LAG Berlin-Brandenburg - 10 Sa 443/21
From GDPRhub
| LAG Berlin-Brandenburg - 10 Sa 443/21 | |
|---|---|
 | |
| Court: | LAG Berlin-Brandenburg (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15 GDPR Article 82 GDPR |
| Decided: | 18.10.2021 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 10 Sa 443/21 |
| European Case Law Identifier: | ECLI:DE:LAGBEBB:2021:1118.10SA443.21.00 |
| Appeal from: | ArbG Berlin (Germany) 27 Ca 11237/19 |
| Appeal to: | Pending appeal BAG (Germany) 8 AZR 91/22 |
| Original Language(s): | German |
| Original Source: | LArbG Berlin-Brandenburg (in German) |
| Initial Contributor: | lou_schda |
The Regional Labour Court of Berlin-Brandenburg awarded a data subject damages in the amount of €2,000 following the insufficient compliance with his access request pursuant to Article 15(1) GDPR.
English Summary
Facts
The data subject worked as a cook for over 20 years for the controller. In 2019, the data subject requested detailed information in accordance with Article 15 GDPR after he had received a warning from the controller and was transferred. The request concerned these two processes. The controller did not comply with the request.
The defendant claimed before the Labour Court of Berlin that, since he had remained in the dark about essential factors of the data processing, he was entitled to damages pursuant to Article 82 GDPR. He argued that a claim for damages in the amount of €250 per month per infringement was appropriate because the infringement had lasted for more than 16 months. As a result of the months-long delay in providing information, he had been prevented from assessing whether and how the defendant had been processing his personal data.
The Labour Court of Berlin dismissed the action insofar as it was relevant to the appeal. It held that it was unclear what the exact aim of the data subject's access request had been.
With his appeal, the data subject pursued a claim of damages in the amount of at least €8,000 by the controller.
Holding
The Regional Labour Court of Berlin-Brandenburg partly upheld the claim. It granted the data subject damages in the amount of €2,000.
It held that information was not given correctly as requested and that the controller should have regarded Article 15 GDPR in full. Contrary to the first instance court's opinion, the data subject had sufficiently specified his access request. The controller had neither indicated whether and, if so, to which persons or bodies it had disclosed or would disclose the transfer process, nor when or according to which criteria the data would be deleted. Nor did the controller indicate the existence of the data subject's rights pursuant to Articles 12 et seqq. GDPR. The court concluded that it was indeed so obvious that this information was missing that the controller could have ascertained what the data subject was asking it to do by simply looking at the text of Article 15(1) GDPR.
The court further agreed with the data subject that he had suffered damages. It held that a non-material claim for damages exists irrespective of whether a materiality threshold has been reached in the case of violations of the provisions of the GDPR. Since the controller had not sufficiently fulfilled its obligation to provide information in terms of content, the data subject had not obtained sufficient knowledge about the processing of his personal data. In this respect, a loss of control had occurred and the possibility of reviewing the lawfulness of the processing of his personal data had been made impossible or difficult for him.
The court found damages in the amount of €1,000 per incompletely answered request for information. It emphasised that the enforcement of the GDPR also relied on a deterrent effect of claims for damages. Therefore, the awarded damages should encourage the controller to comply with the relevant requirements.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
tenor I. On the appeal of the plaintiff, the judgment of the Berlin Labor Court of January 21, 2021 - 27 Ca 11237/19 is partially amended: a) The defendant is sentenced to pay the plaintiff compensation in the amount of €2,000.00 plus interest of 5 percentage points above the respective base interest rate since December 31, 2020. b) the further appeal is rejected. II. The plaintiff bears 75% of the costs of the appeal and the defendant bears 25%. III. The fee value for the appeal procedure is set at EUR 13,500.00. IV. The revision is admitted. facts marginal number1 In the court of appeal, the parties are still arguing about compensation under Art. 82 GDPR. marginal number2 The plaintiff is 62 years old and was employed by the defendant as a cook from January 1, 1997 to April 30, 2021. paragraph 3 In a letter dated July 22, 2019, the plaintiff requested the defendant to provide information in accordance with Art. 15 GDPR on two processes, setting a deadline of August 26, 2019. paragraph 4 “They announced a transfer to our clientele. We reject these as inadmissible. According to Art. 15 GDPR, full information must be provided about the works council hearing and approval. The transfer is to be withdrawn. Paragraph 5 Furthermore, you issued a warning on May 29, 2019. This was wrongly done and must be removed from our client's personnel file along with the associated correspondence. The facts they describe are not correct. On May 5th, 2019, our client