| LAG Düsseldorf - 11 Sa 808/23 | |
|---|---|
 | |
| Court: | LAG Düsseldorf (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 12(3) GDPR Article 15(1) GDPR Article 15(2) GDPR Article 15(3) GDPR Article 82(1) GDPR § 287 ZPO |
| Decided: | 07.03.2024 |
| Published: | 24.06.2024 |
| Parties: | |
| National Case Number/Name: | 11 Sa 808/23 |
| European Case Law Identifier: | ECLI:DE:LAGD:2024:0307.11SA808.23.00 |
| Appeal from: | AG Düsseldorf (Germany) 14 Ca 2923/23 |
| Appeal to: | |
| Original Language(s): | German German |
| Original Source: | NRWE (in German) LAG Düsseldorf (in German) |
| Initial Contributor: | n/a |
A regional labour court awarded a data subject €750 in non-material damages because the controller continuously ignored their repeated access requests, violating Article 15 GDPR.
English Summary
Facts
The data subject, a job seeker with over ten years of experience in debt and accounts management, applied twice for a position at a housing company (the controller) on 3 August 2022 and 3 December 2022. The controller did not respond to either application.
On 18 May 2023, the data subject requested access to his personal data under Article 15 GDPR. After receiving no response, he sent reminders on 3 June 2023 and 18 June 2023, with deadlines of 17 June 2023 and 28 June 2023. The controller still did not respond.
The data subject then filed a lawsuit at the Labour Court Düsseldorf ("Arbeitsgericht Düsseldorf - AG Düsseldorf") seeking a copy of his data, information on all the recipients to whom his personal data was disclosed to, and €5,000 in non-material damages.
The first instance court ruled partially in favour of the data subject, granting the access request but denying the claim for non-material damages. The court held that a violation of Article 15(1) GDPR always means a loss of control and cannot be considered as the damage itself. Therefore, the court found that the data subject did not demonstrate any non-material damage entitling him to compensation.
The data subject then appealed this decision at the Regional Labour Court Düsseldorf ("Landesarbeitsgericht Düsseldorf - LAG Düsseldorf"), adjusting his claim to €2,500 in non-material damages.
Holding
First, the court held that the controller violated Article 15 GDPR in conjunction with Article 12(3) GDPR by not providing information on the data subject's personal data, its processing purposes, and the recipients of the personal data to the data subject after repeated requests.
Second, the court determined whether the violation under Article 15 GDPR gave rise to a claim for compensation for material and non-material damage under Article 82(1) GDPR. The court held that Article 82(1) GDPR should not be interpreted too narrow. The court took into account that some case law take the view that violations under Article 15 GDPR do not fall within the scope of Article 82 GDPR. Recital 146 states that damage caused to a person as a result of "processing" in breach of the Regulation must be compensated and fulfilling the obligation to provide information could be interpreted not to be considered "processing". However, the court held that the term "processing" is broadly defined in Article 4(2) GDPR and also includes "disclosure by transmission", meaning also information. The court further held that Recital 60 and Recital 63 state that the principles of fairness and transparency under Article 5(1) GDPR require for the data subject to be informed of the existence of the processing operation and its purposes, and that they are entitled to corresponding rights of access in order to "be aware of the processing and to be able to verify its lawfulness". Therefore, the right of access is intended to ensure the principles of fairness and transparency. The court therefore found that the obligation to provide compensation under Article 82(1) GDPR should also apply to a breach of the right of access.
The court agreed with the first instance court that not every breach of Article 15 GDPR automatically causes non-material damage as some might not feel a loss of control. However, the court found that in this case, the violation caused the data subject non-material damage. The data subject experienced a loss of control over his data and the inability to exercise his rights to rectification, erasure, restriction of processing, or objection as outlined in Article 16 GDPR and subsequent articles. The court noted that the controller's behaviour by not caring about the data subject's rights, which continued in the court proceedings, exacerbated the data subject's distress and uncertainty about the handling of his personal data.
The court ruled that the data subject was entitled to €750 in non-material damages, recognising the psychological impact and inconvenience caused by the controller's non-compliance. However, it dismissed the data subject's adjusted higher claim of €2,500, finding it disproportionate to the nature of the breach.
