LAG Rheinland-Pfalz - 5 Sa 154/23
From GDPRhub
| LAG Rheinland-Pfalz - 5 Sa 154/23 | |
|---|---|
 | |
| Court: | LAG Rheinland-Pfalz (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 12(3) GDPR Article 15(1) GDPR Article 82(1) GDPR Article 82(3) GDPR § 26 BSSG |
| Decided: | 24.02.2008 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 5 Sa 154/23 |
| European Case Law Identifier: | ECLI:DE:LAGRLP:2024:0208.5SA154.23.00 |
| Appeal from: | ArbG Mainz 6 Ca 350/22 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Landesrecht Rheinland-Pfalt (in German) |
| Initial Contributor: | n/a |
An employee's claim against an employer for €3,000 in immaterial damages under Article 82 GDPR was dismissed, as delays in providing data under Article 15 GDPR alone don't suffice for damages. The court emphasized that specific immaterial damage must be proven.
English Summary
Facts
The data subject, an employee (the plaintiff), worked at a service center operated by the controller. On 12 July 2022, the data subject requested the removal of two warnings from her personnel file, which had been issued on 29 June 2022 for "data protection violations" and "disturbing workplace peace." On 13 July 2022, the data subject, citing Article 15 GDPR, demanded detailed information about her personal data processing and a copy of her data. The controller responded on 30 August 2022, which the data subject received on 2 September 2022, but did not provide the data copy. The data subject then sought additional court orders for the data copy and €3,000 in damages under Article 82 GDPR for delayed and incomplete information.
Initially, the Labour Court ordered the controller to pay €1,000 in immaterial damages. The court found that the controller responded late and failed to provide the requested data copy. The controller appealed, arguing that not all GDPR breaches justify damages unless a specific immaterial damage is proven. The data subject reciprocally appealed for higher compensation, emphasizing her "loss of control" over her data and emotional distress due to the delayed response.
Holding
The court of appeal found in favor of the controller, overturning the lower court's decision. It held that the data subject was not entitled to immaterial damages solely because the controller did not meet the one-month response deadline under Article 12 GDPR. The court emphasized that delayed responses do not automatically lead to damages under Article 82 GDPR. The data subject's claim of "loss of control" over her data wasn't substantiated; the data handling was in line with employment requirements under national law (§ 26 BDSG). The court also negated claims that the data subject's mental distress and sick leave were caused by the delay.
The court ruled that repeating the request verbatim from Article 15 GDPR isn't enough to claim a specific data copy under Article 15 GDPR. Exact data specifications are required for a copy request to be actionable. The controller's willingness to provide data access and copies in a structured manner further evidenced their compliance, negating claims of prolonged non-compliance.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Damages pursuant to Art. 82(1) GDPR - Non-material damage - Delayed provision of information Guiding Principle The delayed provision of information in response to a request under Art. 15(1) GDPR does not in itself constitute non-material damage (similarly, LAG Baden-Württemberg 27 July 2023 - 3 Sa 33/22). (Para. 35) Procedural History Hide procedural history Prior instance ArbG Mainz, 1 June 2023, 6 Ca 350/22, Judgment Tenor 1. On the defendant's appeal, the judgment of the Labor Court Mainz - External Chambers Bad Kreuznach - of 1 June 2023, Case No. 6 Ca 350/22, is amended and the complaint is dismissed. 2. The plaintiff's cross-appeal is dismissed. 3. The plaintiff shall bear the costs of the appeal proceedings. The plaintiff shall bear 70% and the defendant 30% of the costs of the first instance. 4. Revision is not permitted. Facts 1. The parties are still in dispute over non-material damages pursuant to Art. 82(1) General Data Protection Regulation (GDPR). 2. The defendant, an R. Service Center, operates among other things a call center for freight commission at F. H. It employs approximately 100 employees at this location and has a works council. The defendant is a wholly-owned subsidiary of L. Industry Solutions, and thus part of the L. group; it is not bound by collective agreements. 