LAG Baden-Württemberg - 9 Sa 73/21
| LAG Baden-Württemberg - 9 Sa 73/21 | |
|---|---|
 | |
| Court: | LAG Baden-Württemberg (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15 GDPR Article 82 GDPR |
| Decided: | 28.07.2023 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 9 Sa 73/21 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Landesrechtsprechung Baden-Württemberg (in German) |
| Initial Contributor: | mg |
A German court ordered an employer to compensate their employee pursuant to Article 82 GDPR for having refused to comply with an access request, even if the processing at issue was a direct consequence of a disciplinary offence by the data subject.
English Summary
Facts
The data subject was employed by the controller, a company. After an alleged disciplinary offence, the data subject got a warning signed by the owner (and only shareholder) of the company. In particular, the letter stated that the data subject stored confidential information about the company on a USB pen drive. The owner of the company had found the USB and confiscated it.
The data subject asked for access to their personal data, including the content of the USB, claiming ownership over the latter. They also asked the warning to be erased under Article 17 GDPR. Finally, the data subject claimed their right to compensation for damages suffered as a consequence of the unlawful processing.
The owner declared that data originally stored on the USB were backed up and erased from the pen drive. They refused to grant access to the data and to delete the warning.
The court of first instance rejected the data subject’s claims. No erasure under Article 17 GDPR could be asked to the controller, as the employment relationship between the parties had meanwhile expired. Article 15 GDPR was not applicable either, since the data subject did not own the content of the USB, namely the confidential information unlawfully collected from the company. Therefore, there was no right to compensation pursuant to Article 82 GDPR.
The data subject appealed the decision before the Regional Labour Court of Baden-Württemberg (Landesarbeitsgericht Baden-Württemberg, LAG Bade-Württemberg)
Holding
Concerning the right to erasure of the data subject, the court overturned the first instance judgement. The court noted that a warning was no longer necessary after the termination of the employment contract between the data subject and the controller. Therefore, Article 17(1)(a) GDPR applied.
Concerning the right to access, the court clarified that the case at issue was a case of co-controllership. The employer (the company) was clearly controller within the meaning of Article 4(7) GDPR. However, the owner themselves was controller, as they personally signed the warning and were the only stakeholder of the company where the data subject was employed. The court considered these facts sufficient to prove that the owner determined purposes and means of the processing, when it comes both to the warning and the operations on the USB.
From the submission of the controllers themselves it was clear that the controllers processed personal data stored on the USB, as they stated that data were backed up and erased from the device. By not informing the data subject about such data and processing operations – or at least not within the one-month deadline established by Article 12(3) GDPR – the controllers violated Article 15 GDPR. The alleged unlawful conduct of the data subject did not change the situation, as the fact that the controller was allowed to process data on the USB did not exclude their accountability concerning the access request.
Finally, the court granted €2,500 of compensation for non-material damages pursuant to Article 82 GDPR. According to the court, the damage is substantiated by the mere fact that the data subject did not know what kind of information the controller processed about them, which was particularly concerning in the context of their employment relationship.
Comment
In the present case, it is not clear what was the content of the USB, except for the confidential information that the controller declared to have backed-up and erased. Nevertheless, the court seems to consider such information already personal data. The existence of personal data (and related processing) arguably depends, in the view of the court, on the ownership of the USB.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
