BAG - Az. 8 AZR 209/21

BAG - Az. 8 AZR 209/21

Court:	BAG (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 6(1) GDPR Article 82(1) GDPR Article 88(1) GDPR § 26 (1) BDSG
Decided:	08.05.2025
Published:
Parties:
National Case Number/Name:	Az. 8 AZR 209/21
European Case Law Identifier:
Appeal from:	LAG Baden-Württemberg (Germany) 17 Sa 37/20
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	Rewis (in German)
Initial Contributor:	Le

The Federal Labour Court held that a company unlawfully transferred its employee’s personal data to its parent company in order to test an HR software. The transfer could not be based on its legitimate interest since dummy data would have been sufficient. The court awarded the employee €200 in non-material damages.

English Summary

Facts

The data subject is an employee of the controller, a Germany-based company, belonging to an international Group whose parent company is based in the US.

In 2017, the Group introduced a new cloud-based HR software for testing, as a new uniform personnel information management system throughout the group. The provisional agreement for the new software stipulated that its use for personnel administration during the test period was prohibited and that and only certain personal data could be used at that point like surname, first name, date of joining the Group, place of work, business telephone number.

Contrary to the agreement, the controller uploaded the data subject’s, salary information, private residential address, date of birth, marital status, social security number, nationality and his tax ID to the Group’s cloud which were processed there till 2019.

The data subject filed a case before the Labour Court claiming that the processing of real personal data was not necessary for testing purposes but rather so-called dummy test data was sufficient for the test phase. In any case, the controller processed data beyond what was permitted in the agreement. He claimed compensation in non material damages in the amount of €3,000.

The Labour Court (ArbG Ulm) dismissed the action and the Regional Labor Court (LAG Baden-Württemberg) dismissed the data subject’s appeal.

In 2022, the data subject further appealed this judgement before the Federal Labour Court. The Federal Labour Court, requested a preliminary ruling from the CJEU on legal questions concerning the interpretation of Article 88(1) GDPR in connection with agreements for the purposes of employment pursuant to the Federal Data Protection Act (BDSG) Section 26 para. 4 Federal Data Protection Act (BDSG).

The CJEU (C-65/23) stated that that national rules adopted for the processing of personal data in the employment context must comply with all the conditions and limits of the GDPR, in particular Article 5, Article 6(1) and Article 9(1) and Article 9(2) of the GDPR.

At the hearing before the Federal Labour Court the data subject limited the grounds of his case to the data processing not covered by the agreement. He explicitly not claim a violation against the data transfer in the US.

Holding

The court in this procedure examined only the processing of personal data not covered by the agreement.

The court held that the controller transferred the data subject’s personal data that were not covered by the agreement to the Group’s parent company without a legal basis, in violation of Article 6(1) GDPR.

It held that the data subject was entitled to non-material damages in the amount of €200 due to the loss of control over his data, pursuant to Article 82(1) GDPR.

Furthermore, the court pointed out that the processing of real personal data for testing purposes in the context of the HR software would be justified under legitimate interest Article 6(1)(f) GDPR only if depersonalised so-called dummy test data is not sufficient to achieve the test purpose. However in this case the court did not have to examine whether the agreement met the requirements of Article 88 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

rewis logo

Laws
Judgments
Current
Services
More

Start
Judgments
8 AZR 209/21

Federal Labor Court, Judgment of May 8, 2025, Case No. 8 AZR 209/21

8th Senate | REWIS RS 2025, 6671

EMPLOYMENT LAW GDPR ART. 82 GDPR Add
Subject Matter

Data Protection - Non-Material Damages
Guiding Principle

The processing of personal data to test new personnel management software may be justified under Art. 6 (1) (f) GDPR (juris: EUV 2016/679) to protect the employer's legitimate interests, provided that depersonalized "dummy data" is not sufficient to achieve the test purpose.
Operative Part

Upon the plaintiff's appeal, the judgment of the Baden-Württemberg State Labor Court of February 25, 2021 - 17 Sa 37/20 - is partially reversed, the appeal being dismissed in all other respects.

Upon the plaintiff's appeal, the judgment of the Ulm Labor Court of November 14, 2019 - 5 Ca 18/18 - is partially amended and, for the sake of clarity, completely reformulated as follows:

The defendant is ordered to pay the plaintiff damages in the amount of €200.00 plus interest at a rate of five percentage points above the applicable base interest rate since May 26, 2018.