3. The plaintiff, born in August 1964, has been employed by the defendant since 1 November 2002 at a monthly gross salary of €2,080.00 (as of October 2022) as a service center employee on a 40-hour workweek. By notice dated 20 November 2014, she was recognized as having a disability degree (GdB) of 40. On 22 June 2015, she was equated with a severely disabled person effective 16 December 2014. The plaintiff has been a member of the representation for severely disabled persons since 2015. In 2022, she was unable to work, among other periods, from 12 July to 14 September 2022. 4. In a complaint dated 12 July 2022, the plaintiff initially requested the removal of two warnings from her personnel file, which the defendant had issued to her on 29 June 2022 with the labels "violation of data protection of particularly sensitive data" and "disturbance of operational peace" (claims 1 and 2). By extrajudicial letter dated 13 July 2022, received by the defendant on 14 July 2022, the plaintiff requested, referencing Art. 15 GDPR, 5 "detailed information on 6 § the purposes for which my personal data are processed; 7 § the categories of personal data being processed; 8 § the recipients or categories of recipients to whom my personal data has been or will be disclosed; 9 § the planned duration for which my personal data will be stored, or, if that is not possible, the criteria used to determine that period; 10 § the personal data not collected from me, any available information on their source; 11 § the existence of automated decision-making, including profiling, as per Art. 22(1) and 4 GDPR, and in such cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for me." 12 At the same time, she requested a copy of her personal data that was subject to processing. The defendant provided the requested information by letter dated 30 August 2022, received by the plaintiff on 2 September 2022; it did not provide a data copy. 13. With an amended complaint dated 2 February 2023, the plaintiff sought an order for the defendant to provide her with copies of the personal data subject to processing (claim 3). Moreover, she requested damages of €3,000.00 under Art. 82(1) GDPR for delayed and incomplete information (claim 4). She stated that she suffered non-material damage due to the loss of control over her personal data. The claimed amount comprised: €500 for the delay, €1,000 for the incomplete information (no copy), and €2,000 for the period from October 2022 to January 2023. 14. In the chamber hearing on 1 June 2023, the parties reached a partial settlement before the Labor Court. The defendant agreed to remove both warnings dated 29 June 2022 from the plaintiff's personnel file, the one for "disturbance of operational peace" immediately, and the one for "violation of data protection" by 31 August 2023. In return, the plaintiff agreed to ensure in future that messages are not sent to persons not directly involved in the matter when selecting email recipients. The defendant further committed to allow the plaintiff, after 31 August 2023, to inspect her personnel file to confirm the removal of the warnings. Additionally, the defendant agreed to grant the plaintiff immediate access to the personal data stored about her if she specifies in advance which particular data she wishes to see, and if necessary, to provide copies thereof. 15. The plaintiff sought in the first instance to 16. order the defendant to pay her €3,000.00 plus interest at five percentage points above the base rate from the date the complaint became pending. 17. The defendant requested 18. that the complaint be dismissed. 19. A further presentation of the undisputed facts and first-instance submissions under § 69(2) ArbGG is omitted, and reference is made to the statement of facts in the challenged judgment of 1 June 2023. 20. The Labor Court sentenced the defendant, dismissing the remainder of the complaint, to pay the plaintiff €1,000.00. It essentially reasoned that the plaintiff had a claim for non-material damage under Art. 82 GDPR. The defendant violated its obligations regarding the plaintiff's request for information dated 13 July 2022, as it only responded by letter dated 30 August 2022, received on 2 September 2022, thus not within the one-month period stipulated in Art. 12(3) Sentence 1 GDPR. Additionally, it did not timely provide the requested copies. The defendant's fault is presumed under Art. 82(3) GDPR. Considering the circumstances, non-material damage of €1,000.00 was appropriate but sufficient. For detailed first-instance reasoning, reference is made to the grounds of the challenged judgment of 1 June 2023. 21. The defendant filed an appeal against the judgment delivered on 9 June 2023 on 7 July 2023 at the Regional Labor Court and substantiated it within the extended deadline until 11 September 2023 with a brief received on 11 September 2023. The substantiation brief was served on the plaintiff on 25 September 2023. She filed a cross-appeal within the extended response deadline until 17 November 2023 by brief dated 17 November 2023 and substantiated it simultaneously. 