Banner1.jpg

VG Stuttgart - 14 K 870/22

From GDPRhub
VG Stuttgart - 14 K 870/22
Courts logo1.png
Court: VG Stuttgart (Germany)
Jurisdiction: Germany
Relevant Law: Article 4(15) GDPR
Article 9(1) GDPR
Article 9(2)(b) GDPR
Article 9(2)(f) GDPR
Article 9(2)(h) GDPR
Article 82(1) GDPR
Article 34 GG
Decided: 20.06.2024
Published:
Parties:
National Case Number/Name: 14 K 870/22
European Case Law Identifier: ECLI:DE:VGSTUTT:2024:0620.14K870.22.00
Appeal from:
Appeal to: Unknown
Original Language(s): German
Original Source: Landesrecht BW (in German)
Initial Contributor: larm

A court granted €2,500 in non-material damages under Article 82 GDPR because a municipality had unlawfully disclosed a civil servant's health data in an e-mail inviting staff members to apply for the data subject's position.

English Summary

Facts

The data subject is a civil servant that works at a municipality (the controller). In 2017, the data subject had a stroke that led to a longer sick leave of the data subject. Following a medical examination by the public medical officer, the controller decided to attempt to transfer the data subject to early retirement in September 2018. This attempt ultimately failed, as the data subject successfully challenged the early retirement before the Administrative Court Stuttgart (Verwaltungsgericht Stuttgart – VG Stuttgart) in November 2021 therefore remaining a civil servant.

However, on 5 July 2018 the controller had already sent out a job offer to about 80 staff members. It included the information that the previous staff member (the data subject) was about to be transferred to early retirement due to his incapacity to work.

On 16 February 2022, the data subject sued the controller for €20,000 in damages before the VG Stuttgart due to the disclosure of his health information and claiming that the transfer of the his file to the municipality’s lawyer was also illegal.

Holding

The court found that the lawsuit was admissible and belonged before the administrative court, even though Article 34 Basic Law (Grundgesetz – GG) assigns all claims of official liability to the civil courts. The VG Stuttgart argued that Article 82 GDPR was not an official liability claim.

The court awarded the data subject €2,500 in non-material damages.

The court held that there was a violation of Article 9(1) GDPR due to the disclosure of the alleged disability for service in the job offer the controller had sent out. This was health data under Article 4(15) GDPR, because the inability to work was due to the health status. The wording “previous office-bearer” made the data subject identifiable.

The disclosure was neither necessary under Article 9(2)(b) nor (f) GDPR.

The court also found that the data subject had suffered a non-material damage. The data subject had claimed that he had been asked by another staff member about his health status. Furthermore, the e-mail had reached a large number of employees and he feared that the e-mail could have been forwarded to external persons. This amounted to a non-material damage of €2,500.

For the calculation of the exact amount of damages, the court factored in that the information was disclosed to over 80 recipients and that it was an especially sensitive information and that, even though the transferral procedure had not been finished, the data subject was marked as not fit for service before a large group of his colleagues.

The court also recognised that there was no evidence that the disclosed information were really made public or at least known to anyone outside of the administration. The staff had been informed about their duty to confidentiality under the GDPR and there was no detailed information about the data subject’s health status. Furthermore, the information was given for a factual reason, and this was to inform possible applicants that, before they could formally assume office the transferral of the former office-bearer had to be finalised. Hence, the information was not given out arbitrarily. Therefore, an even higher damage did not seem justified.

However, the transfer of the file to the controller’s lawyer was not a violation because it was justified under Article 9(2)(b), (f), and (h) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Jurisdiction in the event of claims for damages under the General Data Protection Regulation; Sending the personnel file of a civil servant to the employer's legal representative in the context of a legal dispute

Guiding principle

1. Article 82 para. 1 GDPR (juris: EUV 2016/679) does not constitute a claim for official liability within the meaning of Article 34 sentence 3 GG or Section 17 para. 2 sentence 2 GVG.(Rn.23)

2. The administrative courts decide on civil servants' claims for damages under Article 82 para. 1 GDPR (juris: EUV 2016/679) in accordance with Section 54 para. 1 BeamtStG.(Rn.21)

3. If the personnel file of a civil servant is requested by the court in a legal dispute, sending the file to the commissioned law firm for submission to the court does not violate Article 9 para. 1 GDPR (juris: EUV 2016/679), but is justified under Art. 9 Para. 2 lit. b, f and h GDPR (juris: EUV 2016/679). (Rn.31)

Tenor

The defendant is ordered to pay the plaintiff €2,500.00 plus interest from the date of action.

The defendant's objection decision of January 17, 2022 is annulled.

The rest of the action is dismissed.

The plaintiff shall bear 7/8 of the costs of the legal dispute, the defendant 1/8.

Facts

Rin.1

The plaintiff seeks damages for alleged violations by the defendant of the duty of care under civil service law and data protection regulations.

Rin.2

The plaintiff, born on xx.xx.xxxx in L., is a graduate in public administration (FH). On August 1, 1988, the city of L. appointed him to a civil service position on probation and appointed him as a city inspector candidate. By certificate dated December 26, 1994, the district of K. appointed the plaintiff to a civil service position for life and appointed him district administrator. Since then, the plaintiff has held various positions in the public service. With effect from January 1, 2016, the city of O. transferred the plaintiff to the defendant, where he took over the management of the main and personnel office in status office A 13.

Paragraph 3

On March 13, 2017, the plaintiff suffered a stroke. He was subsequently on sick leave for a long period. After an official medical examination had been ordered and carried out, the defendant's municipal council decided on June 26, 2018 in a closed session to initiate proceedings to retire the plaintiff and to re-advertise the position of office manager within the company.

