ArbG Duisburg - 3 Ca 77/24

ArbG Duisburg - 3 Ca 77/24
Court:	ArbG Duisburg (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 9 GDPR Article 82(1) GDPR
Decided:	09.09.2024
Published:	16.12.2024
Parties:
National Case Number/Name:	3 Ca 77/24
European Case Law Identifier:	ECLI:DE:ARBGDU:2024:0926.3CA77.24.00
Appeal from:
Appeal to:	Unknown
Original Language(s):	German
Original Source:	justiz.nrw (in German)
Initial Contributor:	tjk

A court awarded €10,000 for non-material damages for the disclosing of personal data to discredit the data subject.

English Summary

Facts

The controller was president of a large association of air sports clubs (X). The data subject instigated a controversial discussion about the leadership qualities of - amongst others - the controller. The data subject had been ill intermittently since May 2022 and for a longer period since November 2022.

On May 11, 2023, the data subject wrote an email to a total of 24 people, including the controller, in which the data subject addressed, among other things, his health situation and its cause. In her capacity as president, the controller sent a circular emails to all (at least 177) members of X on June 11, 2023 stating that the data subject even though being on sick leave since November 2022 had made baseless and unsubstantiated allegations against - among others - her, seeking to discredit her. After failed attempts at reestablishing the working relationship the controller terminated the employment relationship with the data subject. The data subject continues to work for the association after his termination was withdrawn. The controller has since been voted out as president and has resigned.

The data subject was affected in his daily life at the airport by the controllers emails to the members of X. This is all the more serious because the data subject also spends his free time at the airport. In particular, when the data subject meets new people at the airport, he must correct, dispute and rectify the events in the controller's emails. The plaintiff's name always has a negative connotation for unknown people, no matter which airport he lands at.

The data subject demanded that the controller and not his employer X compensates his non-material damages, for at least €17,000. The data subject is of the opinion that the defendant, in violation of the GDPR, degraded and humiliated him in his social standing by publishing sensitive data, namely his illness and its duration. Through the emails, the defendant gave the impression that he was damaging the association by "calling in sick" without actually being sick. In violation of the GDPR, she also made the conflict between him and - among others - her public, even though this operationally sensitive data was subject to confidentiality.

The controller is of the opinion that the data subject is not entitled to the compensation non-material damages, since he himself essentially made his disputes and his illness public.

