morton douglas markenrecht 3.jpglukas kalkbrenner markenrecht.jpg

Pain Compensation after Violation of Data Protection

While immaterial claims for damages by consumers under the General Data Protection Regulation (GDPR) have played only a minor role in previous case law, they could now become considerably more important after a recently published labor court decision.

Background

When the GDPR was enacted, companies feared warning letters and, above all, fines for data protection violations. However, the number of data protection fine proceedings is still manageable in view of limited capacities of the authorities; the same applies to data protection warning letters, since on the one hand it is (still) not yet conclusively clear whether data protection violations can effectively be subject to a cease-and-desist letter at all, and on the other hand there is regularly the risk of a "boomerang", i.e. a counter-warning letter.

According to Section 82(1) GDPR, however, every natural person who has suffered immaterial damage due to a violation of data protection law also has an individual claim for damages against the responsible company. Since mistakes in data protection usually have an impact on a large number of data subjects, this liability for damages can in principle mean significant economic disadvantages for a company.

This fear has not yet been confirmed by the case law on Section 82 GDPR: For example, the Dresden Higher Regional Court (decision of December 11, 2019 - file no. 4 U 1680/19) ascribed to the deletion of a social media post "at best a trivial character, which does not justify the award of immaterial damages". In a further case, the Karlsruhe Regional Court (judgment of August 2, 2019 - file no. 8 O 26/19) held that a violation of the GDPR alone does not lead to a claim for damages for general preventive reasons.

Paradigm shift?

The Düsseldorf labor court, which awarded a former employee 5,000.00 Euro in immaterial damages for a request for information pursuant to Section 15 GDPR, which was not processed in due time and was incomplete, now takes a different view (judgment of March 5, 2020 - file no. 9 Ca 6557/18, not legally binding). In the opinion of the court, there was no de minimis threshold and immaterial compensation must be a deterrent in order to take account of the principle of effectiveness under European law.

In light of the previous case law, the decision from Düsseldorf is remarkable and shows that the large number of theoretically conceivable compensation proceedings - asserted in particular by former employees who had not been parted from in good faith - can represent a serious risk for companies. Against the background of the considerations of the court, compensation for inadmissible employee surveillance is likely to be significantly higher than was the case under the Regional Labor Court Mecklenburg-Vorpommern in connection with an illegal video surveillance (only 1,500.00 Euro compensation; judgment of May 24, 2019 - file no. 2 Sa 214/18).

It remains to be seen whether this decision by the Düsseldorf labor court will lead to a paradigm shift in the sentencing of damages for data protection violations, even outside the field of labor law. In any case, the ruling shows that companies have to continuously review and, if necessary, adjust their internal processes relevant to data protection law in order to prevent violations from occurring in the first place, especially in relation to a large number of data subjects. In addition, this ruling is likely to encourage both consumers and lawyers specializing in this area to initiate such proceedings now in order to obtain economically significant compensation payments via courts that follow this view.

1:1. This is how we work together. You decide upon a competent partner; he/she will then remain your point of contact. > more