Marginal number 4

By email dated July 5, 2018, the defendant re-advertised the position of head of the main office. The email was addressed to around 83 recipients who worked in various positions at the defendant or municipal companies. The subject line of the email was "WG: Job advertisement for head of the main office". Attached to the email was a job advertisement from the defendant, which contained the following passages in addition to a job description and the requirements profile:

Marginal number 5

"The town of P. with around xx,xxx inhabitants is the eastern gateway to the S. region. The scenic location in the N. and F. valleys on the edge of the S. forest and xxx leads to a high residential and leisure value. P. has a well-developed childcare offer, all secondary schools and an attractive club and cultural life. Based on a medical report examining the fitness of the previous office holder, the municipal council of the city of P. has approved the initiation of a procedure for retirement due to confirmed incapacity for work and the re-filling of the office manager position. We are therefore looking for a new head of the main office. The main office includes the subject areas (…) The position is in salary group A 13. An assignment to the permanent position or promotion can only take place after the completion of the procedure for the retirement of the previous office holder. We ask that applications with relevant documents be sent to the city administration of P., Mayor B., S.-strasse xx, xxxxx P. by July 13, 2018."

Margin number 6

On July 24, 2018, the defendant's municipal council was informed in a closed session about the new advertisement for the office manager position. The draft resolution explained that the job advertisement explicitly stated "that an assignment to position A 13 or a promotion could only take place after the completion of the process for Mr. X.'s retirement". The difference in remuneration was to be offset by a performance bonus in accordance with Section 76 of the State Remuneration Act. The municipal council decided, also in a closed session on July 24, 2018, to fill the position with the only internal applicant.

Paragraph 7

By decision of September 7, 2018, the defendant retired the plaintiff at the end of September 2018, against which he initially lodged an unsuccessful objection. On March 11, 2019, the plaintiff filed a lawsuit against the retirement (xxx) with the Stuttgart Administrative Court. With a final judgment of November 2, 2022, the Stuttgart Administrative Court annulled the defendant's decision to retire the plaintiff on September 7, 2018 and the objection decision of February 11, 2019. The Stuttgart Administrative Court dismissed a separate claim for compensation for working hours from the aforementioned proceedings with a final judgment of November 24, 2021 (xxx).

Paragraph 8

In a letter dated April 26, 2021, the plaintiff's legal representative demanded that the defendant pay €20,000 via its legal representative. The defendant had made itself liable for damages by violating its duty of confidentiality and secrecy with regard to the plaintiff's health situation. The defendant did not respond substantively after its legal representative had initially asked for an extension of the deadline. In a letter dated December 29, 2021, received by fax on December 29, 2021, the plaintiff's legal representative filed an objection with the defendant and requested that the defendant pay the plaintiff €20,000. In support of this, the plaintiff's legal representative referred to the letter dated April 26, 2021 and added that there was also a violation of data protection law that was not justified. Art. 82 GDPR therefore also gives rise to a claim for damages. Another violation was the sending of the plaintiff's personnel file to the city's authorized law firm.

Paragraph 9

In letters dated March 22, 2021 and August 6, 2021, the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg asked the defendant for a statement on, among other things, the handling of the plaintiff's personnel file. In the letter dated August 6, 2021, the State Commissioner for Data Protection also pointed out the information obligations under Art. 13 GDPR and the duties of the official data protection officer. It was also stated that, in the opinion of the State Commissioner, the reference to the plaintiff's ability to work in the job advertisement was not permissible from a data protection perspective and would result in supervisory measures if it were repeated.

Paragraph 10

By decision of January 17, 2022, the defendant rejected the plaintiff's objection. The objection was already inadmissible because there was no administrative act. A decision on the claim for damages was never made.

Paragraph 11

On February 16, 2022, the plaintiff filed the present action with the Stuttgart Administrative Court.

Paragraph 12

In support of this, he states that he was informed on March 24, 2020 that his personnel file was in the defendant's authorized law firm. He was neither asked for his consent to this nor did he give it. The passing on of the personnel file was also inadmissible in other respects; in particular, it would have been sufficient if the defendant had informed its authorized representative of the essential contents of the file. In the job advertisement of July 5, 2018, he was clearly identifiable as the previous incumbent. His state of health was thus made public and he was also branded as unfit for service. This was not even the case - as it later turned out. There is no necessity or justification for this. It is true that, within the framework of practical concordance, it is permissible to provide an actual applicant for the position with information about the plaintiff's state of health when specifically asked. However, the information may not be sent to a wide group of recipients from the outset. The plaintiff's general personal rights were violated by this, as well as by the unauthorized disclosure of the personnel file. In addition, this constitutes unauthorized data processing within the meaning of the GDPR, which is not justified. There is an inadmissible double maintenance of personnel files because the defendant copied the file after it was handed over to its legal representative and subsequently continued the copy. The plaintiff is therefore entitled to compensation for pain and suffering because he suffered immaterial damage. The objection decision should be annulled because, according to Section 54 (2) of the BeamtStG, an objection must be lodged even if there is no administrative act.

Margin number 13

The plaintiff requests that

Margin number 14

the defendant's objection decision of January 17, 2022 be annulled and the defendant be ordered to pay the plaintiff €20,000 plus interest in the amount of 5 percentage points above the base interest rate since February 16, 2022.

Paragraph 15

The defendant requests that

Paragraph 16

the action be dismissed.

Paragraph 17

In support of this, it argues that legal recourse to the administrative court has not yet been opened. The ordinary courts have jurisdiction for both the civil service claim for damages and the claim under Art. 82 GDPR. The latter is a claim for official liability in substantive law. The alleged violations do not exist either. The advertisement for the position of head of the main office was necessary to maintain proper administrative operations. It was only done internally. The passages in the job advertisement objected to by the plaintiff were ultimately justified by the defendant's duty of care towards any applicants. They must be informed that the appropriate salary for the position depends initially on the status of the retirement procedure. The statements were general. In addition, all recipients are obliged to maintain confidentiality and to comply with the GDPR. For this reason and otherwise, no damage is apparent. The personnel file was not issued to uninvolved third parties, but only to the defendant's authorized representatives. They were obliged to maintain confidentiality under Section 43a of the Federal Lawyers' Act (BRAO) and had only sent the personnel file to the Stuttgart Administrative Court, from which they would have received it in any case under Section 99 of the Administrative Court Act (VwGO). There was no double keeping of personnel files. There was only one file in paper form, which was necessarily digitized for the duration of the legal proceedings in order to remain operational with this digital copy. The file was physically continued from the date of transmission to the administrative court. Finally, the plaintiff is subject to a duty to mitigate damages (see Section 839 Paragraph 3 of the German Civil Code). The plaintiff could have obtained an injunction to stop the job advertisement from being sent or the personnel file being passed on by way of interim legal protection.

