LAG Baden-Württemberg - 9 Sa 73/21

LAG Baden-Württemberg - 9 Sa 73/21
Court:	LAG Baden-Württemberg (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 15 GDPR Article 82 GDPR
Decided:	28.07.2023
Published:
Parties:
National Case Number/Name:	9 Sa 73/21
European Case Law Identifier:
Appeal from:
Appeal to:	Unknown
Original Language(s):	German
Original Source:	Landesrechtsprechung Baden-Württemberg (in German)
Initial Contributor:	mg

A German court ordered an employer to compensate their employee pursuant to Article 82 GDPR for having refused to comply with an access request, even if the processing at issue was a direct consequence of a disciplinary offence by the data subject.

English Summary

Facts

The data subject was employed by the controller, a company. After an alleged disciplinary offence, the data subject got a warning signed by the owner (and only shareholder) of the company. In particular, the letter stated that the data subject stored confidential information about the company on a USB pen drive. The owner of the company had found the USB and confiscated it.

The data subject asked for access to their personal data, including the content of the USB, claiming ownership over the latter. They also asked the warning to be erased under Article 17 GDPR. Finally, the data subject claimed their right to compensation for damages suffered as a consequence of the unlawful processing.

The owner declared that data originally stored on the USB were backed up and erased from the pen drive. They refused to grant access to the data and to delete the warning.

The court of first instance rejected the data subject’s claims. No erasure under Article 17 GDPR could be asked to the controller, as the employment relationship between the parties had meanwhile expired. Article 15 GDPR was not applicable either, since the data subject did not own the content of the USB, namely the confidential information unlawfully collected from the company. Therefore, there was no right to compensation pursuant to Article 82 GDPR.

The data subject appealed the decision before the Regional Labour Court of Baden-Württemberg (Landesarbeitsgericht Baden-Württemberg, LAG Bade-Württemberg)

Holding

Concerning the right to erasure of the data subject, the court overturned the first instance judgement. The court noted that a warning was no longer necessary after the termination of the employment contract between the data subject and the controller. Therefore, Article 17(1)(a) GDPR applied.

Concerning the right to access, the court clarified that the case at issue was a case of co-controllership. The employer (the company) was clearly controller within the meaning of Article 4(7) GDPR. However, the owner themselves was controller, as they personally signed the warning and were the only stakeholder of the company where the data subject was employed. The court considered these facts sufficient to prove that the owner determined purposes and means of the processing, when it comes both to the warning and the operations on the USB.

From the submission of the controllers themselves it was clear that the controllers processed personal data stored on the USB, as they stated that data were backed up and erased from the device. By not informing the data subject about such data and processing operations – or at least not within the one-month deadline established by Article 12(3) GDPR – the controllers violated Article 15 GDPR. The alleged unlawful conduct of the data subject did not change the situation, as the fact that the controller was allowed to process data on the USB did not exclude their accountability concerning the access request.

Finally, the court granted €2,500 of compensation for non-material damages pursuant to Article 82 GDPR. According to the court, the damage is substantiated by the mere fact that the data subject did not know what kind of information the controller processed about them, which was particularly concerning in the context of their employment relationship.

Comment

In the present case, it is not clear what was the content of the USB, except for the confidential information that the controller declared to have backed-up and erased. Nevertheless, the court seems to consider such information already personal data. The existence of personal data (and related processing) arguably depends, in the view of the court, on the ownership of the USB.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Tenor

I. The judgment of the Labor Court Villingen - Schwenningen, Radolfzell Chambers, 7 Ca 59/20 of October 26, 2021 is partially amended on the plaintiff's appeal.

1. Defendant No. 1 is ordered to remove the warning of March 5, 2020 from the plaintiff's personnel file.

2. Defendants 1 and 2 are jointly and severally ordered to pay the plaintiff € 2,5000.00 plus interest of five percentage points above the base interest rate since October 18, 2021.

II. The appeal is otherwise dismissed as inadmissible with regard to appeal application No. 3.

III. The plaintiff shall bear 65% of the costs of the first instance, and defendants 1 and 2 shall bear 35% jointly and severally.

IV. The plaintiff shall bear the costs of the appeal in proportion to defendant 1 at 4/7 and defendant 2 at half. Defendant 1 shall bear the costs of the appeal at 3/7, defendant 2 shall bear half of the costs of the appeal from a value in dispute of €5,000.00, jointly and severally with defendant 1.

V. The appeal is allowed for both parties with regard to appeal applications no. 2, 4 and 5 and is not allowed for the rest.

Facts

Paragraph 1

In the appeal, after a training relationship has ended, the parties are still arguing about the removal of a warning from the personnel file, the provision of information about the plaintiff's working hours from September 1, 2016 to March 30, 2020, the provision of information about personal data and the payment of compensation for failure to provide information in accordance with Art. 15 GDPR.

Marginal number 2

The plaintiff was in an apprenticeship with the defendant from September 1, 2016 to March 30, 2020 as a sports and health trainer and as a sports and fitness salesman. There is a written apprenticeship contract, for the entire content of which reference is made to Appendix K2.1 (OJ 18 ff.).