Holding

The court held, that the data subject is entitled to compensation from the defendant in accordance with Article 82 Para. 1 GDPR in the amount awarded. 33a) 34The plaintiff is entitled to bring the asserted claim. According to Art. 82 Para. 1 GDPR, any person who has suffered damage due to a violation of the GDPR is entitled to make a claim. 35b) 36The defendant is liable as the responsible party within the meaning of Art. 4 No. 7 GDPR within the meaning of Art. 82 Para. 1 GDPR. 37c) 38There is also a violation of the GDPR within the meaning of Art. 82 Para. 1 GDPR. Material and formal violations can be considered as violations. According to the wording and aim of the standard, there does not have to be a violation of data protection provisions regulated in the GDPR; rather, a violation of the regulation itself is sufficient (Quaas, in: Wolff/Brink, BeckOK Datenschutzrecht, 42nd Edition, as of August 1, 2022, Art. 82 GDPR para. 14). However, with regard to Recital 146 sentence 1 of the GDPR, the GDPR must have been violated during processing (Nemitz, in: Ehmann/Selmayr, GDPR, 2nd edition 2018, Art. 82 para. 8). The burden of proof for such a violation generally lies with the claimant, although the general accountability requirement under Art. 5 (2) GDPR can lead to relief (Quaas, in: Wolff/Brink, BeckOK Data Protection Law, 42nd Edition, as of August 1, 2022, Art. 82 GDPR, para. 16). 39aa) 40There is a violation of Art. 5 (1) (a) GDPR. According to this, personal data must be processed lawfully, fairly and in a manner that is understandable to the data subject. The processing of the plaintiff's personal data about his current state of health, which can be seen in its sending as an email to the recipient (OLG Hamm judgment of January 20, 2023 - 11 U 88/22, GRUR-RS 2023, 1263 paras. 68-73), and thus its disclosure to third parties, was unlawful. According to Art. 6 (1) subparagraph 1 GDPR, the processing is only lawful if at least one of the conditions mentioned there is met. This is not apparent here. Neither was there consent from the plaintiff within the meaning of Art. 6 (1) subparagraph 1 letter a GDPR, nor was the processing in the form of transmission as an email necessary for one of the purposes mentioned in Art. 6 (1) subparagraph 1 letters b to f GDPR. 41In particular, the plaintiff's consent could not be seen in his own email of May 11, 2023 to a selected group of people. Even if the group of addressees chosen by the plaintiff partly corresponded to the group of addressees chosen by the defendant in its letter of June 11, 2023, this under no circumstances constituted the plaintiff's consent to the defendant to send data about his state of health, neither expressly nor implicitly. 42bb) 43In addition, there is a violation of Art. 9 (1) GDPR. According to this provision, the processing of health data is prohibited unless an exception under Art. 9 (2) GDPR applies. According to Art. 4 No. 15 GDPR, health data is personal data that relates to the physical or mental health of a natural person, including the provision of health services, and from which information about their state of health can be derived. According to Recital 35 Sentence 1 of the GDPR, this includes all data relating to the state of health of the data subject and from which information on the past, present and future physical or mental state of health can be derived. The starting point is therefore the state of health, but not the illness of a person, which is why the determination that a person has recovered or is completely healthy is also covered by the term health data (Weichert, in: Kühling/Buchner, DS-GVO, BDSG, 3rd edition 2020, Art. 4 No. 15 DS-GVO Rn. 1). 44Health data here are the information about the time of the plaintiff's ongoing illness and its causal connection with the described conflict with the executive board as well as the defendant's indirect conclusion that there is no actual incapacity to work. 45An exception within the meaning of Art. 9 Para. 2 GDPR does not apply in this case. The plaintiff did not give his consent within the meaning of Art. 9 Para. 2 Letter a GDPR (see above under 1., c), aa)), nor was the processing in the form of transmission as an attachment to the email necessary for one of the purposes stated in Art. 9 Para. 2 Letters b to j GDPR. 462. 47The plaintiff also suffered non-material damage within the meaning of Art. 82 Para. 1 GDPR. 48The concept of non-material damage within the meaning of Art. 82 (1) GDPR is to be interpreted broadly - autonomously under European law and taking into account the objectives set out in the recitals to the GDPR (OLG Koblenz, judgment of 18 May 2022 - 5 U 2141/21). The non-material damage does not need to reach a threshold of significance (ECJ (Third Chamber) judgment of December 14, 2023 - C-456/22 (VX, AT/Gemeinde Ummendorf), but it must be demonstrated that there is non-material damage beyond the violation of a right under the GDPR that is based on the violation of the right (ECJ (Third Chamber) judgment of December 14, 2023 - C-456/22 (VX, AT/Gemeinde Ummendorf; OLG Koblenz, judgment of May 18, 2022 - 5 U 2141/21, juris para. 74; OLG Frankfurt, judgment of March 2, 2022 - 13 U 206/20, juris para. 70 et seq.; OLG Bremen, decision of July 16, 2021 - 1 W 18/21, juris Rn. 2; Buchner/Wessels, in: ZD 2022, 251 (254 f.)). Immaterial damage must therefore also be specifically stated (OLG Brandenburg, decision of August 11, 2021 - 1 U 69/20, juris Rn. 3; OLG Bremen, decision of July 16, 2021 - 1 W 18/21, juris Rn. 2; LG Hamburg, judgment of September 4, 2020 - 324 S 9/19, juris Rn. 34; Quaas, in: Wolff/Brink, BeckOK Datenschutzrecht, 42nd edition, as of August 1, 2022, Art. 82 GDPR Rn. 23a). 49In this case, the plaintiff's non-material damage is based on the fact that all of the almost 10,000 members of X. e. V. became aware of his illness, the duration of his illness and the alleged feigning of his illness at the end of 2022 and even spoke to him about the events in his free time. This damaged his reputation and weakened his reputation. 503. 51The Chamber considers an amount of 10,000 euros to be appropriate to compensate for this non-material damage: 52Art. According to the ECJ, applying the applicable principles of interpretation, Article 82 I GDPR is to be interpreted as meaning that the claim for damages provided for in this provision has a compensatory function, which is intended to enable monetary compensation based on this provision to fully compensate for the damage suffered specifically as a result of the violation of this regulation, and does not fulfil a deterrent or punitive function (ECJ (Third Chamber) judgment of 14.12.2023 - C-456/22 (VX, AT/Gemeinde Ummendorf). 53Against this background, the deciding chamber considers compensation in the amount of €10,000 to be appropriate, but also sufficient. In doing so, the chamber took into account that the European regulatory authority classifies the violated right as significant, which is shown by the classification of health data as particularly sensitive data in Art. 9 GDPR. Since there is no deterrent or punitive function to be fulfilled, the chamber links the amount to the extent of the impairment, namely the knowledge of just under 10,000 club members. The court did not take into account the previous conflict or correspondence between the plaintiff and the defendant as president of X. e. V. This is because this circumstance plays no role in the question of the amount of the compensation claim, but was relevant to the question of whether the plaintiff had consented to the dissemination of his data (which he did not, see above). 54Article 82 III GDPR, viewed in this way, makes it clear that the controller is released from liability under paragraph 2 if he proves that he is in no way responsible for the circumstance that caused the damage (EuZW 2024, 270 Rn. 93, beck-online). The defendant did not provide any corresponding evidence here.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

