain about any breaches to the competent state data protection authority. If the authority establishes a wilful breach of the GDPR, it can impose a fine on the employer in accordance with Art. 83 Para. 5 GDPR. The fine is far more severe (up to 4% of the company's annual turnover) than compensation payments for non-material damages that were granted so far.

Proper deletion concept is important

As part of data protection compliance, employers should routinely check where and for how long employees' personal data is stored. It is important to have a deletion concept to ensure that personal data is deleted after the retention periods have expired. This also helps to fulfil the right to information: data that has already been deleted on the basis of a deletion concept at the time of the request for information can no longer be shared with the employee.