LArbG Nürnberg - 4 Sa 201 22
| LArbG Nürnberg - 4 Sa 201 22 | |
|---|---|
 | |
| Court: | LArbG Nürnberg (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15 GDPR Article 82(1) GDPR Article 83(5)(b) GDPR |
| Decided: | 25.01.2023 |
| Published: | 25.01.2023 |
| Parties: | |
| National Case Number/Name: | 4 Sa 201 22 |
| European Case Law Identifier: | |
| Appeal from: | ArbG Bamberg, Schlussurteil vom 11.05.2022 – 2 Ca 942/20 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Bayern.Recht (in German) |
| Initial Contributor: | Julia |
The State Labour Court Nürnberg determined that compensation for non-material damages under Article 82(1) GDPR in connection to a violation of Article 15 GDPR can only be sought in the case of unlawful data processing, and not in the case of delayed or omitted information provision.
English Summary
Facts
In June 2020, the data subject made an access requesto to the controller, her employer, pursuant to Article 15(1) GDPR. The controller rejected the request and refused to provide information. Shortly afterwards, the employment relationship ended between the parties.
In November 2020, the data subject asserted her claim for a copy of her personal data processed by the controller within the meaning of Article 15(3) GDPR. In addition, she judicially demanded compensation for non-material damages of at least €5,000.00 pursuant to Article 82 GDPR, as the controller had not complied with the obligation to provide the requested data in time.
In the first instance, the Bamberg Labour Court awarded the data subject a claim for payment of non-material damages in the amount of €4,000.00 pursuant to Article 82(1) GDPR in conjunction with Article 15 GDPR. In the opinion of the Labor Court, violations must be effectively sanctioned and the damages must have a deterrent effect in order to help the GDPR achieve its purpose.
The judgment was appealed by the controller. During the appeal, the controller argued that the data subject was motivated not by concerns regarding the use and processing of her personal data, but rather by a desire for personal gain. The controller requested that the lower court's judgment to be revised accordingly.
Holding
The State Labour Court Nürnberg upheld the controller's appeal. On the basis of Article 82(1) GDPR, the data subject was not entitled to compensation for non-material damages from the controller, as the data controller's actions did not meet the legal definition of data processing under Article 4(2) GDPR. As a matter of fact, a violation of Article 15 GDPR regarding the obligation to provide information does not automatically entail the controller's liability in terms of damages. To the contrary, any claim for damages under Article 82(1) GDPR requires an unlawful data processing as defined under Article 4(2) GDPR. Cases of incorrect or delayed information provided under Article 15(1) GDPR are not covered as such by Article 82(1) GDPR. The court reached this conclusions by looking at Recital 146 GDPR and at the original provision in Article 77 of the Commission draft. According to the court, the only admissible remedy in the case at issue could be a sanction adopted by the DPA under Article 83(5)(b) GDPR.
Comment
The Court's interpretation of Article 82 GDPR is overly narrow, contrary to the prevailing legal opinion among scholars and simply ignores the wording of Article 82 GDPR.
To put this into perspective: Other than Article 82 GDPR, Article 77 GDPR actually only mentions GDPR violations by processing data ("...if the data subject considers that the processing of personal data relating to him or her infringes" the GDPR) - nevertheless, data subjects can of course bring complaints regarding the violation of Article 15 GDPR. This is uncontested in both legal practice and among scholars.
Article 82 GDPR does not even use this narrow language but refers to GDPR violations in general ("Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered"). Yet the State Labour Court Nürnberg adds an unwritten requirement that the damage must be the result of a processing as such.
Recital 146 might speak of processing ("The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation"). However, the CJEU has held multiple times (see e.g. XXX) that recitals do not allow to interpret a EU provision contrary to its own wording.