Margin number 18

The plaintiff replied in a written submission dated July 25, 2022 that the administrative legal process had been opened. The imperative special allocation of Section 54 (1) of the Civil Service Act took precedence. Article 82 of the GDPR is a claim arising from the civil service relationship, but not a claim for official liability. There is no priority of primary legal protection under Article 82 of the GDPR from the outset. Moreover, an injunction was unattainable because the plaintiff only learned of the alleged violations afterwards.

Margin number 19

For further details, reference is made to the court and authority files.

Reasons for the decision

Margin number 20

The admissible action is only successful to the extent stated.

Margin number 21

1. The action is admissible as a combined action for annulment and performance. In particular, the administrative legal process is open due to the mandatory special allocation of Section 54 Paragraph 1 of the Civil Service Act. According to this, the administrative legal process is available for all claims by civil servants, retired civil servants, former civil servants and survivors from the civil service relationship as well as for claims by the employer. The asserted claim for compensation is, insofar as it is based on a violation of the duty of care under civil service law, a claim arising from the civil service relationship (BVerwG, judgment of August 24, 1961 - II C 165.59, Ls. 2, juris).

Marginal number 22

The administrative legal process is also open if the claim is based on Article 82 Paragraph 1 of the GDPR. Whether this follows from Section 54 (1) of the Civil Service Act as a lex specialis compared to Section 40 (2) Sentence 1 of the Administrative Court Act can remain open, because the court decides the legal dispute under Section 17 (2) Sentence 1 of the Civil Service Act under all relevant legal aspects (for the special allocation of Section 40 (2) Sentence 1 of the Administrative Court Act, which is therefore not relevant in this case, see VG Köln, judgment of February 23, 2023 - 13 K 278/21, para. 16 ff., juris).

Marginal number 23

Article 82 (1) GDPR is not a claim for official liability within the meaning of Article 34 sentence 3 GG or Section 17 (2) sentence 2 GVG (also for the other specialized courts: BSG, decision of March 6, 2023 - B 1 SF 1/22 R, Ls. 1, juris; BFH, decision of June 28, 2022 - II B 92/21, marginal no. 14, juris; and for the ordinary courts OLG Hamm, judgment of January 20, 2023 - I-11 U 88/22 -, marginal no. 73, juris). The Chamber therefore decides the legal dispute from this point of view as well. It is neither incompetent on the basis of Section 17 Paragraph 2 Sentence 2 of the GVG nor on the basis of overriding constitutional law under Article 34 Sentence 3 of the GG (for the priority of constitutional law over Section 54 Paragraph 1 of the BeamtStG, see Reich, BeamtStG, 3rd edition 2018, Section 54, marginal note 3).

Marginal number24

This applies regardless of the – controversial – question of whether Article 34 of the Basic Law is a norm establishing liability or merely a transfer of liability to the state, since Article 34 of the Basic Law in any case only covers indirect state liability claims, i.e. cases of transferred liability to the state (this is also the predominant opinion in literature and case law Sachs/Detterbeck, GG, 9th ed. 2021, Article 34, marginal no. 15; Papier/Shirvani, in: MüKo BGB, 9th ed. 2024, § 839, marginal no. 9; Grzeszick, in: BeckOK GG, 2024, Article 34, marginal no. 19 ff.; BSG, decision of March 6, 2023 – B 1 SF 1/22 R, Ls. 1, juris; Lorenz, jurisPR-ITR 11/2023 note 3; BFH, decision of June 28, 2022 - II B 92/21, marginal no. 14, juris; OLG Hamm, judgment of January 20, 2023 - I-11 U 88/22, marginal no. 73, juris). It was only because of this dogmatic difference that the legislature was able to assign state liability claims that are to be distinguished from official liability under Section 839 of the German Civil Code in conjunction with Article 34 of the Basic Law to courts other than ordinary courts (cf. BSG, decision of March 6, 2023 - B 1 SF 1/22 R, marginal no. 22, juris).

Marginal number 25

Article 82 (1) GDPR is a claim directed directly against the controller and not a liability claim indirectly transferred to the state. It therefore does not fall within the scope of Article 34, sentence 3 of the Basic Law. In particular, nothing else follows from the fact that Article 82 of the GDPR could be seen as a "material claim for official liability" (as still held by the Finance Court of Berlin-Brandenburg, decision of October 27, 2021 - 16 K 16155/21, para. 11 et seq., juris; repealed by the Federal Fiscal Court, decision of June 28, 2022 - II B 92/21, juris). For historical reasons, official liability within the meaning of Article 34, sentence 3 of the Basic Law is exclusively the liability of the official transferred to the state (cf. Ossenbühl/Cornils, Staatshaftungsrecht, 6th edition 2013, p. 122). The claim under Article 82 (1) GDPR - as well as other liability claims - competes with the official liability claim under Article 34 sentence 1 of the Basic Law in conjunction with Section 839 of the German Civil Code.

Marginal number 26

According to Section 54 (2) sentence 1 of the Civil Service Act, a preliminary procedure must be carried out before all actions brought by civil servants. This also applies to claims for performance and thus also to the present claim for damages (cf. BVerwG, judgment of June 28, 2001 - 2 C 48/00, juris, marginal number 15). The necessary preliminary procedure was carried out. The defendant decided on the plaintiff's objection of November 29, 2021 with an objection decision of January 17, 2022.

Marginal number 27

2. The action is partially justified.

Marginal number 28

a) The plaintiff is entitled to compensation for damages against the defendant under Article 82 (1) GDPR. However, this does not exist in the amount claimed, but only to the extent stated.