Comment
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Düsseldorf Regional Labor Court
IN THE NAME OF THE PEOPLE
DEFAULT JUDGMENT AND FINAL JUDGMENT
In the legal dispute between
W., C.-straße 114, V.
Plaintiff and Appellant
Represented by
Lawyers E., R.-straße 95, K.
vs.
A. GmbH, represented by its managing director Mr. Q., N.-straße 126, F.
Defendant and Respondent
The 11th Chamber of the Düsseldorf Regional Labor Court has, based on the oral hearing of March 7, 2024, through the presiding judge at the Regional Labor Court Salchow as chairperson and the lay judges Winkelkötter and Gesell, rendered the following decision:
I. The appeal of the plaintiff amends the final judgment
of the Düsseldorf Labor Court from August 4, 2023 - Case
No. 14 Ca 2923/23 - and the defendant is ordered to pay
the plaintiff non-material damages in the amount of
€750.00 plus default interest at five percentage points
since July 10, 2023. The plaintiff's further appeal is
dismissed.
II. Of the costs of the first-instance proceedings, the
plaintiff bears 71% and the defendant 29%. Of the costs
of the appeal proceedings, the plaintiff bears 85% and
the defendant 15%.
III. Revision is not allowed, insofar as the final
judgment dismissed the plaintiff's appeal.
FACTS:
The plaintiff is claiming compensation for damages under the GDPR in the second instance. The defendant is a nationwide housing company. In August 2022, it sought an employee for its central office in Düsseldorf-Angermund for receivables management. The plaintiff applied for the advertised position on August 3, 2022. Following a re-advertisement by the defendant, he submitted his application documents again on December 3, 2022. He received no response from the defendant.
In a letter dated May 18, 2023, the plaintiff requested that the defendant provide information pursuant to Article 15(1) and (2) GDPR and a copy of the data still being processed pursuant to Article 15(3) sentence 1 GDPR by June 2, 2023. He reminded the defendant of his request in letters dated June 3, 2023, and June 18, 2023, setting further deadlines, first until June 17, 2023, and then until June 28, 2023. The defendant did not respond.
The plaintiff claimed that he has been working in debtor and receivables management for more than ten years and that he applied for the above-mentioned advertised position with the defendant. After the defendant did not respond to his applications, he wanted to gain an overview of how his data was being handled and why the defendant had not responded. Since his requests were not answered, he experienced a loss of control and restriction of his rights. It was impossible for him to exercise supplementary rights to correction, deletion, restriction of processing, or objection under Articles 16 et seq. GDPR. The defendant obviously did not care about data protection and had intentionally kept him ignorant, so he did not know how his data was being processed. This caused him non-material damage. He claimed monetary compensation of at least €5,000.00 under Article 82(1) GDPR. Considering the defendant's financial strength and the need for a deterrent effect, the claimed minimum amount of compensation was appropriate.
The plaintiff requested:
1. The defendant be ordered to provide him with a copy
of all personal data processed by the defendant
concerning him.
2. The defendant be ordered to inform him of all
recipients to whom the defendant has disclosed his
personal data.
3. The defendant be ordered to pay him monetary
compensation, the amount of which is at the discretion
of the court, but should not be less than €5,000.00,
plus default interest at five percentage points above
the base rate from the date of pendency.
After the defendant was absent from the preliminary hearing in the first instance, the Labor Court granted the requests for the release of information and the provision of a data copy through a partial default and final judgment, dismissing the rest of the claim. The dismissal of the claim by a non-genuine default judgment ("final judgment") was based on the reasoning that the plaintiff had not demonstrated an immaterial damage entitling him to compensation. Following the ECJ decision of May 4, 2023 (C-300/21), a mere violation of the GDPR did not itself give rise to a claim for damages. Although a violation of Article 15(1) GDPR always entailed a loss of control, immaterial damage required an additional substantive requirement, and the loss of control alone did not constitute damage. The recitals 75 and 85 of the GDPR did not suggest otherwise.
The plaintiff appealed the judgment, served on him on August 24, 2023, on September 13, 2023, and substantiated the appeal on October 23, 2023.