Of course not any violation of the right to access under Article 15 GDPR actually entitles a data subject to damages under Article 82 GDPR. A massively delayed or (culpably) wrongful reply to an access request might however cause immaterial damage to the data subject - just like any other GDPR violation possibly might.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Title: Claim for damages according to Art. 82 Para. 1 DS-GVO in case of violation of the duty to provide information according to Art. 15 Para. 1 DS-GVO chain of standards: GDPR Art. 15 Para. 1, 2; Section 82 Motto: Art. 82 (1) GDPR requires data processing that violates the GDPR and thus does not cover a pure violation of the duty to provide information under Art. 15 GDPR. tags: Damages, Appeal, Claim for Damages, Infringement, Interpretation, Claim, Disclosure, Revision, Payment, Limitation Period, Legal Remedy, Liability, Coverage, Disclosure, Costs of Litigation, No Claim Lower court: ArbG Bamberg, final judgment of May 11, 2022 - 2 Ca 942/20 Source: BeckRS 2023, 5047 tenor I. Upon the defendant's appeal, the final judgment of the Bamberg labor court of May 11, 2022, Az.: 2 Ca 942/20, is partially amended in numbers 1 to 3 and reworded for clarification: 1. The action is dismissed in its entirety. 2. The defendant bears 24% of the costs of the legal dispute, the plaintiff 76%. II. The plaintiff has to bear the costs of the appeal proceedings. III. The revision is allowed. facts 1 Finally, the parties are still arguing about a claim by the plaintiff for immaterial damages pursuant to Article 82 (1) GDPR due to the breach of the data disclosure obligation pursuant to Article 15 GDPR by the defendant. 2 In April 2020, at the initiative of the defendants, talks took place about the termination of the employment relationship between the parties, which had existed since March 10, 2014, but these ultimately failed. In a letter from her legal representative dated June 12, 2020, the plaintiff asserted a claim against the defendant for data information in accordance with Art. 15 (1) and (3) GDPR (cf. sheet 17 f. of the case). The defendant's legal counsel rejected this information and stated that the plaintiff could sue for her claim if she thought she had to continue the employment relationship in this way. In a letter dated June 26, 2020, the plaintiff declared that she would terminate her employment on July 30, 2020. With a lawsuit dated November 26, 2020, the plaintiff subsequently asserted data disclosure pursuant to Art. 15 (1) GDPR and a right to be provided with a copy of her personal data processed by the defendant within the meaning of Art. 15 (3) GDPR . Furthermore, according to Art. 82 DS-GVO, she requested compensation for pain and suffering of at least €5,000.00 because the defendant had not complied with the obligation to provide data information. In the further proceedings, the defendant then provided information about the processed personal data for the first time in a letter dated January 5th, 2021, whereby the question of the complete fulfillment of the data information remained disputed between the parties. 3 In the first instance, the plaintiff submitted that the defendant, despite the clear request in the letter dated June 12, 2020, had not provided any complete information within the meaning of Art. 15 DS-GVO until the very end. Also, until recently, no copy within the meaning of Art. 15 (3) GDPR was made available to her. According to Art. 82 Para. 1 DS-GVO, she is therefore entitled to immaterial damages, whereby it must be taken into account that all acts of infringement on the part of the defendant were intentional. 4 The defendant argued in the first instance that it was storing and processing the plaintiff's data on the legal basis of Art. 6 (1) sentence 1 b) GDPR. The plaintiff was also not harmed with regard to the obligation to provide information. Claims from the GDPR are just as unsuitable as the general right to damages to enrich the applicant. It is a right to compensation. Without damage there would be no claim. 5 In the first instance, the plaintiff applied for the defendant to be ordered to provide information in accordance with Article 15 GDPR, the provision of a copy of this data, the payment of compensation for pain and suffering of at least €14,400.00 for bullying and an appropriate compensation for pain and suffering of at least €5,000.00 € due to the incomplete provision of information. 6 In the legal dispute, a partial judgment that has now become final was issued on August 6, 2021, according to which the defendant was ordered to pay the plaintiff €6,189.22 as vacation pay (cf. p. 130 ff. of the case). 7 With the final judgment of the labor court of May 11, 2022, the defendant was ordered to pay the plaintiff €4,000.00 plus interest and the lawsuit was otherwise dismissed. In the opinion of the labor court, the plaintiff filed a claim against the defendant pursuant to Article 82 (1) in conjunction with Art. 15 DS-GVO a claim for payment of immaterial damages iHv. €4,000.00. Violations would have to be effectively sanctioned and the damages would have to have a deterrent effect in order to help the General Data Protection Regulation to achieve a breakthrough. Taking these principles into account, the labor court considered compensation of €4,000.00 to be necessary and appropriate. 8th The final judgment was served on the defendant on June 3, 2022. The appeal by the defendant dated May 18, 2022 was received by the Nuremberg Regional Labor Court on May 18, 2022 and the statement of reasons for the appeal dated August 2, 2022 on August 2, 2022. 9 In its statement of grounds of appeal, the defendant argues in particular that the plaintiff behaved in an abusive manner. She was not concerned with information about the use and processing of her personal data, but rather with an intention to enrich herself. This behavior is illegal. The plaintiff submitted a notice of termination of her own accord within the one-month period set and then allowed five months to elapse. So she simply vented her displeasure at the cancellation negotiations that had been started and tried in some way to get her to pay. The plaintiff also failed to show that she had suffered any damage at all. Irrespective of this, the court's assessment of the amount of damages awarded was inappropriate. In this respect, a maximum amount of €1,500.00 should have been set. Apart from that, any claim according to the exclusion period of the employment contract has expired. In addition, the letter of formal notice dated June 12, 2020 was not accompanied by a power of attorney to assert these claims. 