Marginal number 29

Article 82 (1) GDPR is an independent liability standard under data protection law. Accordingly, any person who has suffered material or immaterial damage due to a violation of the GDPR is entitled to compensation for damages against the controller or the processor. The claim depends on the processor's fault, which is presumed; the damage must be adequately causally based on the violation (ECJ, judgment of December 21, 2023 - C-667/21 -, juris).

Marginal number 30

aa) There is a violation of Article 9 (1) GDPR.

Paragraph 31

(1) However, a violation does not follow from the fact that the defendant sent documents from the plaintiff's personnel file to its legal representatives in a letter dated March 14, 2018. This transmission is not subject to the temporal scope of application of the General Data Protection Regulation. According to Article 99, Paragraph 2 of the GDPR, this was applicable from May 25, 2018, and consequently the legal regime of the BDSG (old version) still applied on March 14, 2018. There is no need to decide whether the sending of documents from the personnel file on March 14, 2018 constitutes a violation of the law applicable at that time. The plaintiff has only claimed non-material damages, which were not compensable under Section 7 of the BDSG (old version). This follows from the wording of Section 7 of the old version of the Federal Data Protection Act (BDSG) and the comparison with Section 8 (2) of the old version of the Federal Data Protection Act (BDSG), according to which compensation for non-material damage was only owed in the case of automated data processing, which is not the case here (cf. Simitis, Federal Data Protection Act, 7th edition 2011, Section 7, marginal no. 32 with further references).

Marginal number 32

(2) Sending the complete personnel file to the defendant's legal representatives does not constitute a violation of the GDPR either, as there is at least a justification under Article 9 (2) (b), (f) and (h) of the GDPR.

Marginal number 33

The temporal scope of application of the GDPR is established under Article 99 (2) of the GDPR, because the personnel file was sent to the defendant's legal representatives on March 4, 2019, after the court had requested it from them. The plaintiff claims that the file had already been sent to the defendant's legal representative with the authorization and refers to the defendant's letter of March 14, 2018. However, the letter mentions "some documents" as an attachment and not the entire personnel file. The defendant claims that it sent the file on April 3, 2019 after it had been requested from its legal representative by the court in the action xxx in a letter dated March 12, 2019. This statement is confirmed by the defendant's administrative documents, according to which the personnel file was requested from the defendant by the legal representative on March 22, 2019 and subsequently sent.

Paragraph 34

Whether the transmission of the personnel file falls within the scope of application of the General Data Protection Regulation can remain open. According to Recital 15, the provisions of the General Data Protection Regulation do not apply to non-digitally kept "files or collections of files and their cover sheets that are not organized according to specific criteria". There are considerable doubts as to whether these requirements are met in the case of analogue civil service personnel files, for which the principle of completeness is legally decisive (cf. LAG Lower Saxony, judgment of May 4, 2021 - 11 Sa 1180/20 -, para. 60, juris; dissenting opinion LAG Saxony-Anhalt, judgment of November 23, 2018 - 5 Sa 7/17 - para. 50, juris and VG Berlin, decision of February 28, 2020 - 3 L 1028.19 -, para. 17, juris). In particular, no systematic access to personal data is made possible (see Recital 15 sentence 2 GDPR, Gola, in: Gola/Heckmann, DS-GVO/BDSG, 3rd edition 2022, Art. 2 marginal no. 11).

Paragraph 35

However, this is not relevant in the present legal dispute, since in any case there is no unjustified data protection violation.

Paragraph 36

Assuming that the GDPR is applicable, the plaintiff's personnel file contains, among other things, health data within the meaning of Art. 4 No. 15 GDPR. According to Art. 4 No. 15 GDPR, health data is personal data that relates to the physical or mental health of a natural person, including the provision of health services, and from which information about their state of health can be derived. The personnel file contains, among other things, information on the plaintiff's fitness for work examination with details of his state of health and documents on his convalescence after the stroke, i.e. health data. For health data, Article 9 (1) GDPR contains a preventive prohibition on data processing, for which, according to Article 9 (2) and Article 6 (1) GDPR, a permission reservation applies. In the present case, the requirements of Article 9 (2) (b), (f) and (h) GDPR are met.

Paragraph 37

According to Article 9 (2)(b) GDPR, the processing of health data is permissible if it is necessary for the controller to exercise the rights arising from employment law and social security and social protection law and to fulfil its obligations in this regard. The transmission to the procedural representatives was necessary so that the defendant could fulfil its obligation under public service law to clarify the plaintiff's fitness for work. The commissioning of a law firm and its comprehensive information were necessary for this because, as a result of the retirement procedure, the defendant's personnel office did not have sufficient internal expertise for the subsequent court proceedings after the plaintiff himself had been head of the main and personnel office. The recourse to external expertise for the purposes of Article 9 (2)(b) GDPR was also justified against the background of Section 3 (3) BRAO. Accordingly, everyone has the right to be advised by a lawyer of their choice in legal matters of all kinds and to be represented before courts, arbitration tribunals or authorities. This also includes the transmission of documents to the lawyer (cf. VG Wiesbaden, judgment of January 19, 2022 - 6 K 361/21.WI -, juris, Ls. 4). The offense under Art. 9 Para. 2 lit. b GDPR is not limited to individual documents from the personnel file. It enables recourse to external experts who may then be informed to the same extent as the processor himself.

Paragraph 38

Art. 9 Para. 2 lit. b GDPR also requires a member state standard that provides appropriate guarantees for the fundamental rights and interests of the data subject. The transmission of personnel file data is governed by Section 85 LBG. However, for the transmission of files requested by a court, Section 99 Paragraph 1 Sentence 1 VwGO is the more specific norm (Holz/Stich, in: BeckOK Beamtenrecht Baden-Württemberg, 2024, Section 85 LBG Rn. 44). According to this, authorities are obliged to submit files. This also applies to personnel files. In this case, the files were requested by the court that had to decide on the action against the retirement order. Since the defendant has the right to be represented by a lawyer in the proceedings under Section 3 Paragraph 3 BRAO, it is also permissible to submit the files to the court via this lawyer.