Marginal number 3

On March 5, 2020, the plaintiff was issued a warning, which was signed by Dr. S., defendant 2 and sole shareholder of the defendant as "owner". For the content of the warning, reference is made to Appendix K1.1 (OJ 16, 17). By email dated March 25, 2020, the plaintiff's attorney contacted the defendants and demanded that the "intentional and unlawful accusation that the plaintiff had committed a criminal offense of fraud" be withdrawn by March 31, 2020. He also demanded, among other things, information about the plaintiff's personal data in accordance with Art. 15 GDPR and the transmission of the plaintiff's personnel file by April 3, 2020 (Appendix K 3.2., OJ 25 and 26).

Marginal number 4

The plaintiff's USB stick was in the fitness studio in K. where the plaintiff worked. The details are disputed. Defendant 2 took this USB stick and has not returned it to date.

Marginal number 5

On April 27, 2020, the plaintiff filed the present lawsuit. As far as relevant for the appeal, he argued that the warning of March 5, 2020 was unfounded because the allegations and accusations listed therein were false. The plaintiff had not saved sensitive member data of the defendant on his USB stick, this stick was the property of the plaintiff and the defendant had therefore to hand it over to the plaintiff. The plaintiff had not attempted to illegally obtain any of the defendant's strictly confidential business secrets. The stick was given to him by the then managing director, Mr. S1, in order to continue the cash register system after the managing director had terminated his employment.

Paragraph 6

The plaintiff is also entitled to the right to information under Art. 15 GDPR. The right to information about working hours is justified because the plaintiff is entitled to this claim "according to the latest supreme court rulings" and because the defendant had intentionally and unlawfully claimed that the plaintiff had given her incorrect working hours.

Marginal number 7

On October 18, 2021 - as far as it is of interest for the appeal - the plaintiff expanded the claim to include a claim for damages in the amount of EUR 5,000.00, also against the second defendant, on the grounds that this claim applies in the event of a violation of Art. 15 GDPR, i.e. without any further specific submission. The second defendant is liable for this because he is no longer the managing director, but he has made all the relevant decisions and describes himself as the owner. The right to information is not fulfilled by the information provided in writing by the defendant on August 28, 2020. Specific data was not transmitted and it is also unrealistic that there is no other data, such as customer discussions, correspondence with third parties, internal notes, conclusion of contracts and commissions, employee evaluations, etc. The defendant must provide information about all of this data.

Paragraph 8

The plaintiff had submitted a total of 14 applications to the labor court, of which the following are of interest for the appeal:

Paragraph 9

1. Defendant No. 1 is ordered to remove the warning dated March 5, 2020 and all copies thereof from the plaintiff's personnel file.

Paragraph 10

2. Defendant No. 1 is ordered to provide the plaintiff with information about his working hours at the defendant from June 30, 2016 to March 31, 2020.

...

Paragraph 11

12. Defendant No. 1 is ordered to provide the plaintiff with information about his personal data in accordance with Art. 15 GDPR.

Paragraph 12

14. Defendants 1 and 2 are jointly and severally liable to pay the plaintiff damages in the amount of EUR 5,000.00 plus interest of 5 percentage points above the base interest rate since the action was brought, alternatively:

Paragraph 13

Defendant 1 is ordered to pay the plaintiff damages in the amount of EUR 5,000.00 plus interest of 5 percentage points above the base interest rate since the action was brought.

Paragraph 14

The defendant has acknowledged the right to be issued with a certificate in accordance with application 13 and has also requested that

Paragraph 15

the action be dismissed.

Paragraph 16

As far as relevant for the appeal, the defendant has argued that there is no need for legal protection to have the warning removed from the personnel file because the training relationship has ended. On March 2, 2020 at around 9:00 p.m., employee B. found a USB stick in the USB slot of a computer on the network with sensitive member data. Member names, addresses, account details and contract terms were stored on it. When asked, the second defendant explained that it was not his stick and the plaintiff then came into the office and inquired about the whereabouts of his USB stick. When asked why the plaintiff had inserted this stick into the computer and why the member data was stored on it, the plaintiff did not comment and fled the premises without taking the stick. On the same day, he reported sick. On March 4, 2020, the plaintiff demanded the USB stick back, saying that the stick and the data on it belonged to him. The second defendant then refused to hand it over and the data was backed up and deleted.

Marginal number 17

In a written statement dated August 28, 2020, defendant No. 1 stated that it had only stored the data necessary for the creation of a certificate, consisting of name, date of birth, postal address, job description and working time recording. No other data on the plaintiff was stored. The plaintiff had no claim to damages; the plaintiff's statements on this in his extended statement of claim dated October 28, 2021 were unsubstantiated and the application was unfounded.

