LAG Baden-Württemberg - 3 Sa 33/22
From GDPRhub
| LAG Baden-Württemberg - 3 Sa 33/22 | |
|---|---|
 | |
| Court: | LAG Baden-Württemberg (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 4(11) GDPR Article 15(1) GDPR Article 17(3) GDPR Article 82(1) GDPR |
| Decided: | 27.07.2023 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 3 Sa 33/22 |
| European Case Law Identifier: | ECLI:DE:LAGBW:2023:0727.3SA33.22.00 |
| Appeal from: | ArbG Pforzheim (Germany) 5 Ca 222/21 |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Landesrecht BW (in German) |
| Initial Contributor: | n/a |
The LAG Baden-Württemberg awarded €10,000 to a data subject for the usage of their images in publicly accessible promotional and training material by their former employer, which continued even after the termination of the employment.
English Summary
Facts
The data subject was employed as a wrapping technician by the controller, a company in the advertising technology industry. While employed, the data subject agreed to the production of photos and a promotional video which featured him prominently. After leaving the company on 1 May 2019 to work for a competitor, the data subject requested the controller multiple times to cease using and delete the photos and video featuring him, but the controller initially did not comply.
On 21 February 2020, the controller finally removed the materials after receiving multiple formal requests from the data subject’s legal representative. The data subject sought non-material damages under Article 82 GDPR due to these violations, including the unauthorized use of their image for commercial purposes.
Holding
The LAG Baden-Württemberg decided that the delayed response to an access request under Article 15 GDPR does not constitute non-material damage in itself. The court clarified that a mere breach of GDPR provisions is not sufficient to establish a claim for damages under Article 82 GDPR. The rationale is that the law requires concrete evidence of harm beyond the violation of GDPR regulations.
First, the court held that the controller’s unconsented use of the data subject's image post-employment violated Article 17 GDPR, justifying a compensation of €10,000 due to the significant damage to their personality rights along with the commercial exploitation without permission.
Second, it addressed the data subject's request for detailed information on all personal data processed by the controller under Article 15 GDPR. The court noted this request lacked the specificity required by § 253(2) No. 2 ZPO. Consequently, it ruled that a general request for all personal data does not meet the necessary clarity and precision.
Finally, the court rejected the claim for additional damages due to the delayed compliance with the access request, ruling that no non-material damage was proven by the data subject, emphasizing that Article 82 GDPR mandates a demonstrable impact beyond regulatory non-compliance.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Guiding Principles
1. The late provision of information upon a request under Article 15(1) GDPR does not, in itself, constitute non-material damage (Rn.77). A mere breach of the General Data Protection Regulation does not suffice to establish a claim for damages under Article 82(1) GDPR (Rn.78).
2. Article 82(1) GDPR also does not presume that the loss of control over one’s own data, resulting from a breach of the General Data Protection Regulation, as such, leads to compensable non-material damage (Rn.82).
3. A request under Article 15(1) sentence 1 clause 2 GDPR for information about "all personal data" generally does not meet the requirement for specificity under Section 253(2) No. 2 ZPO (Rn.86).
Procedural History
(previously: Labor Court Pforzheim, 23 February 2022, 5 Ca 222/21, Judgment)
Judgment
I. The appeals of the plaintiff and the defendant are partly amended, and the judgment of the Labor Court Pforzheim dated 23 February 2022 - 5 Ca 222/21 - is clarified as follows while rejecting further appeals:
1. The defendant is ordered to pay the plaintiff €10,000.00 plus interest at a rate of 5 percentage points above the base interest rate since 23 April 2020.
2. The claim is dismissed in all other respects.
3. The counterclaim is dismissed.
II. The plaintiff is to bear 74% of the first-instance costs of the legal dispute, and the defendant 26%.
The costs of the appeal proceedings are allocated 59% to the plaintiff and 41% to the defendant.
III. The revision is admitted concerning the plaintiff's request for information. In all other respects, the revision is not admitted.
Facts
1. The plaintiff continues to seek information under Article 15 of the General Data Protection Regulation (GDPR) and claims non-material damages for breach of the information obligation under Article 15 GDPR and for the use of video and photo recordings showing him after the termination of the parties' employment relationship. The defendant counterclaims for the repayment of an employer loan.
