No compensation for late and incomplete information pursuant to Art. 15 GDPR

Compensation for late and incomplete information pursuant to Art. 15 GDPR in accordance with Art. 82 GDPR cannot be considered if no corresponding damage is also presented. This was decided by the LAG Düsseldorf in its ruling of November 28, 2023 - 3 Sa 285/23.

Facts of the case

The ruling of the Düsseldorf Higher Labor Court ("LAG") is based on the following facts: The plaintiff was employed in the customer service department of a real estate company in 2016. After leaving the company, he submitted an request pursuant to Art. 15 GDPR to the defendant company in 2020. On October 1, 2022, as part of a new request for information from the defendant, he set a deadline of October 16, 2022, and again requested information and a copy of the data on the basis of Art. 15 GDPR. After the defendant did not respond, the plaintiff sent a reminder by letter dated October 21, 2022, and set a further deadline of October 31, 2022. On October 27, 2022, the defendant provided the plaintiff with the relevant information. However, in a letter dated November 4, 2022, the plaintiff objected to this as being late and incomplete. In his opinion, there was a lack of specific information on the duration of data storage and the named recipients of his data. Furthermore, the data copy was incomplete. The defendant informed the plaintiff in a letter dated November 11, 2022, that the information on the data recipients was generally of no interest to the data subjects and had therefore only been provided in categorized form. The defendant specified the information on storage duration and data copying. In a letter dated November 18, 2022, the plaintiff again demanded that the recipients be named and more detailed information on the storage period. In his opinion, the data copy was still insufficient. In response, the defendant specified the relevant information in a further letter dated December 1, 2022.

The plaintiff then claimed monetary compensation pursuant to Art. 82 para. 1 GDPR, which he left to the discretion of the court, but which should not be less than EUR 2,000. In his opinion, the right to information under Art. 15 GDPR had been violated several times by the defendant. The latter contradicted the plaintiff's submission. There was already no non-material damage.

The first instance labor court awarded the plaintiff monetary compensation in the amount of EUR 10,000.

Reasons for the decision

The LAG Düsseldorf dismissed the action. The court found that the defendant had breached Art. 12 (3) GDPR and Art. 15 GDPR, as it had not provided the information on time and had initially provided incomplete information. The complete information was only provided on December 1, 2022, six weeks after the deadline set by the plaintiff had expired. However, this does not justify a claim for monetary compensation pursuant to Art. 82 para. 1 GDPR. For example, Art. 15 GDPR does not fall within the scope of Art. 82 GDPR, which requires data processing in breach of the GDPR to justify liability. However, this is not the case with the mere breach of the duty to provide information under Art. 15 GDPR. Furthermore, Art. 82 GDPR presupposes more than a mere breach of the provisions of the GDPR for a claim for monetary compensation for non-material damage. The loss of control over the data cited by the plaintiff is not sufficient, as this is ultimately identical to a breach of Art. 15 GDPR. With regard to immaterial damage, however, there is a lack of concrete submission by the plaintiff.

Note for the practice

The reasons for the judgment of the LAG Düsseldorf are not yet published. It therefore remains to be seen whether the decision can serve as guidance in the complex employment law casuistry on Art. 82 GDPR. However, the ECJ has now clarified that anyone wishing to rely on Art. 82 GDPR in the context of a breach of the duty to provide information must demonstrate and prove specific damage (see ECJ May 4, 2023, C-300/21). According to the ECJ, the damage does not have to reach a certain level of materiality. However, as is probably decisive in the present case, the mere allegation of a breach of the GDPR alone is not sufficient. The LAG has allowed the appeal.