Paragraph 39

Furthermore, the requirements of Article 9 Paragraph 2 Letter f of GDPR are met. According to this provision, the prohibition of Article 9 Paragraph 1 GDPR does not apply if the data processing is necessary for the assertion, exercise or defense of legal claims or for actions by the courts in the context of their judicial activities. This also applies to the defense of claims, since the norm serves to safeguard the right to a fair trial (cf. Art. 47 GRCh, Art. 20 para. 2 sentence 2, para. 3 GG). In the court proceedings, the defendant was obliged to submit the personnel file after it had been requested by the court under Section 99 VwGO (VwGO) (see VGH Baden-Württemberg, decision of January 15, 2019 - 1 S 188/19 -, marginal no. 20 et seq., juris). To fulfill this obligation, she was allowed to use her legal representative and make the personnel file available to him for this purpose. According to Section 3 para. 3 BRAO, everyone has the right to be advised by a lawyer of their choice in legal matters of all kinds and to be represented before courts, arbitration tribunals or authorities. Lawyers are independent organs of the administration of justice (Section 1 BRAO). Art. 9 para. 2 lit. f GDPR therefore also covers the information and unhindered presentation of the appointed lawyer (cf. VG Wiesbaden, judgment of January 19, 2022 - 6 K 361/21.WI -, juris, Ls. 4). The respective lawyer must be fully informed in order to ensure adequate legal representation. In the retirement proceedings, for which the defendant was advised and represented by a lawyer in this case, this includes the employment relationship between the defendant and the plaintiff and in particular the plaintiff's health data contained in the personnel file that were relevant for the retirement.

Marginal number 40

The requirements of Art. 9 para. 2 lit. h GDPR are also met, which can be relevant in addition to Art. 9 para. 2 lit. b GDPR (cf. BAG, referral decision of August 26, 2021 - 8 AZR 253/20, marginal no. 19, juris). Accordingly, processing is permissible, subject to Art. 9 (3) GDPR, if it is necessary for the purposes of healthcare or occupational medicine, for assessing the employee’s ability to work, for medical diagnostics, care or treatment in the health or social sector or for the administration of systems and services in the health or social sector on the basis of Union law or the law of a Member State. The provision in Art. 9 (2) (h) GDPR is not limited to members of the medical profession or employees of social security providers and therefore also covers the defendant. In this case, data processing by transmitting the personnel file was necessary to assess the plaintiff’s ability to work because, on the one hand, following the unavailability of its head of department and personnel office, the defendant could no longer rely on sufficient internal expertise to assess the legal framework of the incapacity for work procedure. On the other hand, it was a complex administrative and court procedure in which the defendant - especially against the background of Section 3 Paragraph 3 of the Federal Lawyers' Act - was allowed to be represented by a lawyer and to send him the relevant documents, i.e. the plaintiff's personnel file. The national law norm required for justification is again Section 99 of the Administrative Court Act.

Paragraph 41

The requirements of Article 9 Paragraph 3 of the GDPR - cumulatively required in the case of Article 9 Paragraph 2 Letter h of GDPR - are also met. The data must then be processed by specialist personnel who are subject to professional secrecy under the law of a Member State or the provisions of national competent bodies. Lawyers are professional staff within the meaning of the standard (Weichert, in: Kühling/Buchner, DS-GVO/BDSG, 4th edition 2024, Art. 9 GDPR marginal no. 140), since they are subject to professional secrecy under Section 43a of the Federal Lawyers' Act, which is protected under criminal law under Section 203 (1) no. 3 of the German Criminal Code.

Marginal number 42

The requirements of Art. 6 (1) sentence 1 lit. c and e of the GDPR are also met, which, in the opinion of the Chamber, must be met cumulatively with Art. 9 (2) GDPR (cf. Art. 9 (2) lit. h of the GDPR ECJ, judgment of December 21, 2023 - C-667/21 -, juris, Ls. 3). The transmission to the defendant's own procedural representative indirectly served to fulfill the defendant's legal obligation under Section 99 of the German Administrative Court Act. The defendant has the right to be represented by a lawyer in the court proceedings. As a consequence, she may also use the lawyer to submit the files and is protected by professional secrecy under Section 43a of the Federal Lawyers' Act (BRAO). By means of inspection of the files, the procedural representatives would have had access to the personnel file in any case even if the defendant had submitted them directly. The entering into, implementation, termination or settlement of service or employment relationships are public tasks within the meaning of Art. 6 Paragraph 1 Letter e of GDPR. Section 99 of the Administrative Court Act (VwGO) represents a suitable and lawful legal basis within the meaning of Art. 6 Paragraph 3 of the GDPR (VGH Baden-Württemberg, decision of February 15, 2019 - 1 S 188/19, marginal no. 20 et seq., juris). In particular, Section 99 of the Administrative Court Act (VwGO) regulates the purpose of the processing and makes the other provisions provided for in Art. 6 Paragraph 3 Clause 3 of the GDPR.

Marginal number 43

Information of the data subject, i.e. the plaintiff, pursuant to Article 14 (1) GDPR was not required due to Article 14 (5) (d) GDPR because the defendant's legal representative is subject to professional secrecy under Section 43a of the Federal Lawyers' Act, which is protected under criminal law under Section 203 (1) No. 3 of the German Criminal Code.

Marginal number 44

(3) However, a violation of the prohibition on processing health data pursuant to Article 9 (1) GDPR lies in the reference to the plaintiff's retirement procedure in the defendant's job advertisement. Insofar as the plaintiff's "established incapacity for work" is mentioned therein, this is health data within the meaning of Article 4 No. 15 of the GDPR. According to Article 4 No. 15 of the GDPR, health data is personal data that relates to the physical or mental health of a natural person, including the provision of health services, and from which information about their state of health can be derived. The assessment of the ability to work or service from a medical or psychological point of view represents health data in this sense (cf. LAG Düsseldorf, judgment of March 11, 2020 - 12 Sa 186/19, para. 150, juris), because the ability to work is based on the state of health. The person of the "previous office holder" mentioned in the job advertisement is clearly and easily recognizable to third parties, even outsiders, as an individual of the plaintiff.