2. The plaintiff was employed by the defendant, a company in the advertising technology sector, as an advertising technician in the area of film application until 30 April 2019. Since 1 May 2019, he has been working for a competitor of the defendant.
3. The defendant operates the "W.-S." and conducts training on film application through this format. The plaintiff led these training sessions, offered by the defendant to both internal employees and externals, sharing special know-how on the topic of film application with participants.
4. During the employment relationship, the defendant, with the knowledge and consent of the plaintiff, had numerous photos taken of him "at work" and produced a promotional video of approximately four minutes showing the plaintiff as a training leader "in action." Using this photo and video material, the defendant advertised its services on its company website at www…….de, www……..de, on its Google My Business account, and on the Facebook page of the "W.-S".
5. After the plaintiff left the employment relationship, the defendant initially continued to use the photos and video. The plaintiff repeatedly sent WhatsApp messages to Mr. S., his contact person at the defendant, requesting the deletion of the disputed image material. This was also the subject of multiple correspondences. The defendant initially did not comply with the request.
6. In January 2020, the plaintiff's current legal representative found the following unchanged situation since 1 May 2019: On the company website www……….de, there was a central promotional and training video of the defendant featuring the plaintiff as a training leader (duration: 4 minutes 5 seconds), which was also visible on YouTube. The linked website www……..de also displayed the disputed promotional and training video of the defendant with the plaintiff. Additionally, a photo clearly showing the plaintiff during a training session was displayed. On the defendant's Facebook account, the disputed promotional and training video with the plaintiff was shown and advertised, along with seven photos of the plaintiff "at work." On the defendant's Google My Business account, there were two photos of the plaintiff in a prominent pose for directly promoting the defendant's training offers.
7. The plaintiff's current legal representative sent letters to the defendant on 22 January 2020 and 14 February 2020. The defendant fully complied with the removal request on 21 February 2020.
8. The plaintiff stated that the defendant intentionally and significantly violated his general personal rights from 1 May 2019 to 21 February 2020 in a substantial and intense manner. The impact of the violation was particularly severe for him due to his employment with a competitor from 1 May 2019, as the photo and video material prominently displayed conveyed that he represented the defendant. At his new employer, the defendant's use of his likeness was perceived as disloyalty.
9. The defendant did not inform the plaintiff about the extent, purpose, and manner of collecting and processing personal data during the employment relationship, which constitutes a violation of Article 13 GDPR. The defendant also ignored his fundamental right to information under Article 15 GDPR.
10. The failure to fulfill obligations under Article 15 GDPR also resulted in a claim for damages under Article 82 GDPR. The plaintiff was left completely unclear about the collection and processing of his personal data. The defendant evidently disregarded its retention obligations, as it admitted. The plaintiff's damage was that he was deprived of his rights and freedoms to control his personal data.
11. For the failure to fulfill obligations under Article 15 GDPR, he claimed non-material damages of at least €11,000.00. Damages under Article 82 GDPR should have a deterrent effect, with the amount of damages being based on Article 83(2) GDPR.
12. The defendant illegitimately commercialized the plaintiff and his videos/photos. The defendant offered 20 four-day training courses on film application techniques between 1 May 2019 and 21 February 2020, attended by about six participants each at a price of €1,999.00 per person, calculating a profit of €7,000.00 per course and collecting it accordingly. These courses thrived on the draw of an experienced and competent trainer, such as the plaintiff. Due to the illegitimate use of the video and photos, a damages claim of at least €25,000.00 was assumed.
13. The plaintiff requested:
14. 1. The defendant is ordered to refrain, under penalty of a fine of up to €250,000 or imprisonment of up to six months for each violation, from using photos, videos, or other recordings depicting the plaintiff for advertising purposes, using them otherwise, or passing them on to third parties without the plaintiff's express consent.
15. 2. The defendant is ordered to pay the plaintiff a monetary compensation or non-material damages, at least €36,000.00, plus 5 percentage points above the base interest rate since the date of lis pendens.