received a call from an unnamed nursing assistant, who complained extremely inappropriately about expired portion quark and Camembert wedges. recital 6 Our clients replied that they should not be handing them out to the residents and should dispose of them immediately. She replied that she wouldn't do that at home, but that it was necessary here and hung up without further ado. Also, no expired food was issued by our clients. As far as can be remembered, the residential area manager you mentioned was not on duty at all on that day and therefore cannot make any statements. The extent to which unused food is stored in the living areas and given out later is not subject to our clients' control. Margin number7 Mr. A was not in the house that day and certainly did not look at the supposedly expired quark or the camembert. These persons will not be able to testify to the contrary in any legal proceedings. paragraph 8 With regard to this incident, we also ask you to provide information about all data relating to our clients in accordance with Article 15 GDPR.” Paragraph 9 The defendant replied to this in a letter dated August 23, 2019, enclosing several documents: Paragraph 10 With your letter, you make a claim for information in accordance with Article 15 of the General Data Protection Regulation (as amended by the GDPR), with which you can provide complete information regarding the pronounced transfer "about the works council hearing that has taken place together with approval [...]" and regarding the warning issued for the incident of 05.05.2019 " Request information about all data relating to our clients". In this regard, we take the liberty of commenting as follows: I Paragraph 11 With regard to the relocation of your client to property B Residenz C, 10249 Berlin, we would like to point out that we will maintain the relocation. A copy of the works council hearing and the works council approval is enclosed with our letter. II. Paragraph 12 With regard to the warning of May 29, 2019, we would like to point out that the facts described by your client are incorrect. In addition, contrary to your assertion, the issued warning did not mention a "residential area manager" at all, only the "residential area manager". Although the living area manager was actually not on duty on May 5th, 2019, this does not change the fact that there was still a living area manager on that day. You also fail to recognize that Mr. R. A was not named as a witness in the warning, but merely referred to his statement. A copy of the statement including the logbook entry - which we have blacked out for data protection reasons to include the passages that do not relate to the incident of May 5th, 2019 - is enclosed with our letter. An employer is not obliged to provide evidence of the breach of duty in the warning to the employee. Since the incident of May 5th, 2019 was clarified by us and the breach of duty committed and warned by your client can be easily proven by us, there is no need for any further discussion of the inaccurate description of the facts of your client. Nevertheless, we will take your client's statement on his personnel file. Paragraph 13 In order to substantiate the claim, the plaintiff stated in the first instance that the defendant had been requested by letter dated July 22, 2019 to provide information in accordance with Art. 15 GDPR regarding the works council hearing together with consent and the incident of May 5, 2019 and that the defendant did not or did not agree to this . Paragraph 14 As a result, the plaintiff remained in the dark about essential factors of data processing. The defendant owes damages in accordance with Art. 82 GDPR because of the refusal to provide information. The claim is asserted alternatively from contractual liability, alternatively quasi-contractual liability, alternatively tortious liability. A claim for damages in the amount of EUR 250.00 per month per violation is in any case reasonable. The violation is still ongoing and has now lasted more than 16 months. As a result of the months-delayed information, the plaintiff was in the dark and prevented from examining whether and how the defendant was processing his personal data. Paragraph 15 In a judgment dated January 21, 2021, the labor court dismissed the lawsuit, insofar as it was relevant for the appeal. Paragraph 16 The plaintiff has no right to payment of compensation for the violation of the plaintiff's right to information by the defendant. Paragraph 17 In particular, such a claim - contrary to the plaintiff's view - does not follow from Art. 82 (1) GDPR. Art. 82 (1) GDPR would probably be directly applicable in national law. The defendant is also responsible for the processing of the personal data of the plaintiff within the meaning of Article 4 No. 7 GDPR. However, the defendant cannot be accused of violating an obligation to provide information under Art. 15, 12 GDPR. Paragraph 18 According to Art. 15 GDPR, a data subject has a right to information regarding the personal data concerning them that have been collected by the person responsible. Paragraph 19 In cases in which the person responsible processes a large amount of data about the data subject, the data subject can in principle also assert a general and comprehensive right to information. As a rule, however, this will not be in their interest; rather, as a rule, it will be about information