The plaintiff argued that a violation of the right to information, not just a so-called processing violation, could give rise to a claim for damages under Article 82 GDPR. He criticized the judgment as unsustainable in light of ECJ jurisprudence. There was undoubtedly a violation of the GDPR. While it was true that not every data protection violation automatically resulted in immaterial damage, it was not necessary for the immaterial damage to be particularly significant or to go beyond a loss of control. The ECJ did not follow the conclusions of the Advocate General, who argued that not every loss of control constituted immaterial damage.
Article 85 GDPR explicitly lists the loss of control over personal data as a standard example of immaterial damage. The same applies to the restriction of the rights of the data subject: Without knowing the "whether, what, and why," it is impossible to check whether further rights under Articles 16 et seq. GDPR should be exercised. No additional disadvantages are required. Furthermore, he was significantly annoyed by the defendant's behavior. He had trusted the defendant with his data in good faith, believing he was applying to a reputable company. However, he now had to realize that the defendant was a dubious real estate company that trampled on the rights of data subjects. This realization intensified and underscored his perceived loss of control. He had to invest time, effort, and money to achieve a simple necessity - the fulfillment of his right to information. The loss of control, restriction of his rights, and his "annoyance" were adequate and causal consequences of the data protection violation.
The demanded (minimum) amount of the compensation claim was appropriate because the decision should have a deterrent effect. Even if the 3rd Chamber of the ECJ had decided otherwise, it was questionable whether the Grand Chamber of the Court would follow, especially since the compensation must be "effective" according to recital 146 sentence 6. Regardless, the claimed minimum compensation was modestly calculated. It was to be considered that the defendant was a financially strong company. Moreover, by not responding at all and not even providing the data after being convicted, the defendant had refused to deal with his rights. The immaterial damage continued to deepen day by day. It was one of the standard damages listed in recital 85, which should be considered severe per se. This was also evident from the fact that violations of the rights of the data subject under Article 83(5) GDPR were subject to high fines. The time aspect must also be considered.
The plaintiff initially continued to demand immaterial damages of at least €5,000.00, but after a partial withdrawal of the appeal, he last requested:
To amend the judgment of the Düsseldorf Labor Court of
August 11, 2023 - 14 Ca 2923/23 - to the extent that the
claim for immaterial damages was dismissed, and to order
the defendant to pay him immaterial damages, the amount
of which is at the discretion of the court, but should
not be less than €2,500.00, plus default interest at
five percentage points above the base rate from the date
of pendency.
The defendant neither responded to the appeal statement nor appeared at the oral hearing.
Regarding further details, reference is made to the exchanged briefs with annexes and the session protocols in both instances.
DECISION REASONS:
The plaintiff's appeal against the "final judgment" of the Labor Court is partly successful.
To the extent of a payment amount of €750.00, the appeal had to be granted by default judgment as requested since the defendant did not appear at the hearing despite proper transmission of the appeal, the appeal statement, and the summons. The further appeal had to be dismissed by a non-genuine default judgment.
I. The appeal is admissible, as it is permitted under § 64(2)(b) ArbGG and was properly filed and substantiated within the deadlines of § 66(1) ArbGG.
II. The claim had to be granted pursuant to § 64(6), (7) ArbGG, §§ 539 ff. ZPO to the extent apparent from the tenor.
The claim aimed at compensating an immaterial damage in the amount of at least €2,500.00 in its last version is admissible. As the Labor Court rightly established, it is not mandatory to quantify the payment claim since the court has discretion in determining the compensation claim under Article 82(1) GDPR.
The claim is also substantiated to the extent apparent from the tenor.
a) The decision had to be made based on the plaintiff's presentation. If the respondent in an appeal does not appear at the hearing, and the appellant requests the issuance of a default judgment, the admissible factual presentation is deemed admitted pursuant to § 64(6) ArbGG, § 539(2) sentence 1 ZPO.
The admitted presentation of the plaintiff substantiates the asserted claim in principle but only to the extent of €750.00.
b) The plaintiff's claim arises from Article 82(1) GDPR, as the defendant violated its obligations under Article 15(1), (2), and (4) GDPR, causing non-material damage to the plaintiff.
aa) The plaintiff can directly base his claim on Article 82(1) GDPR.