22. The defendant essentially argues that the Labor Court wrongly assumed that a mere violation of the GDPR provisions established a claim for damages. According to the Court of Justice of the European Union (CJEU 04.05.2023 - C 300/21), national courts could not reject claims for damages under Art. 82(1) GDPR by arguing that the damage did not reach a certain level of seriousness. However, it could not be assumed that every breach of GDPR provisions would, in itself, open up a claim for damages by the affected person. The plaintiff must rather prove any alleged non-material damage. The plaintiff herself stated that the non-material damage lay solely in the loss of control over her personal data. She had not demonstrated how such a loss of control occurred. In an ongoing employment relationship, purpose-bound data processing is permissible. At no time were the plaintiff's data "out of control"; they were processed lawfully. The plaintiff's claim primarily rests on delayed information, not unlawful data processing. 23. The defendant applies at the appellate level to 24. 1. amend the judgment of the Labor Court Mainz - External Chambers Bad Kreuznach - of 1 June 2023, Case No. 6 Ca 350/22, and to dismiss the complaint in its entirety, 25. 2. reject the plaintiff’s cross-appeal. 26. The plaintiff applies to 27. 1. dismiss the defendant’s appeal, 28. 2. amend the aforementioned judgment upon the cross-appeal and order the defendant to pay her an additional €2,000.00 plus interest at five percentage points above the base rate from the date the complaint became pending. 29. She argues that the Labor Court should have awarded her damages of €3,000.00. She sustained non-material damage due to the loss of control over her personal data. The defendant's second-instance objections are excluded. The decision should have fully favored her without justification because the defendant did not substantively contest it in the first instance. Her situation in the employment relationship should be considered in assessing the non-material damage. She filed a lawsuit for discrimination and bullying against the defendant in case 6 Ca 738/22 (LAG Rheinland-Pfalz 5 Sa 155/23). Reference is made to the contents of her submissions dated 30 December 2022 and 8 May 2023 in case 6 Ca 738/22. She has suffered numerous disadvantages. She has been in a stressful employment relationship for years, with repeated and regular intense negative actions against her in various forms. She receives no appropriate salary increases and is continuously subjected to unjustified confrontations. After over 20 years of employment with the defendant, she still works for the statutory minimum wage. Therefore, in case 6 Ca 738/22 (LAG Rheinland-Pfalz 5 Sa 155/23), she asserted another information claim to obtain details about the earnings of other employees in the department to assess whether she is disadvantaged. The defendant offered her a termination agreement without cause, did not issue the requested interim reference (case 5 Ca 357/21), unjustly accused her of disrupting operational peace, and denied her reasonable salary progression. The non-timely and incomplete fulfillment of her GDPR information request is another component aimed to violate her honor and personality. The defendant signaled her clearly that her legitimate concerns would not be addressed, or if so, only insufficiently, incompletely, and untimely. This inflicted a particularly high non-material damage. The defendant had issued two unjustified warnings dated 29 June 2022, one for disturbing operational peace, one for an alleged data protection violation (sending an email to a distribution list of over 60 participants, including representatives for severely disabled persons, inclusion officers, and HR staff of the L. group containing health data of an employee). As the defendant values data protection, it must comply with GDPR deadlines when obliged to provide information. The defendant's breach must be seen in context with other incidents. Because the requested information was not provided timely and no copy was sent before the settlement, she felt broadly disadvantaged and sanctioned. Such humiliations particularly exacerbated her existing health condition; she suffers from psychological stress, which was significantly intensified. Due to the unjustified warnings, she experienced severe health impairments (e.g., sleep disturbances, sweating, severe discomfort). Hence, she was incapacitated for work due to psychological stress severely negatively impacted by the employment situation from 12 July to 14 September 2022. This health impairment caused by the unanswered request is ultimately the damage she suffered. It was again made clear to her that her concerns were ignored and she would not receive adequate information regarding her data. Contrary to the defendant's view, the delay was not minimal as, aside from the missed deadline, the requested copy was not voluntarily provided until the settlement. The disadvantage lasted many months. 