16. 3. The defendant is ordered to provide the plaintiff with a detailed written statement of all personal data collected and processed about him in connection with or resulting from his employment relationship with the defendant, especially including the following information:
17. - Purpose of processing
- Category of personal data being processed
- Recipients or categories of recipients to whom the personal data has been or will be disclosed
18. - The planned duration for which the personal data will be stored, or, if not possible, the criteria for determining this duration
19. - The existence of a right to rectification or erasure of personal data or restriction of processing by the controller or a right to object to this processing
20. - If the personal data is not collected from the defendant, any available information about the source of the data
21. - The existence of automated decision-making, including "profiling," according to Article 22(1) and (4) GDPR, and – at least in these cases – meaningful information about the logic involved as well as the scope and intended effects of such processing for the plaintiff.
22. The defendant requested the dismissal of the claim.
23. In the counterclaim, the defendant requested:
24. The plaintiff is ordered to pay the defendant €1,500.00 plus interest at 5 percentage points above the base interest rate since lis pendens.
25. The plaintiff requested the dismissal of the counterclaim.
26. The defendant stated that it had deleted all personal data of the plaintiff and that such data no longer existed with it. The plaintiff had wanted to make himself known through the videos, not just the defendant, and had expressly desired the promotional use. Due to his express wish, no clarification was needed.
27. Regarding the training video produced with considerable effort and cost, the parties agreed that the defendant could continue using it with the plaintiff's image even after he left. The plaintiff initially only demanded the removal of photos, not video material.
28. Because the defendant continued to advertise the plaintiff even after his employment ended – the training video depicted him as an experienced expert – it actually harmed itself, not the plaintiff, by promoting a former employee now working for a competitor. The plaintiff had portrayed himself as a central figure and trainer out of vanity. He was now employed by a competitor because he had become known through the training sessions and publications.
29. Following the plaintiff's insistence, all his data was deleted, despite possible retention obligations.
30. The stated profits were incorrect.
31. The plaintiff was granted a loan of €2,000.00 in 2018, of which he repaid only €500.00, leaving €1,500.00 outstanding.
32. The Labor Court ruled in favor of the plaintiff in the amount of €5,000.00
plus interest since 22 April 2020 and partially granted request 1. The rest of the claims were dismissed. The court reasoned:
33. The claim faced no admissibility concerns. The information request under request 3 corresponded to the wording of Article 15 GDPR. The defendant provided no information and merely referred to a general deletion of all data. In such a case, repeating the wording of Article 15 GDPR was sufficiently specific.
34. The injunction request was unfounded due to the lack of necessary repetition risk.
35. The defendant owed the plaintiff €5,000.00 in compensation. €2,000.00 of this was for the improper fulfillment of the information obligation under Article 15 GDPR. The defendant claimed to have deleted the relevant data but did not provide information on the other aspects claimed by the plaintiff. The chamber followed the decision of the LAG Berlin-Brandenburg from 18 November 2021 (Az. 10 Sa 443/21), which stated that immaterial damages were due for breaches of GDPR rules, regardless of a materiality threshold. A broad interpretation was required to meet the Regulation's objectives fully, and the damages should have a deterrent effect. A materiality threshold was unnecessary for an experienced loss. By not fulfilling its information obligation, the plaintiff was denied sufficient knowledge of the processing of his data, resulting in a loss of control.
36. For the incomplete response to the information request, €2,000.00 was appropriate. The plaintiff did not demonstrate any additional material or immaterial damage beyond the dispute over the information request. However, the defendant's persistent denial of the plaintiff's information right and the general claim of data deletion without fulfilling the information obligations were factors considered.
37. The compensation claim for violation of the plaintiff's personal rights was valued at €3,000.00. The defendant published the plaintiff's photos and promotional recordings without written consent beyond the end of the employment relationship and initially did not promptly delete them even after being requested. This violation of Article 17 GDPR was clear to the defendant that the plaintiff no longer agreed with the publication of his likeness after the employment ended. The compensation was neither trivial nor severe and was appropriately valued at €3,000.00.
38. The awarded amount was subject to interest from the date of lis pendens according to Section 288 BGB.
39. The information request followed from Article 15(1) clause 2 and (3) sentence 1 GDPR. The plaintiff was initially entitled to make a general information request. He could not know which specific data was stored about him for what purposes. He sought information to enable a more precise description of the stored data.