Pursuant to Article 82(1) GDPR, any person who has suffered material or non-material damage as a result of an infringement of this Regulation has the right to receive compensation from the controller or processor for the damage suffered. The GDPR has applied directly in every Member State of the European Union since May 25, 2018, under Article 288 TFEU, without the need for further implementation by national law. The controller within the meaning of Article 82(1) GDPR is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (Article 4(7) GDPR), i.e., the defendant.
bb) The defendant violated Article 15(1), (2), and (3) in conjunction with Article 12(3) sentences 1 to 3 GDPR.
(1) Under Article 15(1) GDPR, the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and if so, access to the personal data and information about the purposes of the processing (Article 15(1)(a) GDPR), the recipients or categories of recipients to whom the personal data have been or will be disclosed (Article 15(1)(c) GDPR), and the envisaged period or the criteria used to determine that period of storage (Article 15(1)(d) GDPR). In the case of a transfer to a third country or an international organization, the data subject has the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR (Article 15(2) GDPR). Furthermore, the data subject can request a copy of the personal data undergoing processing pursuant to Article 15(3) GDPR. According to the provision of Article 12(3) sentences 1 to 3 GDPR, such a request for information and a copy must be answered within one month of receipt, or within two further months after notification of an extension of the deadline.
(2) According to the admitted factual presentation of the plaintiff under § 539(2) sentence 1 ZPO, he requested comprehensive information on May 18, 2023, and further reminders on June 3, 2023, and June 18, 2023, from the defendant about whether and what data concerning him were processed. He had previously submitted such personal data to the defendant, most recently in December 2022, in the form of his application documents. He also demanded a copy of all data still being processed. By not responding to this request until the end of the oral hearing in the second instance, the defendant violated its obligations under Article 15(1), (2), and (3) in conjunction with Article 12(3) GDPR.
cc) A violation of the obligations under Article 15 GDPR can, in principle, give rise to a claim for compensation for material and non-material damages under Article 82(1) GDPR.
(1) In jurisprudence (cf. Düsseldorf Regional Labor Court November 28, 2023 - 3 Sa 185/23 - n.v.; PM No. 29/2023; Nuremberg Regional Labor Court January 25, 2023 - 4 Sa 201/22 - Rn. 21; Düsseldorf Regional Court October 28, 2021 - 16 O 128/20 - Rn. 35 ff.; Bonn Regional Court July 1, 2021 - 15 O 372/20 - Rn. 41; a. A. Hamm Regional Labor Court May 11, 2021 - 6 Sa 1260/20 - Rn. 54 ff.; Berlin-Brandenburg Regional Labor Court November 18, 2021 - 10 Sa 443/21 - Rn. 51 ff.; doubtful Federal Labor Court May 5, 2022 - 2 AZR 363/21 - Rn. 11) and literature (cf. Ehmann/Selmayr/Nemitz, GDPR Article 82 Rn. 8; Gola/Heckmann/Gola/Piltz, GDPR Article 82 Rn. 3), it is partly argued that such violations of the provisions of the GDPR do not fall within the scope of Article 82 GDPR. This interpretation of the norm is justified with recital 146, which mentions that damages suffered by a person as a result of non-compliance with the Regulation should be compensated. Since the question of fulfilling the right to information is not a data processing within the meaning of the legal definition of Article 4(2) GDPR, a violation of Article 15 GDPR would not constitute a liability-relevant action in principle (cf. Nuremberg Regional Labor Court January 25, 2023 - 4 Sa 201/22 - Rn. 21).
(2) The chamber responsible for the decision does not follow this narrow interpretation of the norm. Against such a narrow understanding of the norm speaks, on the one hand, its wording: In Article 82(1) GDPR, it is stated that a "violation of this Regulation" is meant, and not a non-compliant data processing. The interpretation that this rule contained in Article 82(1) GDPR is concretized by Article 82(2), where it states that the "controller involved in a processing" is liable for the damage, is neither evident from the overall context nor the purpose of the norm with sufficient certainty. Indeed, recital 146 mentions that damages that "a person suffers as a result of processing that does not comply with this Regulation" should be compensated. However, the term "processing" in Article 4(2) GDPR is broadly defined and also includes "disclosure by transmission," which also encompasses information provision. Additionally, recitals 60 and 63 show that the principles of fair and transparent processing require that the data subject is informed about the existence and purposes of the processing and has corresponding rights to access information to "be aware of the processing and verify its lawfulness." This implies that the right to information ensures fairness and transparency in the processing. Therefore, it is plausible to apply the compensation obligation under Article 82(1) GDPR to violations of the right to information (cf. Cologne Higher Regional Court July 14, 2022 - 15 U 137/21 - Rn. 15; probably also Stuttgart Higher Regional Court March 31, 2021 - 9 U 34/21 - Rn. 29; Rudkowski: The data protection right to information in labor law, NZA 2024, 1).