10 The defendant and appellant makes the following claims: I. The judgment of the Bamberg Labor Court of May 11, 2022, Az. 2 Ca 942/20, is to be amended and the action dismissed in its entirety. II. The plaintiff bears the costs of both legal actions. III. The revision is allowed. 11 The plaintiff and respondent submits that 1. The defendant's appeal is dismissed. 2. The defendant bears the costs of the legal dispute. 12 The plaintiff argues that the claim has not expired because the contractual exclusion period would not apply in the case of liability due to intent. The possibility of new employment arose for her at short notice, which is why she terminated the employment relationship herself. The claims were only asserted in court at a later point in time because she would first have had to obtain a cover note from the legal expenses insurance company. 13 For the further submissions of the parties, reference is made to the briefs exchanged in the first and second instance and to the minutes of the meeting of January 11, 2023. Reasons for decision 14 The appeal of the defendant is admissible according to § 64 Section 1, 2 ArbGG. The appeal has been filed and justified in accordance with Sections 64 (6), 66 (1) ArbGG in conjunction with Sections 519, 520 ZPO. 15 The appeal is also justified. 16 1. The plaintiff is not entitled to immaterial damages from the defendant pursuant to Article 82 (1) and (2) GDPR. 17 a) Pursuant to Art. 82 (1) GDPR, any person who has suffered material or immaterial damage as a result of a violation of this regulation is entitled to claim damages from the person responsible or the processor. 18 aa) According to one view, Art. 82 (1) DS-GVO is to be interpreted broadly in view of the wording and the objective and includes any violation of the DS-GVO as a liability-relevant infringement and thus also cases beyond unlawful data processing (see, inter alia, BeckOK DatenschutzR /Quaas DS-GVO Art. 82 para. 14; Kühling/Buchner/Bergt DS-GVO Art. 82 para. 2021 - 6 Sa 1260/20, juris; doubtful in this respect BAG, judgment of May 5th, 2022 - 2 AZR 363/21 [margin no. 11], juris). 19 bb) According to another view, Art. 82 (1) GDPR should be interpreted restrictively. This view justifies its view with Recital 146. Its introductory sentence reads: "The controller or processor should compensate for any damage suffered by a person as a result of processing that is inconsistent with this Regulation." Fulfillment of the obligation to provide information does not involve data processing within the meaning of the legal definition of Art. 4 No. 2 DS-GVO, a violation of Art. 15 DS-GVO as a liability-relevant act is therefore already ruled out on the merits (LG Bonn, judgment of 01.07. 2021 - 15 O 372/20, juris; LG Düsseldorf, judgment of October 28, 2021 - 16 O 128/20, juris; Ehmann/Selmayr/Nemitz DS-GVO Art. 82 para. 8; Gola/Heckmann/Gola/Piltz DS -GVO Art. 82 para. 3). 20 b) In the Board's view, the view of restrictive interpretation is to be preferred. When interpreting a provision of Union law, account must be taken not only of its wording but also of its context and of the objectives pursued by the legislation of which it forms part. The history of the origin of a provision under Union law can also provide relevant clues for its interpretation (cf. ECJ, judgment of March 24, 2021 – C-603/20 PPU, juris). Taking these principles into account, it follows in particular from recital 146 of the DS-GVO, which represents a fundamentally suitable and important guide to the interpretation (cf. Paal/Pauly, DS-GVO/BDSG, 3rd edition 2021, introduction marginal no. 10), that the claim for damages to violations of illegal data processing within the meaning of Article 4 No. 2 DS-GVO is limited and delayed, incorrect or even completely omitted information to a person according to Article 15 Paragraph 1 DS-GVO is therefore not a liability. Not only the wording of recital 146, which, like Art. 82 (2) DS-GVO, which specifies the liability obligation, speaks in favor of this interpretation result, but also the history of the origin of Art. 82 GDPR. The corresponding original regulation in Art. 77 of the Commission draft (COM (2012) 11) still provided with regard to the liability for damages: "Any person who has suffered damage as a result of unlawful processing or any other act incompatible with this regulation has a claim for damages against the person responsible for the processing or against the processor.” The wording of this draft originally went further than e.g. the later version of the Parliament’s proposal (Drs. 9565/15), which in the draft on Art. 77 DS-GVO the obligation to pay compensation related only to damage suffered by a person as a result of processing that does not comply with this Regulation. The original recital 118 (COM (2012) 11) and the later recital 146 themselves were limited from the wording from the outset to unlawful data processing or data processing in violation of the regulation. According to the correct opinion, in the present constellation of the violation of the obligation to provide information according to Art. 15 DS-GVO, the only possible consequence of sanctions according to Art. 83 Para. 5 b) DS-GVO remains. 21 b) Further-reaching bases for claims of a contractual or tortious nature have not been submitted by the plaintiff, nor are they otherwise evident, which is why the defendant's appeal must be granted and the final judgment must be partially modified. The question of the concept of damage or the threshold of significance of a damage therefore does not need to be discussed in more detail at this point, nor does the existence of a power of attorney of the plaintiff's legal representative with regard to the assertion of the right to information, the intervention of the limitation period agreed in the employment contract and any abuse of rights conduct of the plaintiff. 22 2. The final judgment must therefore be partially amended and the complaint dismissed in its entirety. The decision on costs must also be adjusted, taking into account the victory and defeat of the parties in accordance with the partial judgment and the matters in dispute of the final judgment that have become final, Section 92 (2) No. 1 ZPO. 23 1. The decision on the costs of the appeal procedure follows from Section 91 (1) ZPO. 24 2. The revision is allowed because this decision deviates from the decisions of other state labor courts and is based on this deviation, § 72 Para. 2 No. 2 ArbGG