40. The claim that all data was deleted could not defeat the information request. The inaccuracy of this information was shown by the fact that the defendant specifically addressed matters from the employment relationship in the legal dispute. Moreover, the information was highly implausible regarding existing obligations to social security institutions and tax authorities.
41. The counterclaim could not succeed. The defendant could not substantiate the agreement of an employer loan and its specific content. It only stated that Mr. S. handed over €2,000.00 to the plaintiff in August 2018. It lacked detailed information on whether this money was handed over as a representative of the employer or as a private individual.
42. Against this Labor Court judgment, served to the parties on 10 May 2022, the plaintiff appealed on 31 May 2022, executed on Monday, 11 July 2022, and the defendant appealed on 10 June 2022 to the Regional Labor Court, which, after an extension of the appeal statement deadline until 8 August 2022, was substantiated on 8 August 2022.
43. The plaintiff argued that the Labor Court unjustly awarded only €2,000.00 instead of the claimed €11,000.00 for the violation of his right to information under Article 15 GDPR. The plaintiff was left unclear about the collection and processing of all his personal data, which constituted a fundamental and severe violation. His damage was that he was deprived of his rights and freedoms to control his personal data.
44. The first-instance court did not adequately address the commercialization of the image and video recordings. The defendant's promotion of the material occurred after the employment relationship ended. The defendant did not dispute that its financial benefit from the unauthorized use of the plaintiff's image amounted to €140,000.00.
45. The plaintiff requested:
46. The judgment of the Labor Court Pforzheim dated 23 February 2022, Az. 5 Ca 222/21, be amended to order the defendant to pay monetary compensation/non-material damages of €36,000.00, i.e., an additional €31,000.00 beyond the first-instance judgment, plus interest at 5 percentage points above the base interest rate since 22 April 2020.
47. The defendant requested:
48. 1. The plaintiff's appeal be dismissed.
49. 2. The further claim of the plaintiff be dismissed.
50. Counterclaiming, the plaintiff is ordered to pay the defendant €1,500.00 plus interest at 5 percentage points above the base interest rate since lis pendens.
51. The plaintiff requested the dismissal of the defendant's appeal.
52. The defendant argued that the right to information under Article 15 GDPR contradicts the principle that the claim must not be made generally. The Labor Court misunderstood that fulfillment already occurs when the information, according to the debtor's declared intention, represents the complete extent owed. The key is the declaration that the information is complete. Its inaccuracy does not negate fulfillment.
53. A claim for compensation for breach of the information obligation under Article 15 in conjunction with Article 82 GDPR does not exist from the outset. Such a claim does not arise merely because a legally existing right is not fulfilled; an immaterial damage must be present. Mere waiting for the information is insufficient.
54. Regarding the loan claim, the Labor Court should have investigated the first-instance submissions of the defendant. For details of the defendant's submissions, see pages 113 to 118 of the LAG file.
55. For details of the first and second instance party submissions, see the exchanged briefs with attachments and the hearing records.
Reasoning
A.
1. The appeals of the plaintiff and the defendant were timely and in proper form. The plaintiff's appeal is entirely admissible, and the defendant's appeal is partially admissible.
I.
2. The plaintiff's appeal is admissible. It challenges the partial dismissal of the claim except for the dismissal of the injunction request. The plaintiff accepts the dismissal in this respect. The appeal statement meets the legal requirements.
II.
3. The defendant's appeal is inadmissible insofar as it challenges the dismissal of the counterclaim without engaging with the Labor Court's reasoning. The Labor Court based its dismissal on the defendant's failure to substantiate that Mr. S. handed over €2,000.00 to the plaintiff as a representative of the employer, not as a private individual. The defendant did not address this decisive point in its appeal statement, rendering its appeal inadmissible.
4. Otherwise, the defendant's appeal is sufficiently substantiated and entirely admissible.
B.
1. The appeals of the parties are partially well-founded.
I.
2. On the plaintiff's appeal, the defendant is liable to pay €10,000.00 in damages for unauthorized use of image material in videos and photos showing the plaintiff.