Marginal number 45

This is also data processing by the controller within the meaning of Art. 4 No. 2, 7 GDPR. As can be seen from the information provided to the local council on July 24, 2018, the processing was carried out by the controller, i.e. the defendant. Sending the job advertisement to around 83 recipients represents processing because the health data (ability to work) was disclosed to the recipients.

Paragraph 46

The processing of health data was not permitted as an exception under Article 9(2)(h) GDPR. The requirement for the defendant to fulfil its obligations, as presumed therein, is lacking. The defendant claims that mentioning the retirement procedure was necessary in order to properly inform applicants that they could not be assigned to the position immediately and that, due to the ongoing procedure, the plaintiff might even return to the position. In this respect, the defendant refers to its duty of care under civil service law.

Paragraph 47

However, this does not prevail. The disclosure of the incapacity of the office holder (plaintiff) as determined by a medical officer in a retirement procedure was not necessary for the job advertisement within the meaning of Art. 9 (2)(b) GDPR. The element of necessity under Art. 9 (2)(b) GDPR requires a balancing of the rights of the data subject with the justifiable processing purposes. In this balancing, the rights of the plaintiff prevail. The lack of necessity follows from the fact that it would have been sufficient to inform applicants, without explaining the plaintiff's state of health, that he could not be assigned to the position immediately. Such event-related data processing would have been necessary and permissible - as the plaintiff himself admits. Targeted information for specific applicants would also have been sufficient. This is all the more true because it was a purely internal tendering procedure in which a large number of applicants was not expected. In addition, the retirement procedure is mentioned in two places in the job advertisement without any apparent necessity and the incapacity for work was not confirmed in the end.

Margin number 48

The processing was also not necessary according to Art. 9 para. 2 lit. f GDPR. The processing took place in the context of a job advertisement, without reference to the legal disputes between the parties and therefore without any connection to the assertion, exercise or defense of legal claims.

Margin number 49

The defendant cannot rely on Art. 9 para. 2 lit. g GDPR in conjunction with Art. 33 para. 4 GG to justify its decision. The information was not necessary to uphold the duty of care under civil service law because informing specific applicants or pointing out that the position could only be assigned at a later date without any explanation of the plaintiff's state of health would have been sufficient (see above). Furthermore, Article 33 (4) of the Basic Law, as a general constitutional obligation of the employer, is not a sufficiently specific norm of national law within the meaning of Article 9 (2)(g) of the GDPR.

Marginal number 50

Nor does justification follow from the fact that, according to the defendant's statement, all recipients of the email are obliged to comply with the GDPR and to maintain confidentiality. Such a justification does not exist and would also go too far. The number of recipients can at best be relevant to the occurrence of damage (see also LG Cologne, judgment of August 3, 2021 - 5 O 84/21, marginal number 28, juris). Furthermore, the advertisement was not expressly marked as internal and was forwarded without comment.

Marginal number 51

bb) The data protection violation by sending the job advertisement was culpable. The defendant has the burden of proof in this respect and has not presented any circumstances leading to its exculpation.

Marginal number 52

cc) The plaintiff suffered adequate-causal non-material damage as a result of the data protection violation. Non-material damage within the meaning of Art. 82 (1) GDPR is any concrete non-material impairment, in particular of the right to personality, for example in the form of psychological effects on the person concerned (Gola/Piltz, in: Gola/Heckmann, DS-GVO/BDSG, 3rd edition 2022, Art. 82, marginal no. 13). Unlike the impairment of general personal rights that require compensation under national tort law, no particularly serious interference is required. The mere loss of control over the data is generally not damage in itself, but can lead to non-material damage, such as justified worries or discomfort due to the loss of data and possible further dissemination (ECJ, judgment of December 14, 2023 - C-456/22, para. 11; ECJ, judgment of December 14, 2023 - C-340/21, para. 85; OLG Oldenburg, judgment of May 21, 2024 - 13 U 100/23, para. 43; all juris). Non-material damage exists in any case if the person concerned is degraded or exposed by the data being passed on.

Paragraph 53

The plaintiff claims that he was degraded as unfit for service by the job advertisement. The outcome of the retirement procedure was anticipated. In addition, he had to fear that the email - which was not marked as confidential - could be forwarded to a large number of recipients (including external ones). At least one person employed by the defendant had suddenly asked him about his health on the street. The psychological stress he described is an intangible impairment within the meaning of Art. 82 (1) GDPR. Whether the email was actually not forwarded externally, as the defendant stated without contradiction, is irrelevant to the occurrence of the damage. The internal denigration in connection with the specific risk of external forwarding of sensitive health data and the associated - not unfounded - fears of the plaintiff is sufficient. The data protection violation was also causal for the damage. It was precisely through the sending of the email that the plaintiff's health data was made public (at least internally) and the damage was caused.

Paragraph 54

The plaintiff is therefore entitled to compensation. The benchmark for the amount of compensation is the degree to which the general right to privacy is impaired by the data protection violation. In addition to the context and extent of the violation, the type of data affected and - in the case of data transfer - the group of recipients are decisive. The compensation under Art. 82 Para. 1 GDPR has no general or special preventive function, the amount of damages awarded does not have to have a deterrent effect and does not have to fulfill a punitive function (ECJ, judgment of December 21, 2023 - C-667/21, para. 87, juris). Rather, according to the will of the regulatory authority, the specific intangible disadvantages that have occurred should be compensated.