The action is otherwise dismissed.

The plaintiff shall bear 14/15 of the costs of the appeal and the appeal on the law, and the defendant shall bear 1/15 of the costs. The plaintiff shall bear the costs of the proceedings in the first instance.

Facts

1

The parties are still disputing in the appeal a claim for non-pecuniary damages under Art. 82 (1) GDPR due to the transfer of personnel data to a cloud-based software package called "Workday" that was being used on a group-wide basis on a trial basis.
2

The plaintiff has been employed for many years, initially by the defendant's legal predecessor and most recently by the defendant as an organizational programmer. He is the chairman of the works council formed by the defendant. During the relevant period, the defendant, headquartered in Germany, belonged to an international group whose parent company had its headquarters in Washington, D.C.
3

The defendant processed certain personal data of its employees, including for accounting purposes, using personnel management software. In 2017, there were plans to introduce Workday as a new, unified personnel information management system across the group. Between April 24 and May 18, 2017, the defendant uploaded the plaintiff's personal data from its human resources management software to a SharePoint site of the parent company with a server location in the USA in order to transfer it to the Workday software. In addition to information such as the plaintiff's last name, first name, work telephone number, and work email address, the transmitted data also included salary information, the plaintiff's private residential address, date of birth, marital status, social security number, and tax ID.
4

On July 3, 2017, the defendant and its works council signed a "Works Agreement on the Implementation of Workday" (hereinafter "Works Agreement on the Toleration of Workday"), which regulated the provisional operation of Workday. According to the Works Agreement on the Toleration of Workday, the use of the software for human resources management during the test period was prohibited, among other things. It was further agreed that a works agreement governing the use of Workday must be concluded before the system could be introduced into production. Appendix 2 to the Workday Agreement for Toleration listed the data to be transmitted from the HR management software for the test use of the Workday software: personnel number, last name, first name, start date, start date within the group, place of work, company name, business telephone number, and business email address. The effects of the Workday Agreement for Toleration were extended several times until the entry into force of a final works agreement concluded on January 23, 2019, as part of conciliation proceedings.
5

The plaintiff argued that he was entitled to non-material damages in the amount of EUR 3,000.00 under Art. 82 (1) GDPR. According to the General Data Protection Regulation and the relevant provisions of the Federal Data Protection Act, the defendant was not permitted to process real personal data in the cloud-based personnel information management system Workday between May 25, 2018, and the end of the first quarter of 2019. The data processing was not necessary for testing purposes for the subsequent operation of Workday as a group-wide, uniform personnel information management system. Rather, so-called dummy test data would have been sufficient for the test phase. Furthermore, the defendant transmitted additional data beyond the data categories specified in the collective agreement on toleration and its annexes, such as his private contact details, contract and remuneration details, his social security number, his tax ID, his nationality, and his marital status. While the plaintiff had initially also objected that it was unlawful to transfer his personal data to a SharePoint site of the parent company with a server location in the USA, and had alleged violations of Articles 28 and 44 et seq. of the GDPR in this regard, he expressly no longer relied on this in the appeal proceedings. Most recently, the plaintiff relied exclusively on the fact that the defendant had processed personal data that was not covered by the BV Toleration.
6

The plaintiff finally requested that

the defendant be ordered to compensate him for the non-material damages he suffered as a result of the defendant's violations of the General Data Protection Regulation by paying monetary damages, the amount of which is left to the discretion of the court, plus interest at a rate of five percentage points above the base interest rate as of May 25, 2018.

7

The defendant has requested that the action be dismissed. The defendant argued that it had not violated data protection provisions. Furthermore, the plaintiff had not sufficiently demonstrated non-material damages.
8

The Labor Court dismissed the claim, which originally also sought information, an affidavit, and deletion. The Regional Labor Court dismissed the plaintiff's appeal, which now sought only non-material damages. With his appeal on points of law, which was granted leave by the Regional Labor Court, the plaintiff is pursuing his claim for damages. The defendant requests that the appeal be dismissed.
9

By order of September 22, 2022 (- 8 AZR 209/21 (A) - BAGE 179, 120), the Senate stayed the appeal proceedings and requested a preliminary ruling from the Court of Justice of the European Union (hereinafter "Court") under Article 267 TFEU, in particular on legal questions concerning the interpretation of Article 88 (1) GDPR in connection with works agreements pursuant to Section 26 (4) BDSG. The Court ruled on the request for a preliminary ruling in its judgment of December 19, 2024 (C-65/23 - [K GmbH]).