1. The defendant's liability for damages for violating Article 17(3) sentence 1 in conjunction with Article 82(1) GDPR, or for a monetary compensation for violating the plaintiff's personal rights through the use of identifiable images of the plaintiff over a prolonged period, can be initially referred to the Labor Court's reasoning under II.2.b of its judgment (pages 214 to 217 of the Labor Court file). The defendant's objections in its appeal statement are unfounded.
2. When the defendant states that it was "agreed between the parties" that the defendant could continue using the training video with the plaintiff's image even after he left, there is no indication of who – as the defendant is a legal entity – agreed with whom and when about any specific arrangement. The plaintiff denied any such agreement.
3. Even if the plaintiff initially consented to the creation of images and their use for promotional purposes for the defendant, this consent did not extend beyond the termination of his employment, especially as the plaintiff took up a similar position with a competitor immediately after leaving. The defendant should have removed all images of the plaintiff from its promotional media at the latest when the plaintiff left (cf. Labor Court Neuruppin, 14 December 2021 - 2 Ca 554/21 - ZD 2022, 396). However, the defendant did not do so and exhibited behavior that significantly infringed the plaintiff's personal rights.
4. a) The defendant is correct that not every violation of the general personal rights, including the right to one's own image, gives rise to a claim for monetary compensation (BGH, 12 December 1995 - VI ZR 223/94 - NJW 1996, 984). An assessment based on the overall circumstances of the individual case is required. The extent of the infringement, including the spread of publication, the persistence and duration of the damage to the victim's interests or reputation, and the motive and degree of culpability of the perpetrator, must be considered. In cases of violations of the right to one's image, lower standards for granting monetary compensation generally apply, as the violation cannot be undone (BGH, 17 December 2013 - VI ZR 211/12 - BGHZ 199, 237). The focus is often on the victim's satisfaction, and it should also serve a deterrent function.
5. In this case, the plaintiff's personal rights were significantly infringed. Although the plaintiff
initially consented to the creation of images and possibly actively promoted them, it was clear to the defendant that this consent did not persist after the plaintiff left and joined a competitor. The defendant did not remove the images and video of the plaintiff from its promotional media, despite the plaintiff's repeated requests, until February 2020, over nine months after his departure.
6. b) The Labor Court did not adequately consider that the defendant exploited the plaintiff for commercial interests beyond the employment relationship. While this does not necessitate a "profit disgorgement," the profit derived from the infringement should factor into the compensation decision, alongside the severity of the infringement (BGH, 5 December 1995 - VI ZR 332/94 - NJW 1996, 984).
7. The defendant did not substantively dispute the plaintiff's claim that it offered four-day training courses on film application techniques from 1 May 2019 to 21 February 2020, attended by about six participants each at a price of €1,999.00 per person, and calculated a profit of €7,000.00 per course. However, the discussions during the oral hearings before the appeal chamber revealed that it could not be assumed that the course participants booked specifically because of the plaintiff's promotional material. The defendant did not advertise using the plaintiff's name, and the plaintiff did not claim to be known in the industry such that participants would specifically seek training with him. On the other hand, the defendant itself argued that the plaintiff held his current position with competitors because he became known through the training sessions and publications. Thus, the defendant exploited a certain advertising effect, which should be considered in the compensation amount, alongside the effort and cost of producing the training video.
8. c) Balancing these factors, the chamber finds €10,000.00 to be an appropriate compensation amount. The plaintiff's legal representation since early February 2020 does not increase the claim (cf. BAG, 5 May 2022 - 2 AZR 263/21 - NZA 2022, 1191).
9. Since the complaint was served on the defendant on 22 April 2020, the plaintiff is entitled to interest on the amount from the following day, 23 April 2020, according to Sections 291 and 288(1) BGB.
II.
10. The defendant's appeal, insofar as it is admissible, is partially successful.
1. The Labor Court's judgment was amended to dismiss the claim for €2,000.00 in non-material damages awarded for the defendant's failure to provide information under Article 15(1) GDPR within the one-month period stipulated in Article 12(3) sentence 1 GDPR.
11. a) The plaintiff did not demonstrate that a non-material damage resulted from the delayed provision of information.
