For the first time, a labor court has awarded a former employee damages for violation of the right to information under the GDPR against his employer. The decision issued by the Dusseldorf Labor Court on March 5, 2020 is not final and an appeal is pending.
The subject of the dispute was an application for information on which personal data are stored by his former employer pursuant to Art. 15 of the GDPR. The former employer did not comply with the former employee’s request for information in time. More than six months after the request for information, the former employer did provide information, but it was incomplete. In particular, information on the purposes of the processing was missing.
The former employee brought an action before the Düsseldorf Labor Court for damages (among other things) for the late and incomplete information on the processing of his personal data. The former employee did not suffer any material damage due to the delayed and incomplete information. However, the Chamber ordered the former employer to pay damages in the total amount of EUR 5,000 to compensate for the non-material damage suffered as a result of the violation of the right to information under the GDPR. In assessing the amount of the claim, the court took into account in particular that the intention of the GDPR is to sanction violations effectively, and therefore the damages must also have a deterrent effect. In its decision, the Chamber also considered whether the sanction had an economic impact on the former employer. Based on financial strength, companies should generally be required to pay higher amounts of damages than individuals. According to the Chamber’s findings, the fact that the data protection rights of the former employee were violated both in terms of the time it took to receive the information and in the kind of content provided also had an influence on the amount of damages.
Every employer should urgently note that they have an obligation not only towards customers and suppliers, but also towards (current and former) employees, to provide comprehensive and complete information about the personal data stored or processed by them according to Art. 15 of the GDPR. Currently, such requests for information from (former) employees are rather rare. However, they are likely to increase in the future, as data protection as a whole is gaining importance. A request for information can be made without having to comply with a special form. Since a particular form does not have to be observed, there is a high risk that a request for information may be overlooked in day-to-day business. This should be avoided at all costs and the employer must provide appropriate structures for this. A request for information must be answered completely and in good time in order to exclude the risk of a violation of the GDPR. In accordance with Art. 12 para. 3 of the GDPR, requests for information must be answered without delay, at the latest within one month. In exceptional cases, it is possible to extend the deadline by two months, but the person who made the request for information must be informed within one month.
Of course, we would be happy to advise you on employer-related data protection issues.