Marginal number 18

The labor court dismissed the action and - as far as relevant for the appeal - stated that there was no claim to have the warning dated March 5, 2020 removed from the personnel file because there was no need for legal protection because the training relationship had since ended. The plaintiff had not presented any evidence that he had a particular interest in having it removed from the personnel file. The request for information about "the plaintiff's working hours" is already too vague because it is not sufficiently precise. The plaintiff does not describe the content and scope of the information to be provided to him, nor does he explain why he needs the information in the requested period. In addition, the specified period is incorrect. There is no general obligation to provide information under Section 242 of the German Civil Code. The time difference of one and a half hours on February 25, 2020 alone does not justify a request for information that is completely unrestricted and indefinite in terms of time. The plaintiff also has no right to be given a copy of his personnel file. There is no basis for this. There is also no right to be given the USB stick because the plaintiff did not state that it was his property. The right to information under Art. 15 GDPR and the claim for damages for failure to provide information are unfounded. This is already evident from the fact that the plaintiff gave the defendant too short a deadline for providing information, contrary to Art. 12 Para. 3 GDPR. In addition, his request for information in an email dated March 25, 2020 was unspecified. For this reason, he has no claim for damages. In addition, the defendant had already stated in writing on August 28, 2020 which of the plaintiff's personal data it had at its disposal. The plaintiff also did not provide any further evidence of the amount of the claim for damages.

Paragraph 19

For further reasons, reference is made to the contested judgment.

Paragraph 20

The labor court judgment of October 26, 2021 was served on the plaintiff's representative on November 16, 2021. The appeal against this was received by the State Labor Court on time on December 16, 2021 and was substantiated on February 16, 2022 within the deadline for filing the appeal, which was extended until February 16, 2022 due to a timely application for an extension.

Paragraph 21

With his appeal, the plaintiff is only objecting to the rejection of the original applications No. 1, 2, 12 and 14. He argues that the warning should be removed from the personnel file even after the training relationship has ended. In addition, the claim also follows from the defendant's obligation under Section 241 Paragraph 2 of the German Civil Code not to keep any false data about the plaintiff in the personnel file even after the training relationship has ended. Furthermore, the labor court does not address the right to deletion under Article 17 of the GDPR. This alone gives rise to the right to deletion. In addition, the warning was signed by a person who was not authorized to issue warnings, so that the right to removal also arises from this. Furthermore, reference is made to the substantive objections to the warning.

Marginal number 22

The right to information about working hours already exists because the labor court did not take into account that the defendant 1 claimed that the plaintiff had given the defendant incorrect working hours. In addition, the right also arises from Section 241 Paragraph 2 of the German Civil Code and Article 15 Paragraph 3 of the GDPR. The plaintiff's working hours are personal data.

Marginal number 23

There is also a right to information under Article 15 of the GDPR, which the plaintiff has also asserted in writing to the defendant 1 and the defendant 2. The claim is directed not only against the defendant 1 as the plaintiff's employer, but also against the defendant 2 because he is directly involved in the processing and use of the data and is therefore the controller within the meaning of the GDPR, especially since he acts as the owner.

Marginal number 24

The defendants did not complain about the too short deadline for providing information in the email dated March 25, 2020, but only took it into account by the labor court without any party submission.

Marginal number 25

The asserted right to information was also sufficiently specified in the case law of the Federal Court of Justice. The violation of the right to information per se entails a claim for compensation under Art. 82 GDPR. The labor court also failed to recognize this. As a purely precautionary measure, in view of the case law of the European Court of Justice that has since been issued, it is stated that the plaintiff is still under a strong negative and annoying strain because the defendants are managing and storing his data completely inadequately and the information provided so far has been inadequate. The plaintiff also fears that the defendants will misuse his data and pass it on to third parties. Due to the plaintiff's extremely negative psychological state, he is still unable to sleep peacefully and he dreams about this extremely stressful negative situation over and over again and far too often. Finally, the plaintiff is constantly under severe nervous strain due to the extremely negative reporting about the defendant, especially about the second defendant.

Paragraph 26

The plaintiff therefore requests in the appeal:

Paragraph 27

1. The judgment of the Villingen-Schwenningen Labor Court, Radolfzell Chambers, 7 Ca 59/20 of October 26, 2021 is amended.

Paragraph 28

2. Defendant No. 1 is ordered to remove the warning of March 5, 2020 and all copies thereof from the plaintiff's personnel file.

Paragraph 29

3. Defendant No. 1 is ordered to provide the plaintiff with information about his working hours at the defendant from September 1, 2016 to March 30, 2020.

Paragraph 30

4. Defendant No. 1 is ordered to provide the plaintiff with information about his personal data in accordance with Article 15, Paragraph 3 of the GDPR.

Paragraph 31

5. Defendants Nos. 1 and 2 are jointly and severally ordered to pay the plaintiff damages in the amount of € 5,000.00 plus interest at a rate of five percentage points above the base interest rate since the action was brought.

Paragraph 32

Alternatively: Defendant No. 1 is ordered to pay the plaintiff damages in the amount of € 5,000.00 plus interest at a rate of five percentage points above the base interest rate since the action was brought.

Paragraph 33

The defendant requests that

Paragraph 34

the appeal be dismissed.

Paragraph 35

In support of this, it argues that the labor court was right to deny the right to have the warning removed from the personnel file due to a lack of legal protection. The plaintiff's reference to Article 17 paragraph 1 GDPR is irrelevant, as the defendant keeps all personnel files in paper form. The GDPR is not applicable in this respect. There is no right to information about the plaintiff's working hours because there was no automated recording of working hours. There were only duty rosters, of which the plaintiff received a copy himself and thus knew his working hours. In addition, the plaintiff could have inspected the personnel file himself. However, he never asked for this.