about limited areas/facts, as is the case here. In this case, however, the Chamber believes that the person concerned must specify their request for information in principle. This follows from recital 63 of the GDPR, which states: Paragraph 20 "If the controller processes a large amount of information about the data subject, it should be able to request that the data subject specify which information or which processing operations the request for information relates to before providing the information." Paragraph 21 In the opinion of the Chamber, the problem that an employer collects a large amount of personal data about employees in the course of an employment relationship can only be solved by means of a kind of “graded burden of entitlement and fulfilment”. In this case, the employee must first specify a request for information that is not completely general, but targeted, at least to such an extent that the employer can recognize what the object of the request should be. The plaintiff failed to meet these requirements in his letter to the defendant dated July 22, 2019. What exactly is the subject of the information requested by the plaintiff cannot be inferred from the letter with sufficient certainty. Paragraph 22 Insofar as the plaintiff - in connection with the question of the admissibility of the transfer - requests information about "the works council hearing that took place together with approval pursuant to Art. 15 GDPR", it is already unclear what exactly the aim of the request for information is. The connection with the transfer suggests that the plaintiff is concerned with reviewing the co-determination process. The wording that he wanted information about "the works council hearing that took place" was also aimed at finding out more about the content of the co-determination procedure and not about whether and to what extent the plaintiff's personal data had been processed (in connection with the works council hearing). Paragraph 23 The further request for information on page 2 of the letter of July 22, 2019 "regarding this incident" was not sufficiently specific. Which incident is meant is not exactly clear. Because the request for information was preceded by three paragraphs that referred to several events. In addition, it can be assumed that the assertion of the claim for damages based on the violation of the duty to provide information under Art. 15 GDPR is also abusive. Because the defendant replied to the plaintiff's letter of July 22, 2019 within the period of Art. 12 (3) sentence 1 GDPR. It is true that she did not provide any comprehensive information there about the processing of the plaintiff's personal data. However, she sent the plaintiff a copy of the works council hearing together with the consent and the statement of Mr. A and replied to the plaintiff's arguments. Recital 24 Until the extension of the lawsuit on December 21, 2020, the plaintiff did not indicate that he did not consider his request for information to be fulfilled. In view of the imprecise wording of the requests for information, it should have been up to the plaintiff to specify them after receiving the letter of August 23, 2019 or at least to indicate in some way that he did not consider his requests for information to be fulfilled. Insofar as the plaintiff invokes contractual, quasi-contractual and tortious liability to justify his claim for damages, there is a lack of any factual presentation or a comprehensible justification in this regard. Paragraph 25 The plaintiff's representative filed an appeal against this judgment, which was served on February 23, 2021, and justified it in good time. In the grounds for appeal, the plaintiff stated that no facts were evident that the defendant was processing large amounts of data about the plaintiff. The meaning and purpose of the request for information also precludes a prior specification of the request. Also, the request for information does not need to have a specific objective. The goal is already inherent in the legal text. It is obvious that the second request affected the warning of May 29, 2019. It is also wrong to assume that the defendant could not have recognized that the asserted claim was not fulfilled. A debtor does not have to be informed again before filing an action that the claim has not been fulfilled. Paragraph 26 The plaintiff and appellant contend that Paragraph 27 to partially amend the judgment of the Berlin Labor Court of January 21, 2021 – 27 Ca 11237/19 and order the defendant to pay the plaintiff compensation, the amount of which is at the discretion of the court, but an amount of EUR 8,000.00 should not fall below, plus interest of five percentage points above the respective base interest rate since pendency. Paragraph 28 The defendant and the appellant submit that Paragraph 29 dismiss the plaintiff's appeal. Paragraph 30 The defendant replies that it was entitled to interpret the plaintiff's request for information in order to determine the presumed will of the plaintiff. If the plaintiff believes that the letter of August 23, 2021 does not satisfy the claim, the plaintiff's duty of consideration under Section 241 (2) BGB or his duty of loyalty would have required him to point out the insufficient information. Paragraph 31 The claim was also satisfied by the letter dated August 23, 2021. For the rest, the defendant defends the contested decision. Paragraph 