Damages for breach of the right to information under the GDPR

The claimant is a former employee of the defendant and was employed there first as managing director, later as sales manager. 

Pursuant to Article 15 (1) of the GDPR, he demanded, among other things, information about the personal data concerning him that had been processed by the company. 

Furthermore, he demanded a copy of the data pursuant to Article 15 (3) GDPR. However, the defendant employer refused to provide the information. 

Rather, the company did not submit individual documents until 20 months later in the lawsuit. For the period of non-compliance with the request for information, the claimant asserted a claim for non-material damages in the amount of 500 Euro per month pursuant to Article 82 of the GDPR.

In its judgment of 9 February 2023, the court awarded the claimant the requested non-material damages in the amount of 10,000 Euro. 

In its reasoning, the court stated that the defendant should have fulfilled its obligation to provide information within one month in accordance with Article 12 (3) of the GDPR. 

However, this was not done. In view of the preventive nature of Article 82 (1) of the GDPR and the fact that the provision serves as a deterrent, the claimant did not have to demonstrate the existence of damage in more detail. 

In this respect, the Oldenburg Labor Court refers to the Federal Labor Court (hereinafter BAG) decision of 5 May 2022 (BAG, judgment of 5 May 2022 - 2 AZR 363/21, NJW 2022, 2779). 

In contrast to the case there, in which the BAG awarded damages in the amount of 1,000 Euro, the Oldenburg Labor Court considers a significantly higher amount to be appropriate in the present decision. 

The court justifies this with the significantly higher interest in information of the claimant and the long period of non-fulfillment of the duty to provide information.

It should be noted that there is no consensus in the case law regarding the requirements for a claim for damages under Article 82 (1) of the GDPR for late disclosure. 

Thus, the verdicts awarding and rejecting the claim predominantly balance each other out. Ultimately, the CJEU will have to clarify, within the framework of a preliminary ruling pursuant to Article 267 TFEU, whether the mere infringement of data subject rights provisions is compensable (see cases C-300/21, C-340/21, C-667/21, C-687/21 and C-741/21 pending at the CJEU). 

In this context, the Court of Justice will probably also have to deal with the question of whether a materiality threshold is to be read into Article 82 of the GDPR. Advocate General Sánchez-Bordona argued in favor of the latter in his opinion in Case C-300/21. 

However, it remains to be seen whether the CJEU will share the Advocate General's assessment.