Paragraph 36

The first defendant also did not violate the obligation to provide information. The claim fails because the plaintiff does not demonstrate any damage. Furthermore, the plaintiff's statement regarding the alleged impairments suffered due to the failure to provide information in a timely manner would be disputed on the grounds of ignorance.

Margin number 37

For the parties' further statements, reference is made to the written submissions exchanged and the attachments.

Margin number 38

The court heard the plaintiff on the question of the impairments suffered in accordance with Section 141 (1) of the Code of Civil Procedure. Reference is made to the minutes of May 22, 2023.

Margin number 39

A settlement reached between the parties in the hearing on May 22, 2023 was revoked by the defendants within the time limit.

Reasons for the decision

Margin number 40

The appeal, which is only partially admissible, is partially justified.

I.

Margin number 41

The appeal, which is in itself admissible under Section 64 (2) of the Labor Court Act, was filed and justified within the time limits of Section 66 (1) of the Labor Court Act. The appeal and the grounds for appeal are provided with a qeS and were therefore submitted to the court in the correct form in accordance with Section 46c Paragraph 2 Sentence 2 of the ArbGG.

II.

Margin number 42

The appeal is otherwise admissible and justified insofar as the plaintiff requests that the warning of March 5, 2020 be removed from the personnel file.

Margin number 43

1. The appeal also satisfies the admissibility requirements of Section 520 Paragraph 3 Nos. 2 and 3 of the Code of Civil Procedure, as it sufficiently deals with the labor court judgment.

Margin number 44

The labor court dismissed the action as inadmissible insofar as it assumed that there was no need for legal protection because the training relationship had already ended. In his action, the plaintiff objects to this with the following justification: A claim to have the warning removed exists even after the end of the apprenticeship due to the defendant's obligation under Section 241 Paragraph 2 of the German Civil Code not to keep any false data about the plaintiff in the personnel file, the labor court did not address the right to deletion under Article 17 EUV 2016/679 in the written submission of October 8, 2020, the signatory of the warning, Dr. S., is not entitled to issue a warning and the facts presented in the warning are incorrect.

Paragraph 45

The appeal is admissible. Whether the arguments in the appeal are correct is a question of merit. The plaintiff's assertion that the defendant may not keep any false data about him even after the end of the apprenticeship is sufficient for the appeal to be admissible. In particular, however, the plaintiff rightly pointed out that the labor court does not deal with the right to deletion under Art. 17 GDPR.

Paragraph 46

It can remain open whether the right to removal under Section 1004 of the German Civil Code and the right to deletion under Art. 17 GDPR are two different issues (see Baden-Württemberg State Labor Court, judgment of October 30, 2020, 12 Sa 33/20). If this is assumed, the labor court judgment is an unrecognized partial judgment because it does not deal at all with the plaintiff's right to deletion under Art. 17 GDPR, on which the plaintiff expressly based his request in the first instance. However, the labor court judgment does not have to be overturned in this respect and referred back to the labor court. There is also the possibility that the appeal court will "raise" this issue, which it will do for reasons of procedural economy and taking into account the principle of acceleration.

Paragraph 47

In addition, the labor court wrongly assumed that the action to remove the warning was inadmissible. According to the case law of the Federal Labor Court, an action to remove a warning after the end of the employment relationship is unfounded (but not inadmissible).

Paragraph 48

2. The appeal is also justified in this respect. The plaintiff can base his claim on Art. 17 para. 1 a) GDPR.

Paragraph 49

a) The defendant is passively entitled. It is true that the employment contract submitted by the plaintiff shows a different employer than the defendant, which would make the entire action inconclusive unless further submissions are made on this matter. However, this company does not exist and the defendant has never denied being the plaintiff's employer and also issued the disputed warning on its letterhead, so that it is deemed to have been admitted that it was the plaintiff's employer.

Paragraph 50

b) The defendant's argument that the GDPR does not apply is incorrect. Article 2 paragraph 1 of the GDPR does not require electronic processing of the data, but allows any processing in a file to be sufficient. The term "file system" is defined in Article 4 no. 6 of the GDPR. According to this, a file system is any structured collection of personal data that is accessible according to certain criteria, regardless of whether this collection is kept centrally, decentrally or organized according to functional or geographical aspects. The personnel file is also such a file (a.A. LAG Nds. 04.05.2021 11 Sa 1180/20 Rn. 59; Saxon State Labor Court, 31.03.2023 – 4 Sa 117/21 –, Rn. 47, juris).

Margin number 51

A similar structure of certain criteria already exists if files contain the same system according to their external labeling (in the case of a personnel file: name, first name, personnel number). The decisive factor is the uniform and identical design (Gola/Schomerus BDSG § 3 Mar. 18). In this case, files, or rather collections of files, are covered by the term file system. A similar structure is always given for files that are divided according to persons. A similar internal structure of the file is then no longer important. The only decisive factor is that the formal structure ultimately makes the data easier to access. To the extent that the accessibility is fulfilled as a result of the structure, the term file must be affirmed (Simitis/Dammann BDSG § 3 Mar. 89).

Marginal number 52

A name, a file number, a personnel number, an address, etc. serve as a characteristic of a similar structure. Even with the Baden filing system or the Baden filing box (which is a paper box in which the administrative process is loosely inserted in order), a file system is provided.