Grounds of the judgment

10

The plaintiff's appeal is partially well-founded. This leads to the partial annulment of the appeal judgment and the partial modification of the labor court judgment. The plaintiff is entitled to non-material damages from the defendant under Article 82(1) GDPR.
11

I. The plaintiff is entitled to payment of non-material damages from the defendant in the amount of EUR 200.00 plus interest from May 26, 2018. A claim for damages under Art. 82 (1) GDPR requires a violation of the General Data Protection Regulation, the existence of material or non-material damage, and a causal connection between the damage and the violation, whereby these three requirements must be met cumulatively (see ECJ October 4, 2024 - C-200/23 - [Agentsia po vpisvaniyata] para. 140; May 4, 2023 - C-300/21 - [Österreichische Post] para. 32; Federal Labor Court February 20, 2025 - 8 AZR 61/24 - para. 10). These requirements are met.
12

1. The defendant has violated provisions of the General Data Protection Regulation within the meaning of Art. 82 (1) GDPR.
13

a) The plaintiff has ultimately based his claim for damages exclusively on the fact that the defendant processed personal data that was not covered by the BV Toleration. He made this statement at the oral hearing before the Senate on May 8, 2025, following the Court's preliminary ruling. The plaintiff therefore no longer claims that a violation of the General Data Protection Regulation also exists with regard to data whose transfer is in accordance with the BV Toleration. Therefore, with regard to the data collected by the BV Toleration, it is irrelevant whether Section 26 (4) BDSG in conjunction with the BV Toleration can be considered "more specific provisions" within the meaning of Art. 82 (1) GDPR. Article 88(1) GDPR ensures that its addressees comply with the requirements arising from Articles 5, 6(1), and 9(1) and 9(2) GDPR (see ECJ, December 19, 2024 - C-65/23 - [K GmbH], paras. 34 et seq.). The Senate therefore did not have to examine whether the works agreement was drafted in such a way that the requirements of the General Data Protection Regulation were met.
14

b) The defendant violated the General Data Protection Regulation by transferring the plaintiff's personal data, which was not recorded by the collective agreement, to a SharePoint site of the parent company in order to feed data into the Workday software and process it there. This is not contradicted by the fact that the defendant had already transferred the plaintiff's personal data to Workday between April 24 and May 18, 2017, and thus before the General Data Protection Regulation came into force on May 25, 2018 (Article 99 (2) GDPR). Even after the transfer, the defendant continued to be the controller within the meaning of Article 4 No. 7 GDPR. For this purpose, it is not necessary for the controller to decide alone on the purposes and means of processing personal data; according to Article 4 No. 7 GDPR, this can also be done jointly with others. From the time the General Data Protection Regulation came into force, the defendant did not attempt to have the plaintiff's data transferred back to Workday or deleted, and this did not happen. On the contrary, by repeatedly extending the period of validity and after-effects of the BV Toleration, most recently until January 31, 2019, the defendant indicated that it continued to actively act as the controller within the meaning of Art. 4 No. 7 GDPR to ensure the provisional operation of Workday by concluding further works agreements (BAG 22 September 2022 - 8 AZR 209/21 (A) - para. 20, BAGE 179, 120).
15

c) To the extent that the defendant has transferred data not covered by the BV Toleration, such as private contact details, contract and remuneration details, social security number, tax ID, nationality, and marital status, this constitutes the plaintiff's personal data within the meaning of Art. 4 No. 1 GDPR.
16

d) The processing of this aforementioned personal data for testing purposes in Workday is not permissible under Art. 88 (1) GDPR in conjunction with Section 26 (1) BDSG. Section 26 (1) BDSG must remain inapplicable.
17

aa) Section 26 (1) BDSG does not meet the requirements of the opening clause in Art. 88 GDPR. More specific provisions within the meaning of Art. 88 GDPR apply. Article 88(1) GDPR only applies if they are not limited to a repetition of the provisions of the General Data Protection Regulation, but have a regulatory content that is appropriate to the regulated area and differs from the general rules of the General Data Protection Regulation. Furthermore, they must aim to protect the rights and freedoms of employees with regard to the processing of their personal data in the employment context and include appropriate and specific measures to safeguard human dignity, the legitimate interests and the fundamental rights of the data subject within the meaning of Article 88(2) GDPR (cf. ECJ 30 March 2023 - C-34/21 - [Main Staff Council of Teachers] paras. 65, 71, 74; BAG 9 May 2023 - 1 ABR 14/22 - para. 63, BAGE 181, 1). Section 26(1) sentence 1 BDSG does not meet these requirements simply because it lacks protective measures within the meaning of Article 88(2). Art. 88 (2) GDPR is missing (Federal Labor Court, May 9, 2023 - 1 ABR 14/22 - para. 64, ibid.).
18