12. A mere breach of the GDPR does not suffice to establish a claim for damages under Article 82(1) GDPR. This is supported by the wording of Article 82(1) GDPR, which grants a right to compensation to persons who have suffered material or non-material damage. Although Recital 146 sentence 3 GDPR calls for a broad interpretation of the term "damage" in line with the ECJ's case law to fully achieve the GDPR's objectives, a broad understanding of the damage concept does not mean entirely disregarding the existence of actual damage (LAG Hamm, 2 December 2022 - 19 Sa 756/22 - juris). Delayed, completely omitted, or incorrect responses to a request under Article 15(1) GDPR, as such, do not trigger liability. This interpretation is consistent with the wording of Recital 146 and Article 82(2) GDPR, as well as the legislative history of Article 82 GDPR. Article 77 of the Commission's proposal (COM[212]11) initially provided for compensation for damage resulting from unlawful processing or any action contrary to the Regulation. In contrast, the Parliament's later proposal (document 9565/15) restricted liability to damages caused by non-compliant processing (see the detailed legislative history of Article 82 GDPR in LAG Nürnberg, 25 January 2023 - 4 Sa 201/22 - juris). The legislative history can provide insights into the interpretation of a Union law provision (ECJ, 24 March 2021 - C-603/20 - FamRZ 2021, 777).
13. This interpretation aligns with recent ECJ jurisprudence, which held in its judgment of 4 May 2023 (C-300/21 - NZA 2023, 621) that not every breach of GDPR provisions automatically triggers a right to compensation under Article 82 GDPR.
14. The Federal Labor Court (BAG) also stated in its judgment of 5 May 2022 (2 AZR 363/21 - AP DSGVO Art. 82 No. 1 = NZA 2022, 1191) that failing to fulfill or fully fulfilling the right to information under Article 15(1) GDPR does not necessarily constitute a "processing" violation under the Regulation.
15. b) Moreover, the plaintiff did not demonstrate any damage resulting from the delayed information provision. The ECJ clarified in its judgment of 4 May 2023 (C-300/221 - NZA 2023, 621) that the existence of damage is a prerequisite for a claim under Article 82 GDPR (Wahlers jurisPR-ITR 10/2023, Annotation 4), even if the damage does not need to exceed a certain threshold. The ECJ stated in paragraph 50 of its judgment of 4 May 2023 (C-300/21): "However, this interpretation does not mean that a person affected by a GDPR violation, which has had negative consequences for them, would be exempt from proving that these consequences constitute non-material damage under Article 82 of this Regulation."
16. The plaintiff's assertion that he was deprived of his rights and freedoms to control his personal data does not substantiate a specific, even minor, non-material damage. "Mere annoyance" of the affected person does not suffice (cf. the Advocate General's Opinion of 6 October 2022 - C-300/21 - Celex No. 62021CC0300), nor does merely waiting for the information. Article 82(1) GDPR does not presume that the loss of control over one's data resulting from a GDPR breach, as such, constitutes compensable non-material damage (LAG Hamm, 2 December 2022 - 19 Sa 756/22 - juris).
17. 2. The defendant's appeal is also successful, leading to the modification of the Labor Court's judgment, insofar as it challenges the order for providing information. The information request is inadmissible due to a lack of specificity.
18. a) A claim is sufficiently specific if it clearly defines the raised claim by quantification or descriptive designation, so the court's decision-making authority (§ 308 ZPO) is clearly delineated, the content and scope of the res judicata of the sought decision (§ 322 ZPO) are identifiable, the risk of the plaintiff's potential partial defeat is not shifted to the defendant through avoidable imprecision, and any enforcement does not perpetuate the dispute in enforcement proceedings. It is not enough to refer to statutory provisions that outline the claim; the consequences arising from the norms must be considered in the specific case when formulating the claim (BAG, 27 April 2021 - 2 AZR 342/20 - BAGE 174, 351).
19. b) The plaintiff's information request does not meet these requirements.
20. aa) It is entirely unclear when information is considered "detailed" within the meaning of the requested information claim. Additionally, the request for information about "all personal data" collected and processed by the defendant in connection with the established employment relationship lacks sufficient specificity.