30. For further details of the parties' submissions, reference is made to the exchanged briefs and annexes, as well as the content of the session minutes. Furthermore, reference is made to the file 6 Ca 738/22 (LAG Rheinland-Pfalz 5 Sa 155/23) consulted for the chamber's information. Legal Reasoning I. 31. The appeal filed by the defendant, which is admissible pursuant to § 64 paras. 1 and 2 ArbGG, is permissible in accordance with §§ 66 para. 1, 64 para. 6 ArbGG in conjunction with §§ 519, 520 ZPO. It has been submitted within the required form and time limit and properly substantiated. The cross-appeal by the plaintiff is also permissible; in particular, the one-month deadline for filing and substantiating the cross-appeal, starting from the delivery of the appeal statement, has been observed, § 524 paras. 2 and 3 ZPO, § 66 para. 1 ArbGG. II. 32. On the merits, the defendant's appeal is justified; the plaintiff's cross-appeal is unfounded. The defendant is not obligated to pay damages to the plaintiff. Therefore, the first-instance judgment is to be overturned, and the claim dismissed. 33. The plaintiff has no claim to non-material damages pursuant to Art. 82(1) GDPR because the defendant did not comply with her request for information under Art. 15(1) GDPR within the one-month period prescribed by Art. 12(3) sentence 1 GDPR. A claim for damages cannot arise merely from the fact that the defendant did not provide the data copy required under Art. 15(3) sentence 1 GDPR along with its response. 34. 1. The defendant did not respond within the one-month period of Art. 12(3) sentence 1 GDPR to the plaintiff's formulaic request for information dated 13 July 2022, received on 14 July 2022. The response dated 30 August 2022 only reached the plaintiff on 2 September 2022, and was thus (undisputedly) late. 35. a) The mere failure to provide the information timely does not, in itself, give rise to a claim for non-material damages. 36. The appellate chamber shares the legal opinion of other labor courts that a mere violation of GDPR provisions does not, by itself, suffice to establish a claim for damages under Art. 82(1) GDPR. This is supported by the wording of Art. 82(1) GDPR, which states that individuals who have suffered "material or non-material damage" are entitled to compensation. While Recital 146 sentence 3 of the GDPR suggests that the term "damage" should be interpreted broadly in line with the case law of the Court of Justice of the European Union (CJEU, 04.05.2023 - C-300/21), this does not imply that a specific damage can be assumed to be entirely absent. Thus, delayed responses to requests under Art. 15(1) GDPR do not, as such, trigger liability (LAG Düsseldorf 28.11.2023 - 3 Sa 285/23 - PM No. 29/2023; LAG Baden-Württemberg 27.07.2023 - 3 Sa 33/22 - para. 78 ff; LAG Hamm 02.12.2022 - 19 Sa 756/22 - para. 150 ff). 37. b) The "loss of control" over her personal data cited by the plaintiff does not constitute compensable non-material damage (LAG Baden-Württemberg 27.07.2023 – 3 Sa 33/22 – para. 82). In the case at hand, it is also not apparent what the plaintiff's "loss of control" could have entailed. The defendant rightly points out that the plaintiff's data did not "get out of control" but were processed for the purposes of the employment relationship under § 26 BDSG. Contrary to the plaintiff's view, the defendant can assert this in the appeal proceedings. The assertion of a "delay of possible defensive actions" lacks legal basis. 38. Mere annoyance about the defendant's untimely response to her information request also does not constitute compensable non-material damage. "Mere annoyance" of the affected person is insufficient, as are "mere waiting" for the response (see Advocate General’s opinion of 06.10.2022 in case C-300/21), to establish non-material damage. 