1Facts
2The parties are in dispute over a claim for non-material damages under Art. 82 (1) GDPR and, alternatively, under Section 823 (1) BGB.
3The defendant was president of X. e.V. during the relevant period of 2023 and as such a member of the association's executive board. The executive board, in turn, is the association's board of directors within the meaning of Section 26 BGB (see also Appendix 1 to the statement of claim). The plaintiff is employed by X. e.V. on the basis of an employment relationship as technical director.
4As an air sports association, X e.V. represents the interests of air sports clubs based in North Rhine-Westphalia. In its organization, it brings together motor pilots, glider pilots, motor glider pilots, model pilots, balloonists, parachutists, ultralight pilots and hang gliders, who have joined together in a total of 177 clubs. The state association is the second largest multi-air sports association in Germany. 9988 active members are organized in the association through the clubs. The entire training of all air sports clubs in North Rhine-Westphalia is organized through the association. The plaintiff was and is responsible for this as head of the "Approved Training Organization" (ATO) in the association.
5At the plaintiff's instigation, the parties held a controversial discussion from May 2022 about the leadership qualities of the executive board and the managing director B. in particular.
6The plaintiff has been ill intermittently since May 2022 and for a longer period since November 2022.
7On May 11, 2023, the plaintiff wrote an email to a total of 24 people, including the executive board, i.e. the defendant and the managing director B., in which the plaintiff addressed, among other things, his health situation and its cause. For the content of the email, reference is made to page 139 f. of the A.
8In her capacity as president, the defendant sent a circular to all members of X. e. V. on June 11, 2023, which states verbatim (Appendix 2 to the statement of claim):
9"Dear association members, dear air sports enthusiasts,
10With this circular, I would like to inform you that our head of the Approved Training Organization (ATO), L., has been on sick leave since November 2022. Nevertheless, during this time he began to make baseless and unsubstantiated allegations against both our managing director B. and myself, with which he is obviously seeking to discredit the managing director and the president.
11The executive board then became very active and repeatedly asked L. for an appointment in order to re-establish a trusting working relationship with him in a constructive dialogue. Unfortunately, all active attempts were unsuccessful.
12For this reason, the executive board felt obliged at its meeting on June 6, 2023 to unanimously decide to terminate the employment relationship with L. on time and to also inform him of this.
13In the name and on behalf of the executive board,
14C. D.
15President X. e.V."
16There was no effective resolution by the executive board to send this email.
17On July 24, 2023, the defendant sent another letter to all members of X. e. V., the content of which is referred to in Appendix 3 to the statement of claim.
18The plaintiff continues to work for the association after his resignation was withdrawn by X. e. V. The defendant has since been voted out as president and has resigned.
19He was affected in his daily life at the airport by the defendant's emails to the members of X. e. V. This is all the more serious because the plaintiff also spends his free time at the airport. In particular, when the plaintiff meets new people at the airport, he must correct, dispute and rectify the events in the defendant's emails. The plaintiff's name always has a negative connotation for unknown people, no matter which airport he lands at.
20With his lawsuit, which was received by the S. Labor Court on January 16, 2024 and served on the defendant on January 26, 2024, he is demanding that the defendant pay appropriate compensation for pain and suffering, which should not be less than €17,000. He deliberately did not sue his employer in order to keep him out of the dispute with the defendant. The plaintiff is of the opinion that the defendant, in violation of the GDPR, degraded and humiliated him in his social standing by publishing sensitive data, namely his illness and its duration. Through the emails, the defendant gave the impression that he was damaging the club by "calling in sick" without actually being sick. In violation of the GDPR, she also made the conflict between him and the executive committee public, even though this operationally sensitive data was subject to confidentiality. 21After the labor court had initially decided that legal recourse to the labor courts was not open, the Y. State Labor Court overturned the labor court's decision following the plaintiff's immediate appeal and considered that legal recourse was open. Reference is made to the content of the decision of July 1, 2024 (3 Ta 85/24).
