BAG - 8 AZR 117/24
| BAG - 8 AZR 117/24 | |
|---|---|
 | |
| Court: | BAG (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1)(b) GDPR Article 14(1)(d) GDPR |
| Decided: | 05.07.2025 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 8 AZR 117/24 |
| European Case Law Identifier: | |
| Appeal from: | LAG Düsseldorf (Germany) 12 Sa 1007/23 |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | BAG (in German) |
| Initial Contributor: | Le |
The Federal Labour Court confirmed that a university violated its information obligation after rejecting a job applicant due to search results regarding the applicant. The university was ordered to pay €1.000 for non-material damages. However, the search itself was a lawful pre-contractual measure.
English Summary
Facts
The data subject is a renowned lawyer specialised in employment law and the controller a university operating as a corporation under public law.
In 2020, the data subject was sentenced for fraud by a court of first instance (Regional Court of Munich I). In 2022 the Federal Court of Justice overturned this judgment.
In June 2021, the controller advertised a temporary position for a lawyer, to which the data subject applied for, enclosing all relevant documents, and then went through the interview process.
In July 2021, the data subject received a rejection notice from the controller, stating that it can be seen from publicly available online sources that the data subject had been sentenced for fraud by the court of first instance. Even though the judgement is not yet legally binding, he could only be hired under the resolutory condition of a clean criminal record. He was also informed that another candidate, who matched the requirements better, had been selected.
In December 2022, the data subject filed a case with the Court of First Instance (Düsseldorf Labor Court -ArbG Düsseldorf) claiming, amongst other things, that he is entitled to material and immaterial damages due to the unlawful collection of his personal data. The core of the allegations is that that the controller collected the data from the internet without him being aware, the collected data was incorrect and since the controller did not inform him about the processing he was not given the opportunity to comment which had an influence to the outcome of the selection process.
The controller claimed that the position had been filled with another applicant who demonstrated better professional competence in comparison to the data subject. The knowledge of the criminal proceedings against the data subject and their evaluation in relation to the position were additional reasons for the rejection. The data subject is not entitled to damages under Article 82(1) GDPR, because the personal data collection did not violate the GDPR nor did it result in the loss of control, since it constituted publicly available information.
The court of first instance decided that the internet research about him was permissible and necessary, and the selection process was lawful.
The data subject appealed this decision before the Court of Appeal (Düsseldorf Higher Labour Court-LAG) demanding that the controller must compensate him for all material and immaterial damages that he has suffered or will suffer as a result of the rejection of his application. The data subject’s appeal was partially successful.
First, the Court of Appeal held that the controller processed the data subject’s personal data lawfully. The internet research as such was lawful under Article 6(1)(b) GDPR, as a pre-contractual measure. If the pre-contractual measure, as in this case, can be traced back to the initiative and will of the data subject, the collection and processing of data is permitted to the extent necessary for the specific selection process. It also held that was necessary for a public employer to determine and check the suitability of the applicant. Plus, the controller was not obliged to clarify these facts by asking the data subject questions.
Second, the Court of Appeal found that the controller violated the information obligation under Article 14(1)(d) GDPR by failing to inform the data subject of the categories of personal data that it processed about him in the selection procedure, namely the criminal conviction at the court of first instance. The information on the categories of data must be sufficiently precise and specific to enable the data subject to assess the risks that may be associated with the processing of the data collected.
Third, the Court of Appeal held that the data subject is not entitled to material damages because the required casual link is lacking.
Lastly, the Court of Appeal held that the controller must pay the data subject compensation for non material damages in the amount of €1,000 for failing to inform him about the category of data processed in the selection procedure. Without informing the data subject, the controller made his appealable criminal conviction the basis of its data processing in the selection process, even if only in the alternative. As a result, the data subject suffered a considerable loss of control with negative effects on the selection decision.
Finally, the decision of the Court of Appeal was challenged before the Federal Labour Court (BAG).
Holding
The Federal Labour Court upheld the ruling of the Court of Appeal.
Comment
This judgment has clarified that anyone who does not obtain data directly from the applicant himself, but from public sources, must provide the applicant with specific information about this data collection.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Start Hearing Results 8 AZR 117/24 8 AZR 117/24 The default judgment of March 27, 2025 – 8 AZR 117/24 – is upheld. The plaintiff must bear the further costs of the appeal proceedings.