39. This interpretative result aligns with the CJEU's case law, which emphasizes in its judgment of 4 May 2023 (case C-300/21 Österreichische Post) that a claim for damages requires the presence of "damage." A mere violation of the GDPR does not suffice to establish a claim for damages for the affected person (para. 42). A claim for damages does not depend on the damage reaching a certain degree of seriousness. However, this does not mean that a person affected by a GDPR violation that had negative consequences for them is exempt from proving that these consequences constitute non-material damage under Art. 82 GDPR (para. 50). 40. c) In the case at hand, the plaintiff did not succeed in demonstrating non-material damage resulting from the delayed provision of information within the meaning of the norm. 41. The plaintiff argues that the employment relationship has been strained for years; she references her statements in the ongoing legal dispute 6 Ca 738/22 (LAG Rheinland-Pfalz 5 Sa 155/23). There, she demands, inter alia, adequate compensation for pain and suffering of at least €30,000.00 for discrimination and bullying. The defendant's 18-day delayed response to her information request is seen by the plaintiff as another "building block" to insult her honor and personality. The defendant allegedly conveyed the "clear signal" that they do not deal with her concerns and, if they do, only inadequately, incompletely, and untimely. This does not demonstrate a causal damage from the delayed information provision. The same applies to her reference to the two warnings from the defendant dated 29 June 2022. 42. It is objectively not understandable why the defendant's response, which was 18 days late according to Art. 12(3) sentence 1 GDPR to an information request that was simply repeated the wording of Art. 15(1) second half-sentence GDPR, could have led to the plaintiff's "humiliation." Nor is there any objectively discernible violation of the plaintiff's honor or personality rights that could be recognized without regard to the plaintiff's subjective feelings. To the extent that the plaintiff claims she was unable to work from 12 July to 14 September 2002 due to psychological stress triggered by the defendant's delayed response, there is no causal link. The plaintiff's information request dated 13 July 2022 reached the defendant on 14 July 2022, and the one-month period of Art. 12(3) sentence 1 GDPR expired on 15 August 2022 (a Monday). The plaintiff’s inability to work started on 12 July 2022. The defendant's late response could not have causally influenced this period of inability to work. Furthermore, the plaintiff claims that she suffered from severe health impairments (among others, sleep disturbances, sweating, severe discomfort) due to the two warnings from the defendant dated 29 June 2022. The plaintiff's contradictory facts and circumstances cannot establish a causal link between her psychological ailment and the untimely response. Viewed objectively, the plaintiff’s information request was a reaction to the warning for data protection violations, not vice versa. This is evident from the chronological sequence. 43. 2. The defendant is not liable for damages because it did not provide the plaintiff with the required data copy under Art. 15(3) sentence 1 GDPR along with its response on 30 August 2022. There is no breach of duty by the defendant. 44. The plaintiff's written information request dated 13 July 2022 only reiterated the wording of Art. 15(1) second half-sentence GDPR and vaguely requested a copy of her personal data subject to processing. This does not generally suffice to establish a claim under Art. 15(3) sentence 1 GDPR. The mere repetition of the provision's wording does not clarify which specific personal data is being requested for a copy (see BAG 16.12.2021 - 2 AZR 235/21 - para. 33). Only once the information is provided can the affected person specify from which processed personal data a copy is requested. Here, the defendant agreed in clause 3 of the partial settlement dated 1 June 2023 to allow the plaintiff, in coordination with her supervisor, to inspect the stored personal data if the plaintiff specifies in advance which exact data she wishes to see. Contrary to the plaintiff's view, no unlawful condition existed before specifying her access request. Her accusation that the defendant disadvantaged her for "many months" by not providing a data copy with its response is unfounded. III. 45. The cost decision follows from §§ 91(1), 92(1) ZPO. The plaintiff must bear the costs of the second instance entirely since she was unsuccessful in the full amount in dispute (€3,000.00). The first-instance costs are proportionately divided considering the partial settlement, § 98 ZPO. Consequently, the plaintiff must bear 70% and the defendant 30% of the first-instance costs (with a dispute value of €9,160.00). 46. The revision was not permitted as the legal requirements under § 72(2) ArbGG were not met.
