The plaintiff was employed by the customer service department of a real estate company, the defendant, from December 1, 2016 to December 31, 2016. He had already submitted a request for information pursuant to Art. 15 GDPR in 2020, to which the defendant responded.
In a letter dated October 1, 2022, which the defendant received on that day, he again requested information and a copy of the data on the basis of Art. 15 GDPR. He set a deadline of 16.10.2022. When the defendant did not respond, the plaintiff sent a reminder by letter dated 21.10.2022, setting a further deadline of 31.10.2022. In a letter dated 04.11.2022, the plaintiff complained that the information provided to him by letter dated 27.10.2022 was late and lacking in content. It lacked specific information on the duration of data storage and the named recipients of his data. In addition, the data copy was incomplete. In a letter dated 11.11.2022, the defendant informed the plaintiff that the information on the data recipients was generally of no interest to the data subjects and had therefore only been provided in categorized form. It also specified the information on the storage period and the data copy. In a letter dated 18.11.2022, the plaintiff again requested that the recipients be named and also requested more detailed information on the storage period. The data copy was still insufficient. The defendant specified the information in a letter dated 01.12.2022.
The plaintiff demanded monetary compensation from the defendant pursuant to Art. 82 para. 1 GDPR at the discretion of the court, which should not be less than EUR 2,000, because his right to information under Art. 15 GDPR had been violated by the defendant on several occasions. The latter objected to this because, among other things, the plaintiff had already suffered no material damage.
Unlike the labor court, which had awarded the plaintiff monetary compensation of EUR 10,000 due to the defendant's alleged intentional infringement, the 3rd Chamber of the Düsseldorf Regional Labor Court today dismissed the claim in its entirety. It was true that the defendant had breached Art. 12 para. 3 GDPR and Art. 15 GDPR. It had not provided the information on time and had initially provided incomplete information. Complete information was only provided on December 1, 2022, i.e. six weeks after the deadline set by the plaintiff had expired. For two reasons, however, this does not justify a claim for monetary compensation pursuant to Art. 82 para. 1 GDPR. A breach of Art. 15 GDPR does not fall within the scope of Art. 82 GDPR. The provision presupposes data processing in breach of the GDPR as a basis for liability. This is lacking in the case of a mere breach of the obligation to provide information under Art. 15 GDPR - whether this is delayed or initially incompletely fulfilled. Irrespective of this, Art. 82 GDPR presupposes more than a mere breach of the provisions of the GDPR for a claim for monetary compensation for non-material damage. The mere loss of control over the data cited by the plaintiff was not sufficient and was ultimately identical to the breach of Art. 15 GDPR. The plaintiff failed to provide any concrete evidence of further immaterial damage.
The Regional Labor Court allowed the appeal.
Düsseldorf Regional Labor Court, judgment of 28.11.2023 - 3 Sa 285/23
Duisburg Labor Court, judgment of 23.03.2023 - 3 Ca 44/23
