Data protection related right to information: Oldenburg Labor Court awards employee a record sum in damages
An employer failed to comply with an employee’s request for information about his stored personal data. The decision of February 9, 2023 – Case no.: 3 Ca 150/22 is remarkable in that it is the highest amount ever awarded to an employee by a court due to an infringement of the right to obtain information. The damages awarded amount to EUR 10,000.00.
Pursuant to Art. 15 (1) General Data Protection Regulation (GDPR), the plaintiff had requested from his former employer information about his personal data processed by the company as well as a copy of the personal data pursuant to such provision’s Section 3. The employer initially did not comply with such request. Consequently, the employee brought an action before the Oldenburg Labor Court. It was only during these proceedings and thus 20 months after the request for information that the employer provided the information and submitted the documents, respectively.
Pursuant to Art. 82 (1) GDPR, the employee has the right to demand compensation for his material and non-material damage in case of an infringement of such regulation. Therefore, the employee claimed a compensation amount of EUR 500.00 for each month of the employer’s failure to provide information, consequently a total amount of EUR 10,000 in damages as the employer’s refusal to provide the requested information violated the obligations pursuant to GDPR. Such amount was awarded to the employee by the Oldenburg Labor Court.
An employee’s request for information must be fulfilled within one month (Art. 12 (3) GDPR). If such information is not provided, it is, according to the Oldenburg Labor Court, not necessary to further substantiate and prove any damage, as the violation of the GDPR’s provisions alone results in a damage. The courts’ stance on the obligation to present and prove damages, however, differs. In some cases, the courts hold the opinion that the employee must provide concrete evidence of the damage (for example, Herne Labor Court of September 4, 2020 – 5 Ca 178/20; Bonn Regional Court of July 1, 2021 – 15 O 335/20).
Other courts believe that the claim for damages should generally have a deterrent effect. If employees cannot obtain any timely and sufficient information about their personal data’s processing, this results in a loss of control and a claim for damages generally exists, irrespective of the assertion of a concrete damage (for example, Berlin-Brandenburg Regional Labor Court on November 18, 2021 – 10 Sa 443/21; Lower Saxony Regional Labor Court of October 22, 2021 – 16 Sa 761/20; Hamm Regional Labor Court of May 11, 2021 – 6 Sa 1260/20).
The Oldenburg Labor Court also believes that a breach of the obligation to provide information alone results in claims for damages. However, it has awarded an amount which has so far never been awarded by any other court. At most, amounts of up to EUR 1,000.00 have been awarded in the past, without regard to how long the request for information remained unanswered. The Oldenburg Labor Court’s approach of applying a damage amount of EUR 500.00 per month of failure to provide information is unique to date.
We assume that the decision will be appealed before the Lower Saxony Regional Labor Court. Whether the decision will be sustained is, in our opinion, very doubtful.
Practical advice
The right to information pursuant to Art. 15 of the GDPR does generally not play a role in an ongoing employment relationship. However, if employees leave the company, such right is of greater importance, especially if the separation was not amicable. In any case, a request for information should be answered within the statutory period of one month in order not to trigger any claims for damages.