Marginal number 53

However, it is questionable whether there must be at least a certain number of files that are structured in the same way in order to even arrive at a structured collection. The definition does not require a minimum number of files, data or persons affected. This means that two structured processes, to which further processes may or may not be added later, can meet the conditions for a file system. Only files or collections of files and their cover sheets that are not arranged according to certain criteria do not fall under the term and thus under the scope of the GDPR (Recital 15). (BeckOK DatenschutzR/Schild, 44th Ed. 1.5.2023, GDPR Art. 4 Rn. 83-85).

Marginal number54

In addition, the obligation to delete also arises from Section 26 Para. 7 BDSG, which does not require the processing of employee data in a file system. The principle of necessity in Section 26 Para. 1 BDSG already shows that the permission to process data is limited. This corresponds to the data subject's right to deletion, which is generally regulated in Art. 17 GDPR and Section 35 BDSG and not specific to employee data protection (BeckOK DatenschutzR/Riesenhuber, 44th Ed. 1.5.2023, BDSG Section 26 Rn. 206).

Marginal number 55

c) The conditions for deletion are met:

Marginal number 56

According to Article 17 paragraph 1 GDPR, the data subject has the right to demand that the controller delete personal data concerning him or her immediately, and the controller is obliged to delete personal data immediately if it is no longer necessary for the purposes for which it was collected or otherwise processed.

Marginal number 57

The warning letter contains personal data within the meaning of Article 4 no. 1 GDPR, since the warning letter describes and criticizes certain behaviors of the plaintiff.

Marginal number 58

After the end of the employment relationship, warning letters are generally no longer required for the purpose for which they were stored in the personnel file. Since the employment relationship has ended, warning letters, which generally serve to criticize objectionable behavior and may contain a warning function with regard to an impending termination of the employment relationship, are no longer of any significance. In particular, the warning no longer serves to assert, exercise or defend the defendant's legal claims within the meaning of Art. 3 e GDPR. The defendant has not presented anything in this regard. There are no statutory retention periods for warnings.

Paragraph 59

For this reason, the plaintiff can demand that the defendant remove the warning from the personnel file even after the employment relationship has ended. The appeal is successful in this respect and leads to the amendment of the labor court's judgment.

III.

Paragraph 60

The appeal is inadmissible insofar as the plaintiff requests information about the working hours he has worked - now limited to the period from September 1, 2016 to March 30, 2020.

Paragraph 61

1. The labor court dismissed the action as inadmissible in this respect because it was too vague what specific information the plaintiff was requesting and what he needed this information for. In addition, it justified the dismissal as inadmissible on the grounds that there was no right to information because the requirements were not met, as only 2.5 hours of working time were in dispute.

Paragraph 62

There was no discussion of the labor court's argument that the claim was too vague. The appeal complains that the labor court ignored the plaintiff's statement on page 5 of the claim. This was as follows: 2. Claim number 2 - working hours - is justified because the plaintiff is entitled to this claim according to the latest case law of the highest courts. Purely as a precautionary measure, also because the defendant intentionally and unlawfully claims that the plaintiff gave the defendant incorrect working hours.

Paragraph 63

However, for the appeal to be admissible, it is not enough to simply refer to previous factual statements; a discussion tailored to the judgment is required in accordance with Section 520 Paragraph 3 of the Code of Civil Procedure. Since the labor court here - regardless of the accuracy of its statements - considered the action inadmissible due to a lack of certainty, a discussion of precisely this argument would have been necessary. This is missing in the appeal. The reference to Art. 15 Para. 3 GDPR also does not constitute a discussion of the lack of certainty alleged by the labor court. The appeal is therefore inadmissible in this respect.

Paragraph 64

2. The plaintiff is now also basing his appeal on Art. 15 Para. 3 GDPR. In this respect, it depends on whether the right to information under Section 242 BGB in conjunction with Section 241 Para. 2 BGB is a different subject matter of the dispute than the right to information under Art. 15 GDPR. If one assumes this, the current assertion of the right to information on the basis of Art. 15 GDPR would constitute an extension of the claim in the appeal under Section 533 of the Code of Civil Procedure in conjunction with Section 67 of the Labor Courts Act.

Margin number 65

This can, however, remain undecided. Even if one assumes in favor of the plaintiff that the plaintiff has extended the claim here and that this extension of the claim is admissible in the appeal, the appeal would be admissible in this respect, but unfounded.

Margin number 66

The defendant has stated that there was no separate recording of working hours or storage of the plaintiff's working time data from the duty rosters - which were undisputedly handed over to the plaintiff. The defendant has thus initially provided the requested information. The plaintiff would therefore have to first prove a different practice, in particular that the plaintiff's working hours were stored, or demand corresponding information and corresponding assurance from the defendant by means of an information claim. However, the plaintiff did not do any of this, so his request for information, even if it is based on Art. 15 GDPR, is unfounded.

Margin number 67

The labor court therefore rightly rejected this request and the appeal is unfounded and must therefore be rejected.

IV.