The recent case law of the ECJ also confirms that Article 82(1) GDPR should be understood broadly and also covers non-compliant behavior that (still) does not involve data processing. On the one hand, in its decisions on Article 82(1) GDPR, the ECJ generally states that a violation of "provisions of this Regulation" is a prerequisite (cf. e.g., ECJ December 14, 2023 - C-456/22 - Rn. 20, 21; ECJ May 4, 2023 C-300/21 - Rn. 28). On the other hand, in a judgment on the consequences of a violation of the obligation to conclude a data protection agreement and maintain a processing directory, the ECJ explicitly stated that even a violation that does not constitute an "unlawful processing" can give rise to a claim for compensation for any damage caused (cf. ECJ May 4, 2023 - C-60/22 - Rn. 69).
dd) According to the admitted factual presentation of the plaintiff, he suffered non-material damage causally caused by the violation of the obligations under Article 15(1), (2), and (3) GDPR.
(1) The proof or the uncontroverted or admitted presentation of non-material damage is, as the Labor Court rightly pointed out, not dispensable. As the ECJ has explicitly stated multiple times, the mere norm violation as such is not sufficient. Rather, a person affected by a violation of the GDPR that has caused them adverse effects must prove that these effects constitute non-material damage within the meaning of Article 82 GDPR (cf. ECJ December 14, 2023 - C-456/22 - Rn. 22; ECJ December 14, 2023 - C-340/21 - Rn. 84; ECJ May 4, 2023 - C-300/21 - Rn. 50).
(2) What constitutes non-material damage within the meaning of Article 82(1) GDPR is to be determined by an autonomous and uniform definition under Union law (cf. ECJ May 4, 2023 - C-300/21 - Rn. 30 and 44).
(a) The term "damage" is understood broadly by the Union legislator. The ECJ recently clarified that a certain degree of severity of impairment is not required (cf. ECJ May 4, 2023 - C-300/21 - Rn. 51; ECJ December 14, 2023 - C-340/21 - Rn. 78). The disadvantage does not have to be "perceptible" nor the impairment "objective." This interpretation follows from the third sentence of the 146th recital of the GDPR, which states that the term "damage" should be interpreted broadly in light of the ECJ's case law in a way that fully respects the objectives of this Regulation. This aligns with the GDPR's goals, namely ensuring a consistent and high level of protection for natural persons regarding the processing of personal data within the Union (cf. ECJ December 14, 2023 - C-456/22 - Rn. 20).
(b) The ECJ also determined that it does not matter whether the non-material damage claimed by the data subject following a proven violation of the GDPR is already associated with an actual misuse of their personal data by third parties at the time of their compensation claim or whether it is "only" related to their fear that such misuse might occur in the future. The wording of Article 82(1) GDPR does not exclude the possibility that the term "non-material damage" in this provision covers a situation where the data subject cites their concern that their personal data might be misused in the future due to the occurred GDPR violation. This broad interpretation of Article 82(1) GDPR is confirmed by the 146th recital and the intent of the Union legislator expressed therein (cf. ECJ December 14, 2023 - C-340/21 - Rn. 83).
Additionally, the ECJ clarified that the Union legislator intended the term "damage" to particularly include the mere "loss of control" over one's data due to a GDPR violation, even if there was no actual misuse of the concerned data to the detriment of the individuals. To justify this, the ECJ referred to the first sentence of the 85th recital of the GDPR. In an exemplary list of possible material or non-material damages, the "loss of control" over personal data is explicitly mentioned (cf. ECJ December 14, 2023 - C-340/21 - Rn. 74 - 86).