22The plaintiff finally requests that
23the defendant be ordered to pay him appropriate compensation for pain and suffering, the amount of which is left to the discretion of the court, but according to the plaintiff's ideas should not be less than an amount of €17,000.
24The defendant requests that
25              the action be dismissed.
26The defendant is of the opinion that the plaintiff is not entitled to the compensation for pain and suffering claimed, since he himself essentially made his personal disputes with the board of directors of X. and his illness public to the executive committee of X., the presidium and its affiliated club members.
27With regard to the further facts and disputes, reference is made to the written submissions exchanged between the parties and the attachments.
28Reasons for the decision:
29I.
30The action is admissible and justified in the amount awarded.
311.
32The plaintiff is entitled to compensation from the defendant in accordance with Art. 82 Para. 1 GDPR in the amount awarded.
33a)
34The plaintiff is entitled to bring the asserted claim. According to Art. 82 Para. 1 GDPR, any person who has suffered damage due to a violation of the GDPR is entitled to make a claim.
35b)
36The defendant is liable as the responsible party within the meaning of Art. 4 No. 7 GDPR within the meaning of Art. 82 Para. 1 GDPR.
37c)
38There is also a violation of the GDPR within the meaning of Art. 82 Para. 1 GDPR. Material and formal violations can be considered as violations. According to the wording and aim of the standard, there does not have to be a violation of data protection provisions regulated in the GDPR; rather, a violation of the regulation itself is sufficient (Quaas, in: Wolff/Brink, BeckOK Datenschutzrecht, 42nd Edition, as of August 1, 2022, Art. 82 GDPR para. 14). However, with regard to Recital 146 sentence 1 of the GDPR, the GDPR must have been violated during processing (Nemitz, in: Ehmann/Selmayr, GDPR, 2nd edition 2018, Art. 82 para. 8). The burden of proof for such a violation generally lies with the claimant, although the general accountability requirement under Art. 5 (2) GDPR can lead to relief (Quaas, in: Wolff/Brink, BeckOK Data Protection Law, 42nd Edition, as of August 1, 2022, Art. 82 GDPR, para. 16).
39aa)
40There is a violation of Art. 5 (1) (a) GDPR. According to this, personal data must be processed lawfully, fairly and in a manner that is understandable to the data subject. The processing of the plaintiff's personal data about his current state of health, which can be seen in its sending as an email to the recipient (OLG Hamm judgment of January 20, 2023 - 11 U 88/22, GRUR-RS 2023, 1263 paras. 68-73), and thus its disclosure to third parties, was unlawful. According to Art. 6 (1) subparagraph 1 GDPR, the processing is only lawful if at least one of the conditions mentioned there is met. This is not apparent here. Neither was there consent from the plaintiff within the meaning of Art. 6 (1) subparagraph 1 letter a GDPR, nor was the processing in the form of transmission as an email necessary for one of the purposes mentioned in Art. 6 (1) subparagraph 1 letters b to f GDPR. 41In particular, the plaintiff's consent could not be seen in his own email of May 11, 2023 to a selected group of people. Even if the group of addressees chosen by the plaintiff partly corresponded to the group of addressees chosen by the defendant in its letter of June 11, 2023, this under no circumstances constituted the plaintiff's consent to the defendant to send data about his state of health, neither expressly nor implicitly.
42bb)
43In addition, there is a violation of Art. 9 (1) GDPR. According to this provision, the processing of health data is prohibited unless an exception under Art. 9 (2) GDPR applies. According to Art. 4 No. 15 GDPR, health data is personal data that relates to the physical or mental health of a natural person, including the provision of health services, and from which information about their state of health can be derived. According to Recital 35 Sentence 1 of the GDPR, this includes all data relating to the state of health of the data subject and from which information on the past, present and future physical or mental state of health can be derived. The starting point is therefore the state of health, but not the illness of a person, which is why the determination that a person has recovered or is completely healthy is also covered by the term health data (Weichert, in: Kühling/Buchner, DS-GVO, BDSG, 3rd edition 2020, Art. 4 No. 15 DS-GVO Rn. 1).