Margin number 68

1. The claim asserted by the plaintiff in original claim no. 12 "to order the defendant 1 to provide the plaintiff with information about his personal data in accordance with Art. 15 para. 3 GDPR" was rejected by the labor court on the grounds that the plaintiff had not complied with the deadline in Art. 12 para. 3 GDPR.

Margin number 69

The appeal is still admissible within the meaning of Section 520 para. 3 no. 2 and 3 ZPO. However, it requires interpretation.

Marginal number 70

It says literally on page 6, item 3 of the grounds for appeal: "The nine-day deadline listed in the information letter dated March 25, 2020 was complained about by the labor court, but by the defendant. A complaint by the labor court is not provided for by law or by the relevant case law." The sentence only becomes understandable if one assumes that a "not" was forgotten before the word "complained about". Assuming this in favor of the plaintiff, the appeal is admissible because the plaintiff complains that the labor court based its decision on facts that it should not have used - namely the failure to comply with the deadline for asserting the information in accordance with Art. 15 GDPR, without the defendant having complained about this.

Marginal number 71

2. However, the application does not meet the requirements of the case law of the Federal Labor Court, so that the action is already inadmissible in this respect.

Marginal number 72

To the extent that the plaintiff requests information from the defendant about “his personal data”, the application requires interpretation. The plaintiff himself knows his personal data, so he cannot demand information about this from the defendant. Due to the fact that the plaintiff bases his claim on Art. 15 GDPR, this means that the defendant provides the plaintiff with information about the plaintiff’s personal data that it processes. With this content, the application is admissible.

Marginal number 73

The application is, however, inadmissible for another reason, as it is not sufficiently specific.

Marginal number 74

A judgment must have a specific or at least determinable content in itself. The requirement of the specificity of the judgment – which must be examined ex officio – serves legal clarity and legal certainty. The extent of the substantive legal force within the meaning of Section 322 Paragraph 1 of the Code of Civil Procedure and thus the effects of the decision must be able to be determined. Otherwise, any ambiguities about the content of the obligation would be shifted from the discovery procedure to the enforcement procedure, whose task is not to clarify what the debtor's specified obligation consists of. In order to examine the certainty of the judgment, the facts and reasons for the decision must be used in addition if the judgment formula does not reveal the subject matter of the dispute and thus the extent of the legal force in itself. For constitutional reasons, the debtor must be able to recognize in which cases he can expect a coercive measure (BAG judgment of December 16, 2021 - 2 AZR 235/21; NJW 2022, 960, beck-online). This is missing here. Both the term "information" used and the vague description of the personal data ultimately shift the question of fulfillment to compulsory enforcement, which is not permissible. Instead, the plaintiff could have made use of the option of a staged action, whereby in the first stage he would demand that the defendant inform him of what personal data the first defendant has about the plaintiff and then, if necessary, in a second stage he could demand an affidavit confirming the accuracy of the information.

Margin number 75

The plaintiff refers to the decision of the Federal Court of Justice of June 15, 2021. Here, however, the plaintiff had specified his request for information in more detail (margin number 31 of the decision; the Federal Court of Justice left everything else open). For this reason alone, the plaintiff cannot request information on the basis of the case law of the Federal Court of Justice without any further specification.

Margin number 76

The labor court was therefore right to dismiss the action here too, at least in the end, and the appeal is unfounded and had to be dismissed.

V.

Margin number 77

With regard to the payment request based on Art. 82 GDPR, the appeal against both the first defendant and the second defendant is admissible and partially justified and leads to the amendment of the labor court judgment.

Margin number 78

The first and second defendants are jointly and severally liable to pay the plaintiff compensation in the amount of €2500 due to the partly significantly delayed and partly non-fulfillment of the obligation to provide information pursuant to Art. 15 (1) GDPR.

Paragraph 79

1. The plaintiff's appeal is admissible. It deals sufficiently with the labor court judgment. Firstly, the appeal attacks the labor court judgment insofar as it based the rejection of the payment claim on the fact that the plaintiff set too short a deadline for the first and second defendants to provide information. In addition, he also argued in the appeal that the plaintiff had actually suffered non-material damage as a result of the delayed provision of information. In addition, the demands on the grounds of the appeal should not be too high, because the labor court's reasoning is also limited to the fact that "the payment application lacks a justification for the amount claimed; but contrary to the plaintiff's legal opinion, this is not dispensable."

Margin number 80

2. The claim is also partially justified, namely in the amount of €2500. The defendants are jointly and severally liable for this amount in accordance with Section 421 of the German Civil Code. The claim arises from Article 82 Paragraph 1 of the GDPR.

Margin number 81

a) The plaintiff is entitled to information in accordance with Article 15 Paragraph 1 Sentence 1 of the GDPR. According to this, he has the right to request confirmation from the controller as to whether personal data concerning him is being processed. If this is the case, he also has the right to request information about this data.

Margin number 82

b) The claim is directed against "the controller". The term "controller" is legally defined in Article 4 No. 7 of the GDPR. According to this, the controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data. This applies here to both the first defendant and the second defendant. They are joint controllers within the meaning of Art. 4 No. 7 GDPR. According to Art. 4 No. 7 GDPR, there can be several controllers or co-controllers for data processing who are jointly responsible for the processing (BeckOK DatenschutzR/Schild, 44th Ed. 1.5.2023, GDPR Art. 4 Rn. 87a). The term controller is to be interpreted broadly with regard to the protective purpose of the GDPR (ECJ, judgment of July 29, 2019 - C-40/17, Rn. 68ff., MMR 2019, 579, beck-online).