bb) National legislation ensuring the protection of the rights and freedoms of employees with regard to the processing of their personal data in the employment context must remain inapplicable if it does not comply with the conditions and limits set out in Art. 88 (1) and (2) GDPR, unless it constitutes a legal basis within the meaning of Art. 6 (3) GDPR that meets the requirements of this Regulation (ECJ, March 30, 2023 - C-34/21 - [Main Staff Council of Teachers] paras. 76 et seq.).
19

cc) With regard to the processing of personal data in the personnel information management system Workday at issue here, Section 26 (1) BDSG does not constitute a legal basis within the meaning of Art. 6 (3) GDPR. Art. 6 (3) GDPR (cf., however, for data processing to fulfill a statutory right of employee representatives, see BAG May 9, 2023 - 1 ABR 14/22 - paras. 65 et seq., BAGE 181, 1). The defendant has neither asserted nor is it otherwise apparent that the processing of the plaintiff's personal data in Workday was necessary to fulfill a legal obligation within the meaning of Art. 6 (1) subparagraph 1 letter c GDPR, or for the performance of a task in the public interest within the meaning of Art. 6 (1) subparagraph 1 letter e GDPR.
20

e) In the absence of more specific provisions that meet the requirements and limits set out in Art. 88 GDPR, the processing of personal data in the employment context is directly governed by the provisions of the General Data Protection Regulation (ECJ December 19, 2024 - C-65/23 - [K GmbH] para. 53; March 30, 2023 - C-34/21 - [Main Staff Council of Teachers] paras. 82 et seq.). According to the provisions of the General Data Protection Regulation, the transfer of the plaintiff's personal data not recorded by the BV Toleration to the Workday software for testing purposes is not justified.
21

aa) The transfer of this data to the parent company is not justified under Art. 6 (1) (f) GDPR. According to this, processing is lawful if it is necessary to protect the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject which require protection of personal data prevail, in particular if the data subject is a child. Justification for processing personal data in the preliminary operation of Workday for “test purposes” is not excluded a priori, provided that depersonalized so-called dummy test data is not sufficient to achieve the test purpose (BAG September 22, 2022 - 8 AZR 209/21 (A) - marginal no. 29, BAGE 179, 120). Preliminary test operation with personal data may be necessary in individual cases to protect the legitimate interests of the employer in order to prepare for a software changeover. However, in this case, the excessive data processing is ultimately not necessary within the meaning of Article 6 (1) subparagraph. 1 letter f GDPR because it goes beyond the permission granted in the work agreement toleration (cf. Federal Labor Court (Bundesarbeitsgericht) decision of September 22, 2022 - 8 AZR 209/21 (A) - para. 24, ibid.). The defendant agreed with the works council in the work agreement toleration that certain personal data would be transferred to the parent company for testing purposes. This includes the personnel number, last name, first name, date of entry, date of entry into the group, place of work, company name, business telephone number, and business email address. Since the defendant and the works council limited the permission to these individually listed personal data, it can be assumed that only this data was required for testing purposes. The defendant itself does not claim that the additional data it transferred to the parent company was necessary to test Workday.
22

bb) The transfer of data beyond the permission granted in the BV (acceptance of processing) is also not justified under Art. 6 (1) (b) GDPR. According to this provision, processing is lawful if it is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the request of the data subject. In its order for reference of September 22, 2022, the Senate still assumed a possible justification under Art. 6 (1) (b) GDPR (- 8 AZR 209/21 (A) - para. 29, BAGE 179, 120). According to the Court's case law since then, the use of real personal data for testing purposes for a software change, which is to be assessed here, probably constitutes further processing within the meaning of Art. 6 (1) (b) GDPR. 5 (1) (b) GDPR, which serves a purpose other than that for which the data was originally collected (cf. ECJ October 20, 2022 - C-77/21 - [Digi] paras. 22 et seq.). The data transmitted to the parent company for testing purposes therefore no longer served the fulfillment of the employment relationship within the meaning of Art. 6 (1) (1) (b) GDPR. In any event, the transfer of data beyond the permission granted in the collective agreement toleration is neither necessary under Art. 6 (1) (1) (b) GDPR nor under Art. 6 (1) (1) (f) GDPR.
23

