GDPR violation: Compensation for incomplete and late information

In the case before the Düsseldorf Labor Court, the plaintiff demanded compensation for pain and suffering because the company had not responded to its right to information in accordance with Art. 15 GDPR in a timely and complete manner. The plaintiff was a former employee who requested information from his employer at the time about the processing of his personal data in accordance with Art. 15 GDPR. However, the information was only given months later and was incomplete.

The Düsseldorf Labor Court followed the plaintiff’s view and sentenced the employer to pay compensation for pain and suffering in the amount of € 5,000. The court referred to recital 75 of the GDPR, in which risks for the freedoms and rights of natural persons are also identified where those affected are deprived of their rights and cannot control their data. The Düsseldorf Labor Court saw this case as given: Due to the late and incomplete information, the plaintiff could not know for months which and how his personal data was being processed.

The defendant, the applicant’s employer, had tried to defend itself against the lawsuit by arguing that it had never received the request for information. According to the plaintiff, this was handed in at the reception of his employer, whereby the reception could be occupied by an external service provider for the employer. The court did not accept this argument. The defendant would have had to ensure that asserted data subject rights would have reached her. This also applies if, according to the public opinion, a messenger is intended to receive documents.

For companies, the same applies to data protection, whatever else applies: By properly organizing the operational processes, it must be ensured that declarations of intent can be received. Anyone who violates it cannot afterwards excuse himself that he did not know anything.

The right to information according to Art. 15 GDPR also applies in the employment relationship

The right to information according to Art. 15 GDPR also applies to employee data protection, as this general provision is a fully harmonizing regulation with no scope for national regulations.

As the Düsseldorf Labor Court stated in its judgment, the violation of the right to information according to Art. 15 GDPR also constituted a violation of the right to information anchored in Art. 8 (2) sentence 2 of the Charter for Fundamental Rights of the European Union.

However, the Düsseldorf Labor Court rejected another part of the lawsuit: If data is transmitted to so-called unsafe third countries according to GDPR, the person concerned only needs to be informed of the appropriate guarantees under Art. 46 GDPR under Art. 15 (2) GDPR. However, companies do not have to disclose the entire contract on which the data transfer is based to the data subject.

When assessing the amount of the compensation for pain and suffering, the court did not assume that there was intent, only negligence was assumed. It also had a positive effect on the defendant that no data in special categories according to Art. 9 GDPR were affected.

The following factors increased the compensation for pain and suffering in this case: The violation of the right to information also represented a violation of a European fundamental right. The violation lasted for several months. It was a high-turnover company and the amount of immaterial damages should have a deterrent effect.

In the end, the Düsseldorf Labor Court found € 5,000 to be appropriate.

Companies should therefore be careful not to take requests for information lightly. Those responsible must answer these in full and on time. Information that is only given partially and a little later can not only be punished as a fine, but also result in compensation for pain and suffering. A look at Art. 12, 15 GDPR is worthwhile for everyone in order to understand that there are a number of things to consider when answering a request for information.

If you are not sure whether you are answering the request for information correctly – contact us here.