Marginal number 83

As an employer, the first defendant is automatically responsible for the processing of personal data, which means that it is she who decides which of the plaintiff's data is processed, to what extent and in what manner.

Paragraph 84

However, the second defendant is also a person within the meaning of the above definition of responsibility within the meaning of Art. 4 No. 7 GDPR. It was the second defendant personally who took the relevant USB stick from the plaintiff, secured it and deleted it and who thus decided on the plaintiff's personal data. It was also he who issued a warning to the plaintiff, which he signed as the "owner". According to the plaintiff's uncontradicted statement, he was the "manager" of the studio in K.. This assumption is supported by the fact that he is a limited partner in the defendant with a deposit of over €700,000, as shown in the commercial register extract. All of this makes it clear that the second defendant also decides whether and to what extent the plaintiff's personal data is processed.

Paragraph 85

c) The plaintiff asserted the right to information against both defendants one and two in the email dated March 25, 2020. Without asserting the right to information, there is no reason to provide information. However, as the labor court rightly pointed out, the plaintiff set the defendant too short a deadline, namely only nine days, while the deadline for the defendant to provide information under Art. 12 (3) GDPR is one month. However, setting a deadline that is too short is irrelevant. The deadlines for providing information are regulated by law. If the person entitled to information sets a deadline that is too short, this cannot change the fact that the deadline under Art. 12 (3) GDPR applies. Before this deadline expires, the person responsible, in this case defendants one and two, does not have to meet the claims. However, setting a deadline that is too short does not render the right to information irrelevant, contrary to what the labor court assumed without further justification. Only the too short deadline is irrelevant.

Paragraph 86

d) The claim asserted in the email of March 25, 2020 was also sufficiently specific to prompt defendants one and two to take action in the sense of providing information. Unlike in the case of the judicial assertion of the right to information, it is sufficient here that it is clear to the person responsible that the plaintiff wants to assert his rights under Art. 15 GDPR. This is not about procedural enforcement and procedural problems of shifting the question of the fulfillment of claims to the enforcement proceedings. It was immediately clear to defendants one and two that the plaintiff was asserting his rights under Art. 15 GDPR with his email. This is all the more true as the defendants have a duty to assist in the exercise of the right to information under Art. 12 Para. 2 Sentence 1 GDPR. They were therefore obliged to provide appropriate information, which must first of all relate to which personal data the first and second defendants process from the plaintiff.

Margin number 87

e) The defendants have not fulfilled this right to information. In the course of the legal dispute, the defendants stated in a written statement dated August 28, 2020 that they had only stored the data necessary for the creation of a certificate, consisting of name, date of birth, postal address, job description and time recording, and that no other data had been stored.

Margin number 88

Apart from the fact that there are already considerable doubts about the accuracy of this information with regard to tax and social security regulations for payroll accounting and that the defendants would also have been obliged to provide the data in terms of its content, it was in any case provided too late, namely only 4 months after the expiry of the deadline in Art. 12 (3) GDPR.

Paragraph 89

In any case, however, this information is incomplete, as can be seen from the defendants' own statements. They stated that they had backed up and deleted the USB stick that the plaintiff had left in the gym's premises for reasons that were not clear. The defendants themselves thus declare that they have data that was on the plaintiff's USB stick. They should therefore also have provided information about which data that was on the plaintiff's USB stick they still have. The fact that they deleted the stick does not change the fact that they have backed up the data that was on the stick, i.e. they continue to store it in some way and thus continue to process it. This information was not provided, so that the information provided in writing on August 28, 2020 was incomplete in any case and remains so to this day.

Paragraph 90

Not only the first defendant, but also the second defendant would have been obliged to provide this information. Apart from the fact that they are jointly responsible, it was also the second defendant himself, according to his own statement, who took the stick from the plaintiff, read it and secured it.

Margin number 91

The defendants have thus failed to comply with their obligation to provide information under Art. 15 (1) GDPR.

Margin number 92

f) Since the defendants have essentially jointly violated a provision of the GDPR through a joint act - the failure to provide information after "securing" the USB stick - they owe the plaintiff compensation under Art. 82 (1) GDPR, for which they are jointly and severally liable. Defendant 1 does not claim that the removal and "securing" of the stick was an "excess" on the part of the second defendant, for which the first defendant is not liable. In addition, this would not change the obligation to provide information.

Margin number 93

However, it is not sufficient for a claim to payment of compensation if there is merely a violation of the provisions of the GDPR. Rather, according to the case law of the European Court of Justice, at least some, even if not significant, immaterial impairment must have occurred (ECJ, judgment of 4 May 2023 - C-300/21, GRUR-RS 2023, 8972, beck-online).

Paragraph 94

The plaintiff has made sufficient statements on this. The plaintiff explained in his hearing before the court that the mere fact that defendants one and two read a USB stick used by the plaintiff and saved the data means that the plaintiff is extremely uncertain as to which data is still accessible to the two defendants. If an employer has access to personal data belonging to an employee by taking away a USB stick, this indicates a corresponding impairment of the employee. The defendant's blanket denial is not sufficient to deny this obvious impairment of the plaintiff.