2. The plaintiff suffered non-material damage within the meaning of Art. 82 (1) GDPR as a result of the transfer of personal data not covered by the collective agreement toleration.
24

a) The loss of control over personal data, even temporarily, may constitute non-material damage within the meaning of Art. 82 (1) GDPR, which gives rise to a claim for damages, provided the data subject proves that they have actually suffered such damage, however minor it may be (ECJ October 4, 2024 - C-200/23 - [Agentsia po vpisvaniyata] para. 150; April 11, 2024 - C-741/21 - [juris] para. 42; Federal Labor Court February 20, 2025 - 8 AZR 61/24 - para. 13; Federal Court of Justice November 18, 2024 - VI ZR 10/24 - para. 30, BGHZ 242, 180).
25

b) The damage lies in the loss of control suffered as a result of the transfer of personal data to the parent company and its further processing in the Workday software (cf. Federal Court of Justice (BGH) February 11, 2025 - VI ZR 365/22 - para. 16). The present case of data transfer differs from delayed disclosure under Art. 15 GDPR, which in itself does not constitute a loss of control over data within the meaning of the risk of misuse, but only a delay in providing the information (Federal Labor Court (BAG) February 20, 2025 - 8 AZR 61/24 - para. 17; Federal Social Court (BSG) September 24, 2024 - B 7 AS 15/23 R - para. 32; cf. order for reference to the Court of Justice (BGH) May 6, 2025 - VI ZR 53/23 - para. 40 et seq.).
26

3. The damage in the form of the resulting loss of control is also causally caused by the defendant's violation of the General Data Protection Regulation.
27

4. The Senate can decide on the amount of non-material damages itself, since all facts relevant to the decision have been established. The plaintiff is entitled to non-material damages in the amount of €200.00.
28

a) In assessing the amount of damages owed under Art. 82 (1) GDPR, in the absence of a provision in the General Data Protection Regulation, national courts must apply the domestic provisions of the individual Member States regarding the amount of financial compensation, provided that the EU principles of equivalence and effectiveness are observed. Art. 82 (1) GDPR does not require that the gravity of the fault of the controller or processor be taken into account. The compensatory function of the claim for damages enshrined in Article 82 (1) GDPR even excludes any intentional nature of the violation of the General Data Protection Regulation from being taken into account when assessing the amount of damages. However, the amount must be set in such a way that it fully compensates for the damage specifically suffered as a result of the violation of the General Data Protection Regulation (cf. ECJ 20 June 2024 - C-182/22 et al. - [Scalable Capital] paras. 27 et seq. with further references; ECJ 8 January 2025 - T-354/22 - paras. 192 et seq.; BAG 25 July 2024 - 8 AZR 225/23 - para. 36; cf. BGH 28 January 2025 - VI ZR 183/22 - paras. 8 et seq.; 18 November 2024 - VI ZR 10/24 - paras. 95 et seq., BGHZ 242, 180).
29

b) Based on these principles, damages in the amount of €200.00 are appropriate. This amount is necessary but also sufficient to compensate the plaintiff for the non-material damage suffered. In particular, the sensitivity of the personal data specifically affected, below the threshold of Art. 9 GDPR, as well as the larger, yet limited, group of recipients and the duration of the loss of control must be taken into account (cf. Federal Court of Justice (BGH) November 18, 2024 - VI ZR 10/24 - para. 99, BGHZ 242, 180). The fact that the plaintiff's personal data was transferred to a third country could not play a role in determining the amount of damages. The plaintiff has stated that he does not invoke violations of Art. 44 et seq. GDPR.
30

II. The decision regarding costs for the appeal and the appeal on points of law follows from Section 97 (1) and Section 92 (1) of the Code of Civil Procedure (ZPO) and corresponds to the ratio of mutual success. The plaintiff shall bear the costs of the first-instance proceedings pursuant to Section 92 (2) No. 1 of the Code of Civil Procedure.

Spinner

Krumbiegel

Pulz

Bloesinger

Gothe