Marginal number 55

In the case law issued so far on Art. 82 GDPR, compensation of between €1,500 and €2,000 is generally awarded for data protection violations that affect health data, because the data is particularly protected and implies a certain severity of the data protection violation (cf. with individual references, Slizyk, beck-online. Compensation for pain and suffering, as of March 18, 2024, decisions, special violations and consequences of violations, violation of personal rights, data protection, data forwarding or data dissemination; e.g.: sending a 100-page health record to third parties: €2,000, OLG Düsseldorf, judgment of October 28, 2021 - I-16 U 275/20, Ls. 3, juris; information about incapacity for work: €1,500, LAG Rhineland-Palatinate judgment of June 13, 2019 - 5 Sa 438/18, juris; Forwarding of health data by the employer contrary to the advice of the State Data Protection Commissioner: €1,500, ArbG Dresden, judgment of August 26, 2020 - 13 Ca 1046/20, juris). Higher sums were - as far as can be seen - only awarded in particularly serious cases, such as the unjustified forwarding of sensitive data from employment relationships despite the most vehement objection (OLG Hamm judgment of August 31, 2021 - 9 U 56/20, juris with lower court LG Bochum, judgment of January 22, 2020 - 2 O 186/19, juris). In less serious cases, however, compensation in the three-digit range has been awarded, especially when no health data is affected (see, for example, OLG Hamm judgment of January 20, 2023 - 11 U 88/22, juris - erroneous sending of an Excel spreadsheet).

Marginal number 56

According to these standards, the non-material damage suffered by the plaintiff in this case is to be assessed at €2,500.

Marginal number 57

There is only one damaging event. The sending of the job advertisement is a single processing and thus infringement act, even if it was sent to several people at the same time. For a uniform processing process, the obligation to pay damages only arises once (ECJ, judgment of April 11, 2024 - C-741/21, marginal number 63, juris). The plaintiff has not claimed any further consequences of the violation, such as receiving unwanted emails or specific denigrations due to the health condition that has become public. The plaintiff has not suffered any damage as a result of the sending of the personnel files, which in any case does not constitute a violation of the GDPR, because there is no loss of control due to the professional secrecy under Section 43a of the Federal Lawyers' Act (BRAO) and the procedural representatives would also have received knowledge of the data under Sections 99 and 100 of the Administrative Court Act (VwGO).

Paragraph 58

The Chamber is convinced that the disclosure of protected data in the job advertisement is not a very minor violation. This is based on the consideration that the plaintiff's health data is affected, which is particularly protected under Article 9 (1) of the GDPR. What also speaks in favor of higher compensation, at least in the four-figure range, is that the result of an ongoing disciplinary procedure was anticipated and the plaintiff was labeled as unfit for service to at least 83 recipients of the email dated July 5, 2018, without the incapacity for service being ultimately confirmed.

Paragraph 59

What speaks against a particularly serious violation, however, is that the email was only sent internally to a certain number of recipients and - as the defendant convincingly argued - was not forwarded externally. In addition, all recipients were obliged to maintain confidentiality as public officials or public servants and had been informed of the obligations under the GDPR. Even if the instruction was merely declaratory in nature, the defendant nevertheless provided security measures that would also be relevant as adequate protection of secrets within the framework of Art. 9 Para. 3 GDPR (see Weichert, in: Kühling/Buchner, DS-GVO/BDSG, 4th ed. 2024, Art. 9 para. 144). The mention of the retirement procedure was not justified, as the defendant claimed, by the civil service duty of care towards applicants or by the duty to provide information and advice. On the other hand, the mentions were not arbitrary. This is shown by the statements made by the defendant's administration in the draft resolution for the municipal council meeting on July 24, 2018 that applicants had been informed of the lack of possibility of direct assignment to the permanent position. Finally, no detailed information on the plaintiff's state of health was passed on. Rather, only the incapacity for work was mentioned in general, which speaks against a particularly serious violation.

Margin number 60

b) A further claim for compensation does not arise from a claim for damages due to a breach of the duty of care under civil service law.

Margin number 61

The claim for damages under civil service law due to a breach of the duty of care can be used to claim compensation for non-material damages. The prerequisite for this claim for damages is that the employer has culpably breached the duty of care owed to the civil servant, that the violation of the law was adequately causal for the occurrence of the damage and that the civil servant did not fail to avert the damage by using a legal remedy that was reasonable for him (BVerwG, judgment of March 28, 2023 - 2 A 12/21, margin number 9, juris).

Margin number 62

The plaintiff is not entitled to compensation for pain and suffering from the outset because Section 253 (2) of the German Civil Code, which is exhaustive, does not cover the violation of general personal rights. Since this result corresponds to the legislator's will, an analogous application of the norm is also out of the question (BeckOGK/Brand, 2022, § 253 marginal no. 39 et seq. with further references). However, according to the consistent case law of the Federal Court of Justice, a violation of the general right of personality gives rise to a claim to monetary compensation if it is a serious interference and the impairment cannot be satisfactorily compensated in any other way (BGH, judgments of November 14, 2017 - VI ZR 534/15, marginal no. 19, juris; of September 15, 2015 - VI ZR 175/14, BGHZ 206, 347 marginal no. 38; of April 21, 2015 - VI ZR 245/14, VersR 2015, 898 marginal no. 33, each with further references). The case law of the Federal Court of Justice is to be applied to civil service law because the duty of care under civil service law also includes the protection of the civil servant's general personality rights (BVerwG, judgment of February 27, 2003 - 2 C 10/02, marginal no. 19, juris) and because the resulting claim for damages also covers compensation for non-material damages (BVerwG, judgment of March 28, 2023 - 2 C 6/21, juris, marginal no. 20).

Marginal number 63

The general personality rights under Article 2, Paragraph 1 and 1, Paragraph 1 of the Basic Law protect the narrow personal sphere of life and thus grant every individual the right to withdraw, shield or keep to themselves. In its form as the right to informational self-determination, the general personality rights protect every individual's decision as to when and within what limits he or she reveals or conceals personal life circumstances.

Marginal number 64

aa) The sending of documents from the plaintiff's personnel file on March 14, 2018 to the defendant's (later) legal representatives does not give rise to a claim for damages by the plaintiff, even from the point of view of the general protection of personal rights and the duty of care under civil service law.