Paragraph 95

It can remain open whether the stick was the plaintiff's property or - as the plaintiff contradicted himself in the first instance - was given to him by the managing director S1. In any case, the plaintiff accepted the arguments of defendants 1 and 2 during his hearing before the court, according to which it was his private stick that was taken away from him by defendant 2.

Paragraph 96

When determining the amount of compensation, the degree of unlawful conduct of parties 1 and 2 and the degree of impairment of the plaintiff were to be taken into account.

Paragraph 97

The plaintiff's impairment is easily understandable insofar as it concerns the fact that the plaintiff is uncertain about not knowing what personal data the defendants have about him after they have read his personal USB stick. The plaintiff also stated that the stick contained photos, videos and also some documents for applications. Given the vagueness of this statement, the court cannot understand why it also contained intimate personal data. Otherwise, however, after hearing the plaintiff in person in accordance with Section 141 Paragraph 3 of the Code of Civil Procedure, the court is convinced that the plaintiff is exaggerating considerably and that his statement is inconclusive in this respect. The ongoing, significant sleep disturbances and anxiety described by the plaintiff are inconclusive to the extent described. The plaintiff has admitted in particular that he has not sought medical help for this reason, but is "only considering doing so once", although the sleep disturbances and anxiety have now lasted for three years. The plaintiff has also described that his insomnia and anxiety, as he himself has stated, are mainly due to the fact that the defendant lives in the same town as him. He is apparently afraid of him, including the use of physical violence, even though the plaintiff has trained as a fitness trainer. However, this fear has nothing to do with a violation of Art. 15 GDPR and compensation under Art. 82 Paragraph 1 GDPR, but represents a general risk to the plaintiff's life.

Paragraph 98

On the other hand, the violation by defendants one and two of the obligation to provide information with regard to the retained USB stick and its "backup" is not insignificant. The defendants cannot invoke contributory negligence on the part of the plaintiff here, even if their description of the facts were correct, according to which the plaintiff is said to have copied member data of defendant one using the stick. The obligation to provide information exists regardless of whether and why the controller processes certain data. The fact that the plaintiff - assuming this is correct - attempted to copy member data without permission and thereby possibly even committed a criminal offense can be the basis for defendants one and two processing certain data, in particular reading the USB stick. But that does not change the fact that they are still obliged to provide information about what happened to the "secured" data on the stick. Moreover, they have not provided the information to date.

Margin number 99

In consideration of these overall circumstances, compensation of €2,500 is appropriate, also from the point of view of deterring defendants 1 and 2 from further violations.

Margin number 100

The interest claim arises from Section 291 sentence 1 of the German Civil Code.

Margin number 101

For this reason, the labor court judgment also had to be amended in this respect.

VI.

Margin number 102

The costs were to be distributed in proportion to the parties' success and defeat in accordance with Section 92 paragraph 1 of the German Code of Civil Procedure.

Marginal number 103

Based on a dispute value of

Marginal number 104

-€ 550 (a gross salary) for the removal of the warning

Marginal number 105

-€ 550 for the information regarding working hours (there were only minor differences here; it is a financial claim that the "standard dispute value" does not apply)

Marginal number 106

- € 1000 for the information according to Art. 15 GDPR (compare the case law of the regional labor courts)

Marginal number 107

- € 5000 for the payment request

Marginal number 108

the plaintiff won with € 3050 and lost with € 4050.

Marginal number 109

This gives the cost ratio for the appeal. The labor court's decision on costs also had to be changed in the ratio of winning and losing - based on the value in dispute assumed by the labor court.

Paragraph 110

The appeal was allowed for both parties with regard to the appeal applications 2, 4 and 5. With regard to the claim to remove the warning, the admission arises from the divergence from other state labor court decisions, otherwise because of fundamental importance.

Other long text

Margin number 111

Correction decision of August 21, 2023:

In the legal dispute

...

The tenor of I. 2. of the judgment of July 28, 2023 - 9 Sa 73/21 - is corrected as follows:

Defendants 1 and 2 are jointly and severally sentenced to pay the plaintiff € 2,500.00 plus interest of five percentage points above the base interest rate since October 18, 2021.

Reasons:

The tenor of the judgment of July 28, 2023 - 9 Sa 73/21 - is to be corrected due to obvious inaccuracy in accordance with Section 319 (1) of the Code of Civil Procedure. The tenor of I. 2. already suggests that an extra zero was accidentally inserted for an amount of "2,5000.00 euros". However, the reasons for the decision under V. (p. 14 ff. of the judgment) make it clear that the plaintiff should only be awarded 2,500.00 euros, not 25,000.00 euros. The amount of 2,500.00 euros is mentioned several times.

According to Section 53 ArbGG, the decision could be made by the chairperson outside of an oral hearing. Due to the illness of the permanent chairperson, the deputy was called upon to do so. Obvious inaccuracies can also be corrected by judges who were not involved in the judgment (BGH February 9, 1989 - V ZB 25/88 to II. of the reasons; Zöller/Feskorn ZPO 34th edition Section 319 marginal no. 34).