32 Due to the further submissions of the parties in the appeal instance, reference is made to the content of the plaintiff's reasoning of appeal of May 21, 2021 and the content of the defendant's response to the appeal of July 22, 2021 and the minutes of the meeting of November 18, 2021. Reasons for decision I Paragraph 33 The plaintiff's appeal, which is permissible under Section 64 (2) ArbGG, was filed and justified in the correct form and within the time limit set out in Sections 66 (1) ArbGG, 519, 520 Code of Civil Procedure (ZPO). II. Paragraph 34 However, the plaintiff's appeal is only partially justified. Paragraph 35 The defendant correctly raised the respective test questions for the asserted claim in the response to the appeal. Paragraph 36 1. Is there a violation of Art. 15 GDPR? Paragraph 37 2. Is the defendant responsible for any violation? Paragraph 38 3. Has the plaintiff sustained any damage? Paragraph 39 4. Is there a causal relationship between a possible breach of Art. 15 (1) GDPR by the defendant and any damage suffered by the plaintiff? Paragraph 40 5. Is the plaintiff contributory negligence or is the claim forfeited or asserted in an abusive manner? Paragraph 41 6. Is the amount of compensation claimed reasonable? 1. Paragraph 42 According to Art. 15 Para. 1 GDPR, the plaintiff has the right to request confirmation from the defendant as to whether it is processing personal data relating to him and, if necessary, information about this personal data and, among other things, the following information: Paragraph 43 a) the processing purposes; Paragraph 44 b) the categories of personal data being processed; Recital 45 c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; Paragraph 46 d) if possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period; Paragraph 47 e) the existence of a right to correction or deletion of the personal data concerning you or to restriction of processing by the person responsible or a right to object to this processing; Paragraph 48 f) the existence of a right of appeal to a supervisory authority; Paragraph 49 g) if the personal data are not collected from the data subject, all available information about the origin of the data; Recital 50 The defendant only partially provided this information to the plaintiff. 2. Recital 51 It may be that the defendant processed large amounts of data about the plaintiff. The defendant did not provide any specific information on this. Contrary to the opinion of the labor court, this is also irrelevant in this case, since the plaintiff did not request general information regarding the data stored about him by the defendant, but limited it to two facts. 2.1 Recital 52 The first was the hearing of the works council and its approval. By referring to Art. 15 GDPR, however, it was clear and unambiguous in any case that the plaintiff was not only concerned with the letter of the employer's hearing and the letter of reply from the works council, but also with the other aspects mentioned in the regulation. With the information provided by sending the two letters, the defendant has at most fulfilled the obligation to provide information under Art. 15 (1) a) and b) GDPR. With its reply of August 23, 2019, the defendant obviously did not fulfill the further claim according to letters c) to g). Recital 53 The defendant has not stated whether and, if so, to which persons or bodies it has disclosed or will disclose the transfer process, or when or according to which criteria the data will be deleted. The defendant also did not point out the existence of a right to correction or deletion of the personal data concerning the plaintiff or to restriction of processing by the defendant or a right to object to this processing and the existence of a right of appeal to a supervisory authority. Since the data had apparently not been collected from the plaintiff, information about the origin of the data would also have been required, i.e. who was involved in the process. 2.2 Recital 54 On the other hand, it was about the warning of May 29, 2019. Here, too, the defendant, by sending Mr. A’s application for a warning and the so-called logbook entry, at most had the obligation to provide information according to Art. 15 Para. 1 a) and b ) GDPR fulfilled. With its answer of August 23, 2019, the defendant obviously did not fulfill the further claim according to letters c) to g) with regard to this process either. Recital 55 The defendant has not stated whether and, if so, to which persons or bodies it has disclosed the warning process or will disclose it, or when or according to which criteria the data will be deleted. Nor did the defendant inform the plaintiff of the existence of a right to correction or deletion of the personal data relating to the plaintiff or to the restriction of processing by the defendant or a right to object to this processing and the existence of a right of appeal to a supervisory authority. Since the data had apparently not been collected from the plaintiff, information about the origin of the data would also have been required, i.e. who was involved in the process. 3. Recital 56 It is obvious that this information is missing. Because by simply looking at the text of Art. 15 (1) GDPR, the defendant could have determined what the plaintiff is asking of her. In this respect, the defendant is also responsible for the insufficient information and thus the violation of Art. 15 Para. 1 DSGVO. 