Marginal number 65

The prerequisite for the existence of a claim for damages under civil service law due to a breach of the duty of care is a serious infringement of the general right of personality. Whether there is such a serious violation of the right of personality that the payment of monetary compensation is necessary can only be assessed on the basis of all the circumstances of the individual case. In particular, the significance and scope of the intervention, the reason and motive of the person acting and the degree of his fault must be taken into account (BGH, judgments of November 14, 2017 - VI ZR 534/15, para. 19, juris; of November 24, 2009 - VI ZR 219/08, BGHZ 183, 227, para. 11, juris; of December 17, 2013 - VI ZR 211/12, para. 38 ff., juris; of April 21, 2015 - VI ZR 245/14, para. 33, juris).

Paragraph 66

There is no serious intervention. The defendant has commissioned a law firm in exercising its right under Section 3 Paragraph 3 of the Federal Lawyers' Act (BRAO). This was necessary in order to maintain the office's ability to work in view of the loss of the head of the main and personnel office and to enable the complex and conflict-ridden retirement process to be carried out. In order to enable the law firm to carry out a legal review, the defendant sent individual documents from the plaintiff's personnel file. This, like the corresponding lawyer's presentation, is part of the warranty content of Section 3 Paragraph 3 BRAO (cf. VG Wiesbaden, judgment of January 19, 2022 - 6 K 361/21.WI -, juris, Ls. 3). This does not constitute a serious violation of the plaintiff's personal rights, especially since there are neither disadvantages nor material or immaterial damages as a result of the sending of individual documents.

Marginal number 67

bb) The passing on of the personnel file to the defendant's legal representative does not constitute an unjustified infringement of the plaintiff's general personal rights because there is lawful data processing in accordance with Art. 6, 9 GDPR in conjunction with Section 99 VwGO. Any infringement would therefore be justified in any case. In addition, as in the context of Art. 82 GDPR, there is no damage according to the standards of Section 253 BGB because the plaintiff has not plausibly presented any material or immaterial disadvantages as a result of the file being sent to the defendant's legal representatives.

Marginal number 68

cc) For the immaterial damage caused to him by the sending of the job advertisement, the more specific Art. 82 GDPR supersedes the general civil service liability claim. Data protection law and its liability standards represent a special form of personal protection.

Margin number 69

dd) The other violations of the civil service duty of care alleged by the plaintiff also do not give rise to a claim for damages.

Margin number 70

The plaintiff claims a violation of the prohibition on keeping duplicate personnel files. When he attempted to inspect his personnel file on March 24, 2020, he was informed that it was only available in digital form. At the oral hearing, the plaintiff also stated that he only found out about a letter from the municipal pension association, which actually belongs in the personnel file, during the course of the legal proceedings against the retirement order because it had been filed in the benefit file.

Margin number 71

In this respect, there is no serious infringement of the general right of personality. To the extent that the defendant digitized the file when requested by the administrative court in order to remain operational, there is no impermissible double filing. Rather, it is in line with the principles of good administration and standard administrative practice to make a (digital if necessary) copy of the files submitted if - as in this case - the court is not expected to return them promptly. Otherwise, neither the processing of current inquiries about the file nor the conduct of the court proceedings would be meaningful. Even if the plaintiff claims that a document was filed incorrectly, there is no serious violation, as this is a one-off error with no direct impact on general personal rights. Moreover, there is no causal damage in each case, as the plaintiff has not claimed any disadvantages - apart from difficulties in obtaining information from the file.

Paragraph 72

There is also no serious violation if the overall events are reassessed from the perspective of possible mobbing, which the plaintiff raised in the administrative proceedings. According to the case law of the Federal Administrative Court, there is a claim for damages for breach of the civil service duty of care if, after an overall assessment, bullying has occurred (BVerwG, judgment of October 15, 2005 - 2 A 4.04, marginal no. 36; BVerwG, judgment of March 28, 2023 - 2 C 6/21, marginal no. 22; both juris). "Bullying" is defined as "systematic hostility, harassment and discrimination" (BVerwG, judgment of March 28, 2023 - 2 C 6/21, marginal no. 22; juris). However, the plaintiff must provide concrete evidence of the actual evidence for the bullying allegation; general or vague descriptions are not sufficient (BVerwG, judgment of March 28, 2023 - 2 A 12/21, para. 15 ff., juris).

Marginal number 73

However, there is no apparent systematic nature of the alleged violations of data protection and personnel file law. To the extent that violations or disadvantages exist at all, the defendant has plausibly argued that there was no intention to discriminate, but that there were understandable motivations for its actions, even if there were not comprehensive justifications in every case. Overall, there is a lack of targeted discriminatory action, as is inherent in the concept of bullying.

Marginal number 74

c) The objection decision is unlawful because the objection, which is permissible under Section 54 (2) of the BeamtStG and is also otherwise permissible, was rejected as inadmissible. In administrative procedural law, there is in principle no "objection to inaction", as can be seen from the wording of Section 68 Paragraph 2 of the VwGO and the regulation in Section 75 Sentence 1 Alternative 2 of the VwGO. However, this does not apply to civil service law due to the special regulation in Section 54 Paragraph 2 of the BeamtStG (or Section 126 Paragraph 2 of the BBG). In civil service proceedings, an objection procedure must always be carried out before an action for failure to act is brought (established case law of the Federal Administrative Court, see BVerwG, judgment of June 28, 2001 - 2 C 48/00, para. 14, juris; BVerwG, judgment of May 17, 2018 - 2 C 49/17, para. 8, juris; OVG North Rhine-Westphalia, decision of July 15, 2020 - 1 E 185/19, para. 10 ff., juris, each with further references). Because the objection decision does not address the asserted claim, it had to be annulled not only to the extent stated, but in its entirety.

Margin number 75

3. The decision on costs is based on Sections 155 (1), 154 (1) VwGO.

Marginal number 76

4. There are no reasons according to Section 124 Paragraph 2 No. 3 or No. 4 VwGO, so that the appeal is not admissible, Section 124a Paragraph 1 VwGO.

Marginal number 77

Decision of June 20, 2024

Marginal number 78

The value in dispute is set at

Marginal number 79

€20,000.00 in accordance with Sections 63 Paragraph 2 and 52 Paragraph 3 Sentence 1.