(3) However, contrary to the plaintiff's view, this does not mean that every violation of the right to information under the GDPR, due to the associated loss of control and restriction of rights, "automatically" causes non-material damage that should be compensated under Article 82(1) GDPR. While it is true that the ECJ in the cited decision mentions the loss of control as an example of damage in recital 85, the ECJ also makes it clear that the affected person must prove in each individual case that the loss of control actually caused them damage. The ECJ explains that, for instance, if the affected person expresses a fear that their data might be misused, the court must assess whether this concern is justified under the specific circumstances and considering the affected person (cf. ECJ December 14, 2023 - C-340/21 - Rn. 86). The short-term loss of control over personal data can cause damage, even if minor. However, it must be proven that this actually occurred (cf. ECJ December 14, 2023 - C-456/22 - 22).
This further examination or proof would be unnecessary if every failure to provide information, i.e., every violation of Article 15 GDPR, inevitably caused damage. In other words, if the affected person does not feel a loss of control despite the lack of information about their data, or if their stated feeling is not justified under the given circumstances, a claim for damages is excluded.
(4) Based on these principles, the plaintiff suffered non-material damage caused by the defendant's GDPR violation.
(a) The plaintiff claimed that the defendant's violation of its obligations caused him non-material disadvantages. In the appeal statement, he referred to other court decisions, stating that an "uneasy feeling," an annoyance, as well as subjective sensitivities and feelings like "annoyance," "fears, worries, and stress," and loss of comfort and time, constituted non-material damage.
(b) After being informed by the court that this reference did not clearly indicate whether and to what extent he personally felt these concerns or emotions, the plaintiff argued that a mere reference to the experienced loss of control sufficed. Because this, according to the regulation's intent, already constituted non-material damage.
(c) This - incorrect - legal opinion does not absolve the chamber from considering the further factual presentation of the plaintiff regarding the consequences of the violation and assessing whether non-material damage occurred: Upon reasonable consideration, his first and second instance submissions can be understood as indicating that the plaintiff perceives the loss of control due to the missing information as a disadvantage because he does not know if his data is being handled "honestly" - i.e., lawfully. He already explained in the complaint that the defendant had "intentionally kept him ignorant" about his data, preventing him from knowing how his data was being processed. The defendant showed by its behavior that it did not care about data protection. He could not exercise supplementary rights to correction, deletion, restriction of processing, or objection. In his brief of February 19, 2024, he further explained that the defendant seemed to be a "dubious real estate company" that "trampled on the rights of affected persons." This "intensified and underscored" his "perceived loss of control." Additionally, he was significantly annoyed by the defendant's non-transparent behavior because he had to invest time, effort, and money to achieve the fulfillment of his right to information and fundamental right from Article 15 GDPR and Article 8(2) sentence 2 CFR.
With these statements, the plaintiff also expressed his own negative feelings and his fear that the defendant might not only violate his rights under Article 15 GDPR but also misuse his data. These concerns were confirmed by the plaintiff during the oral hearing on March 7, 2024.
(d) These concerns and feelings appear justified under the given specific circumstances.
The plaintiff applied for a position at the defendant's company on August 3, 2022, and again in December 2022, submitting personal data with his application. The defendant did not respond to his application or his subsequent inquiries about his data. In the first instance proceedings, the defendant did not respond to the complaint and was in default. In the appeal proceedings, the defendant also refrained from making any statement.
The plaintiff is correct that such behavior creates the impression that the defendant does not want to acknowledge the data protection rights arising from the GDPR. If the defendant intended to comply with its GDPR obligations, it would have been easy for it to respond to the plaintiff's inquiries or at least inform him that it needed to verify his data. By simply not reacting, the defendant made it clear that it did not take the plaintiff's concerns and rights seriously or that it did not care. This impression is further confirmed and intensified by the defendant's continued behavior in the legal proceedings, despite the proven service of the complaint and the summons to the hearing, by not responding to his legitimate information requests. In such a situation where one's concerns are simply ignored, it is understandable to feel a loss of control over one's data as an impairment, annoyance, and fear of misuse.
ee) The described damage was causally caused by the data protection violation. If the defendant had complied with the plaintiff's information request, he would not have remained uncertain about the handling of his personal data. He would not have had to (rightly) fear misuse.
ff) To compensate for this non-material damage, the chamber considers a sum of €750.00 appropriate but also sufficient. The further appeal is unfounded and therefore had to be dismissed by final judgment.
The plaintiff had left the assessment of the amount of non-material damage to the discretion of the court, § 287(1) sentence 1 ZPO. Based on this, the court had to decide on the amount of damage by freely assessing all circumstances.