21. According to the ECJ (4 May 2023 - C-487/21 - DB 2023, 1275), the term "personal data" (Article 4 No. 1 GDPR) has a broad meaning, potentially encompassing all types of information of both objective and subjective nature in the form of opinions or assessments, provided it concerns information "about" the individual in question. This broad definition covers not only the data collected and stored by the controller but also all information about an identifiable or identified person resulting from data processing. Information "about" the individual concerns information that is linked to the individual due to its content, purpose, or effects (BGH, 15 June 2021 - VI ZR 576/19 - NJW 2021, 2726).
22. The term "personal data" is thus broadly understood (Granetzny in: Schlewing/Henssler/Schipp/Schnitker, Arbeitsrecht der betrieblichen Altersversorgung, 1. Personal data para. 5) and undefined. For instance, the level of detail required for the provided information is debated (BeckOK Datenschutzrecht/Schmidt-Wudy GDPR Article 15 para. 52), as is the question of when a person is identifiable or when anonymous data, which do not fall under the GDPR, are present (cf. EUArbRK/Franzen 4th ed. VO (EU) 2016/679 para. 4 ff.).
23. The use of terms subject to interpretation, like "personal data" in this case, is only permissible if further specification is not possible or reasonable for the plaintiff, and there is no doubt about their meaning for the parties, ensuring the scope of the request and the judgment is clear (BAG, 16 December 2021 - 2 AZR 235/21 - NZA 2022, 362). Generally, a claim merely repeating statutory text is insufficient to resolve a specific dispute with
res judicata effect (BAG, 9 July 2013 - 1 ABR 17/12 - NZA 2013, 1166; 25 April 2001 - 5 AZR 395/99 - NZA 2001, 1157).
24. In this case, the plaintiff's request for information about "all personal data…" merely repeats the wording of Article 15(1) sentence 1 clause 2 GDPR without specifying the information sought. This does not meet the specificity requirement of Section 253(2) No. 2 ZPO in this case (cf. LAG Berlin-Brandenburg, 16 March 2022 - 23 Sa 1133/21 - ZD 2023, 57 for a request concerning "specific personal data of the plaintiff"). This remains true even if the plaintiff's request is understood to demand "complete" information (left open by BGH, 15 June 2021 - VI ZR 576/19 - NJW 2021, 2726; cf. also BAG, 16 December 2021 - 2 AZR 235/21 - NZA 2022, 362).
25. It is unclear why the plaintiff could not have legally defined the term "personal data" in his request more precisely, especially to avoid shifting the risk of partial defeat to the defendant.
26. The lack of a shared understanding between the parties regarding the term "personal data" in this context is also evident. During the oral hearing before the appeal chamber, the court addressed the issue of the requests' admissibility and specificity. The plaintiff's side merely referred to the wording of Article 15(1) GDPR, and the defendant's side did not comment further.
27. The requirement for specifying this information request is also not generally inconsistent with the GDPR's protective direction. Recital 63 sentence 7 GDPR indicates that the controller may request the data subject to specify which information or processing activities their request relates to if the controller processes a large amount of information about the data subject (cf. LAG Hamm, 2 December 2022 - 19 Sa 756/22 - juris).
28. bb) The lack of specificity in the requested "personal data" also makes the information request inadmissible, as it demands the provision of "in particular" the five bullet-pointed items, which almost verbatim repeat the wording of Article 15(1)(a) to (e) and (g) to (h) GDPR.
29. The wording of the request, which treats these items as part of the information claim regarding all personal data, indicates that the plaintiff does not have a clear idea of what he is requesting. Article 15(1) GDPR ("about this personal data and the following information") indicates that the information listed in Article 15(1)(a) to (h) GDPR is not personal data but other distinct information (Schulte/Welge NZA 2019, 1110, 1111; see also ECJ, 4 May 2023 - C-487/21 - DB 2023, 1275 - para. 30: "…information about their personal data as well as the information listed in points (a) to (h) of this paragraph" - emphasis not in the original).
C.
I.
1. The cost decision follows from Sections 97 and 92 ZPO based on the respective degree of defeat or success of the parties.
II.
2. The revision was admitted regarding the plaintiff's information request under Article 15(1) GDPR due to fundamental legal questions (§ 72(2) No. 1 ArbGG).
3. The requirements for admitting the revision regarding the other issues are not met.
4. The limited admission of the revision was possible. The information claim is a separate factual and legal part of the overall dispute. The plaintiff did not file a stepwise claim.