44Health data here are the information about the time of the plaintiff's ongoing illness and its causal connection with the described conflict with the executive board as well as the defendant's indirect conclusion that there is no actual incapacity to work.
45An exception within the meaning of Art. 9 Para. 2 GDPR does not apply in this case. The plaintiff did not give his consent within the meaning of Art. 9 Para. 2 Letter a GDPR (see above under 1., c), aa)), nor was the processing in the form of transmission as an attachment to the email necessary for one of the purposes stated in Art. 9 Para. 2 Letters b to j GDPR.
462.
47The plaintiff also suffered non-material damage within the meaning of Art. 82 Para. 1 GDPR.
48The concept of non-material damage within the meaning of Art. 82 (1) GDPR is to be interpreted broadly - autonomously under European law and taking into account the objectives set out in the recitals to the GDPR (OLG Koblenz, judgment of 18 May 2022 - 5 U 2141/21). The non-material damage does not need to reach a threshold of significance (ECJ (Third Chamber) judgment of December 14, 2023 - C-456/22 (VX, AT/Gemeinde Ummendorf), but it must be demonstrated that there is non-material damage beyond the violation of a right under the GDPR that is based on the violation of the right (ECJ (Third Chamber) judgment of December 14, 2023 - C-456/22 (VX, AT/Gemeinde Ummendorf; OLG Koblenz, judgment of May 18, 2022 - 5 U 2141/21, juris para. 74; OLG Frankfurt, judgment of March 2, 2022 - 13 U 206/20, juris para. 70 et seq.; OLG Bremen, decision of July 16, 2021 - 1 W 18/21, juris Rn. 2; Buchner/Wessels, in: ZD 2022, 251 (254 f.)). Immaterial damage must therefore also be specifically stated (OLG Brandenburg, decision of August 11, 2021 - 1 U 69/20, juris Rn. 3; OLG Bremen, decision of July 16, 2021 - 1 W 18/21, juris Rn. 2; LG Hamburg, judgment of September 4, 2020 - 324 S 9/19, juris Rn. 34; Quaas, in: Wolff/Brink, BeckOK Datenschutzrecht, 42nd edition, as of August 1, 2022, Art. 82 GDPR Rn. 23a). 49In this case, the plaintiff's non-material damage is based on the fact that all of the almost 10,000 members of X. e. V. became aware of his illness, the duration of his illness and the alleged feigning of his illness at the end of 2022 and even spoke to him about the events in his free time. This damaged his reputation and weakened his reputation.
503.
51The Chamber considers an amount of 10,000 euros to be appropriate to compensate for this non-material damage:
52Art. According to the ECJ, applying the applicable principles of interpretation, Article 82 I GDPR is to be interpreted as meaning that the claim for damages provided for in this provision has a compensatory function, which is intended to enable monetary compensation based on this provision to fully compensate for the damage suffered specifically as a result of the violation of this regulation, and does not fulfil a deterrent or punitive function (ECJ (Third Chamber) judgment of 14.12.2023 - C-456/22 (VX, AT/Gemeinde Ummendorf).
53Against this background, the deciding chamber considers compensation in the amount of €10,000 to be appropriate, but also sufficient. In doing so, the chamber took into account that the European regulatory authority classifies the violated right as significant, which is shown by the classification of health data as particularly sensitive data in Art. 9 GDPR. Since there is no deterrent or punitive function to be fulfilled, the chamber links the amount to the extent of the impairment, namely the knowledge of just under 10,000 club members. The court did not take into account the previous conflict or correspondence between the plaintiff and the defendant as president of X. e. V. This is because this circumstance plays no role in the question of the amount of the compensation claim, but was relevant to the question of whether the plaintiff had consented to the dissemination of his data (which he did not, see above).
54Article 82 III GDPR, viewed in this way, makes it clear that the controller is released from liability under paragraph 2 if he proves that he is in no way responsible for the circumstance that caused the damage (EuZW 2024, 270 Rn. 93, beck-online). The defendant did not provide any corresponding evidence here.
55II.
56The decision on costs is based on Section 91 Paragraph 1 Sentence ZPO. The plaintiff initially left the amount of compensation to the discretion of the court and the defendant, as the losing party, must therefore bear the costs of the legal dispute, since the court has in principle affirmed a claim for compensation.
57The value in dispute was determined in accordance with Section 46 Paragraph 2 of the Labor Court Act and Section 3 of the Code of Civil Procedure.
58Since there was no reason within the meaning of Section 64 Paragraph 3 of the Labor Court Act, the appeal was not separately admitted.