4. Recital 57 As the plaintiff rightly pointed out, he suffered damage. With reference to a decision of the Lower Saxony State Labor Court of October 22, 2021 - 16 Sa 761/20, there is an immaterial claim for damages regardless of whether a threshold of significance is reached in the event of violations of the provisions of the GDPR. It should be borne in mind here that recital 146 sentence 3 of the GDPR requires a broad interpretation in order to fully meet the objectives of the regulation. It would be incompatible with this if a liability for damages would only arise in the case of significant violations of the law, since a large number of scenarios would then be conceivable in which those affected did not receive any compensation despite violations of the provisions of the GDPR. Furthermore, in order to effectively enforce the provisions of the GDPR, a deterrent effect of the damages can also be used (cf. ECJ December 17, 2015 - C-407/14 - para. 44). In addition, according to recital 146 sentence 3, the persons concerned should receive full and effective compensation for the damage suffered. The fact that damage has been suffered does not only arise when a certain threshold is exceeded - the seriousness of the breach of duty and the impairments associated with it can rather be effectively countered at the level of the amount of damages. Recital 58 Since the defendant did not adequately fulfill its obligation to provide information, the plaintiff did not obtain sufficient knowledge about the processing of his personal data. In this respect, there has been a loss of control and it has been made impossible or more difficult for him to check the legality of the processing of his personal data. 5. Paragraph 59 The causality between the insufficient information provided by the defendant and the uncertainty on the part of the plaintiff as to which data was processed by the defendant with regard to the two specifically named facts is obvious. No additional request for information was required, since just looking at the text of the regulation is enough to recognize that the information is incomplete. 6. recital 60 The plaintiff's claim has not been forfeited or asserted in an abusive manner for any other reason. It is indeed unusual that the plaintiff has already submitted his letter of July 22, 2019 and the defendant's reply of August 23, 2019 with the statement of claim without opening a subject of dispute with regard to Art. 15 DSGVO. As a result, a time moment required for forfeiture may have arisen between August 23, 2019 and December 21, 2020. However, a circumstance factor that is required beyond this is neither presented nor evident. Since the two letters not only deal with Art. 15 GDPR, but also with the reversal of the transfer and the removal of the warning from the plaintiff's personnel file, it was necessary for a complete description of the facts to be attached to the complaint. Because the statement of claim was initially (only) about these two facts. Recital 61 In view of the fact that the claim for information was obviously not completely fulfilled, contrary to the defendant's view, there was no need for the plaintiff to indicate that the claim with the letter of August 23, 2019 was not fulfilled. 7. Recital 62 In view of the breaches of duty by the defendant, the plaintiff is to be awarded immaterial damages of EUR 2,000 at the discretion of the judge in accordance with Section 287 (1) ZPO. Recital 63 The claims for damages should, as the LAG Lower Saxony pointed out in the judgment of October 22, 2021 - 16 Sa 761/20 with reference to decisions of other courts, generally have a deterrent effect. Taking into account recital 146 sentence 6 of the GDPR, the data subject should receive full and effective compensation for the damage suffered. Violations must be effectively sanctioned. Compensation for data protection violations should have a deterrent effect in order to help the General Data Protection Regulation to achieve a breakthrough. Recital 64 Measured against the purpose of the compensation, the Chamber, taking into account and weighing up the circumstances of the present case, considers immaterial compensation in the amount of EUR 1,000 per incompletely answered request for information to be appropriate. It should be noted here that the information provided by the defendant was obviously incomplete. Even after the extension of the lawsuit of December 21, 2020, the defendant did not complete the information. Due to the insufficient information, the plaintiff had no comprehensive knowledge of the processing of his personal data by the defendant in two circumstances that were disadvantageous for him (transfer and warning). Recital 65 Compensation for damages of EUR 1,000 each ensures that the payment of a noticeable amount will help the regulation of Art. 15 GDPR to apply and that the obligated parties will be required to comply with the corresponding provisions. III. Recital 66 The decision on costs follows Section 64 (6) ArbGG in conjunction with Section 92 ZPO. In view of the damages suggested by the plaintiff of EUR 8,000, the parties have to bear the costs of the appeal according to their share in winning and losing. Paragraph 67 The approval of the revision according to § 72 Abs. 2 ArbGG was out of the question because the legal requirements were not met.