(1) According to the established case law of the ECJ, in the absence of relevant Union law provisions, it is the responsibility of each Member State's national legal system to regulate procedural rules for actions that guarantee the protection of the individual's rights derived from Union law, provided that these requirements are not less favorable than those governing similar domestic situations (principle of equivalence), and the exercise of rights conferred by Union law is not rendered practically impossible or excessively difficult (principle of effectiveness, cf. ECJ April 7, 2022 - C-385/20 - Rn. 47; ECJ October 6, 2020 - C-511/18 - Rn. 223; ECJ December 19, 2019 - C-752/18 Rn. 33; ECJ October 6, 2015 - C-69/14 - Rn. 26 f.). In the present case, this leads to the application of § 287(1) sentence 1 ZPO, in the absence of relevant Union law provisions. Article 82 GDPR itself does not regulate procedural rules for enforcing the compensation claim.
Applying § 287(1) sentence 1 ZPO meets the principles of equivalence and effectiveness. This provision is also applied in national law for the enforcement of other claims for non-material damage compensation. Moreover, it particularly facilitates effective enforcement of compensation claims because it allows the plaintiff to choose a lower standard of proof (cf. Federal Labor Court May 5, 2022 - 2 AZR 363/21 - Rn. 14; Düsseldorf Regional Labor Court April 26, 2023 - 12 Sa 18/23 - Rn. 179).
(2) When assessing the amount of a compensation claim under § 287(1) ZPO, the court has wide discretion to consider the specificities of each individual case.
(a) Recital 146 (sentence 6) of the GDPR makes it clear that the affected person should receive full and effective compensation for the damage suffered.
In a recent decision, the ECJ clarified that compensation is "full and effective" if it allows the full compensation of the damage actually suffered due to the GDPR violation. Unlike Articles 83 and 84 GDPR, which essentially have a punitive purpose as they permit the imposition of fines or other sanctions, Article 82 GDPR has no punitive but a compensatory function. It neither has a deterrent nor a punitive function. Therefore, the severity of the GDPR violation does not affect the amount of compensation to be granted. The decisive factor is solely that the monetary compensation allows the complete compensation of the damage actually suffered due to the violation of this Regulation (cf. ECJ December 21, 2023 - C-667/21 - Rn. 80 ff.; different under the application of Article 83 valuations LG Lübeck December 7, 2023 - 15 O 73/23 - Rn. 128 ff.; LG Cologne May 18, 2022 - 28 O 328/21 - Rn. 34 f.; Labor Court Düsseldorf March 5, 2020 - 9 Ca 6557/18 - Rn. 102; left open Federal Labor Court May 5, 2022 - 2 AZR 363/21 - Rn. 17).
(b) Based on these principles, the chamber estimated the plaintiff's non-material damage at €750.00.
(1) The chamber considered that the European legislator per se assessed the violated right to information as significant, as indicated by the inclusion of Article 15 GDPR in the catalogue of Article 83(5) GDPR.
The violation results in uncertainty about the (honest) handling of one's data and the associated inability to assert rights against the defendant or third parties. The plaintiff's described and reasonably assessed fears and negative feelings like annoyance and "being annoyed" were included in the assessment.
However, the plaintiff did not present further psychological burdens, social or societal disadvantages, restrictions in personal lifestyle, or the possibilities of personal development and expression.
(2) To assess the severity of the damage, the chamber also considered the nature of the personal data the plaintiff remained uncertain about.
The plaintiff did not concretely state which information he provided to the defendant in writing. The chamber assumed that the application included typical documents, namely a cover letter, a resume with a photo, and educational and employment certificates. The plaintiff confirmed this in the oral hearing on March 7, 2024, stating that he submitted such documents digitally to the defendant.
Personal photos are often published by individuals themselves on social networks or by third parties with the knowledge of the data subject - apparently also in the plaintiff's case, who is visible on several poker websites. The chamber could leave aside whether the plaintiff had indeed already published his photo with the consequence that his concern about further processing or other use by the defendant could hardly be assessed as a significant burden. Because at least other components of his application documents, such as the private address and assessments from former employers, are information that affected individuals usually regard as sensitive and specifically make available only to third parties who have a legitimate interest. On the other hand, there is no indication or presentation by the plaintiff that his documents included personal data with particularly high protection requirements, such as genetic, biometric, and health data, or personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. The impairment due to the uncertainty about the handling of the data is initially assessed as low to moderate.
(3) Finally, the chamber considered that the damage deepened with the duration of the uncertainty. The impairment during the first month (June 2023), when the plaintiff set new deadlines for the defendant, and the following month (July 2023) is assessed as minor. A valuation of €100.00 seems appropriate in this respect. In the following months, the violation persisted and, according to the plaintiff's description, intensified his negative feelings and concerns. Considering this progression and all circumstances, the chamber considers a total amount of €750.00 to compensate for the suffered disadvantages as appropriate.
III. The cost decision is based on §§ 92(1), 516(3) sentence 1 ZPO.
In distributing the costs of the first instance, the chamber - like the Labor Court - assumed that the request for information under Article 15(1), (2) GDPR and the request for the provision of a data copy were each valued at €500.00. This corresponds to the predominant case law of the regional labor courts (cf. with detailed reasoning Munich Regional Labor Court August 2, 2023 - 3 Ta 142/23 - Rn. 26; Düsseldorf Regional Labor Court May 6, 2022 - 4 Ta 108/22 - Rn. 13; Berlin-Brandenburg Regional Labor Court March 18, 2021 - 26 Ta (Kost) 6110/20 - Rn. 5; Baden-Württemberg Regional Labor Court January 23, 2020 - 5 Ta 123/19 - Rn. 24; Nuremberg Regional Labor Court May 28, 2020 - 2 Ta 76/20 - Rn. 14; Hessen Regional Labor Court January 11, 2022 - 12 Ta 417/22 - Rn. 15).
IV. The decision on the non-admission of the revision is based on § 72(1) ArbGG.
LEGAL REMEDY INSTRUCTION:
An objection can be lodged against the default judgment by the defendant. The plaintiff has no legal remedy against the default judgment.
The objection must be filed in writing or electronically with the Düsseldorf Regional Labor Court within a non-extendable period* of one week after the service of this default judgment.
Düsseldorf Regional Labor Court
Ludwig-Erhard-Allee 21
V.
Fax: 0211 7770-2199
The objection can also be declared in writing at the office of this Regional Labor Court. The objection can also be declared at the office of another court, but it must be received within the non-extendable period at the above-mentioned Regional Labor Court.
For lawyers, authorities, and legal persons of public law, including the associations formed by them to fulfill their public tasks, there is a general obligation to file the objection exclusively as an electronic document as of January 1, 2022, according to §§ 46g sentence 1 ArbGG. The same applies to authorized persons for whom a secure transmission channel according to § 46c(4) no. 2 ArbGG is available.
The electronic form is preserved by an electronic document. The electronic document must be suitable for processing by the court and signed with a qualified electronic signature of the responsible person or signed by the responsible person and submitted via a secure transmission channel according to § 46c ArbGG in accordance with the detailed requirements of the Regulation on the Technical Framework Conditions of Electronic Legal Transactions and the Special Electronic Mailbox of Authorities (ERVV) of November 24, 2017, as amended. Further information on electronic legal transactions can be found on the website www.justiz.de.
Means of attack and defense, as far as this corresponds to the process situation of careful and promotion-minded litigation, as well as objections concerning the admissibility of the lawsuit and/or appeal, must be presented simultaneously. However, there is a need for legal representation for these declarations. They must be made by a representative and, if submitted in writing, signed by such a representative. Only the following are admitted as representatives:
1. Lawyers,
2. Trade unions and associations of employers as well as
associations of such associations for their members or
for other associations or associations with a similar
orientation and their members,
3. Legal persons whose shares are wholly owned by one of
the organizations mentioned in no. 2 if the legal person
exclusively conducts legal advice and legal
representation for this organization and its members or
another association or association with a similar
orientation and their members in accordance with their
statutes, and if the organization is liable for the
activities of the representatives.
A party authorized as a representative can represent itself.
Means of attack and defense presented later are only to be admitted by the court if their admission would not delay the resolution of the dispute or if the delay is sufficiently excused.
* A non-extendable period cannot be extended.
No legal remedy is given against the final judgment.
For the possibility of a non-admission complaint, see § 72a ArbGG.
Salchow Winkelkötter Gesell
