The right of access by data subjects pursuant to Article 15 of the General Data Protection Regulation (GDPR) is increasingly proving to be a sharp sword, as already seen last year from decisions of various courts clarifying just how far such right goes, thus clearly setting out the requirements to be met by controllers under data protection law when it comes to granting proper access to personal data, whilst at the same time tightening such requirements.

From the Partial Judgment handed down by the Oldenburg Labour Court [ArbG – Arbeitsgericht] of 9 February 2023 (case ref.: 3 Ca 150/21) it is now clear that when access to personal data is delayed, this can result not only in measures being taken by the supervisory authorities but also in data subjects bringing compensation claims that are not insignificant.

Facts of the case

The plaintiff had worked for the defendant as managing director and then as head of sales. In addition to claims for consideration based a post-contractual covenant not to compete, the plaintiff also made claims for access to information relating to the storage and processing of his personal data, including the surrender of a copy of the stored personal data as well as compensation for damages for defendant’s failure to grant access to the data sought.

Prior to lodging his legal action to enforce his claims, he requested the defendant on 19 April 2021 to give him access, based on data protection law, to the personal data pursuant to Article 15 GDPR, setting a time limit until 3 May 2021 for compliance. The defendant rejected this request on 12 October 2021.

It was only during the court proceeding that the defendant then finally, on 5 February 2023, submitted a bundle of documents and clarified in this regard that the documents were the plaintiff’s personal data stored by the defendant.

Decision

This did not convince the Labour Court, which ordered the defendant among other things to grant access to the personal data requested pursuant to Article 15(1) GDPR and to pay compensation for the non-material damage in the total amount of € 10,000.00 for violating its obligation to grant access to the personal data.

The Court did not hold that the right of access had been fulfilled by submission of these exhibits to the Court. It explained that even if the documents constituted all the plaintiff’s personal data, such personal data were only the plaintiff’s stored personal data. 

However, according to Article 15(1) GDPR, the right of access refers to the plaintiff’s personal data processed by the controller. Neither was it possible to infer from the defendant’s clarification to what extent the plaintiff’s personal data contained in the exhibits were processed and to what extent the right of access for the specific information referenced in Article 15(1) second half-sentence GDPR had been met by the defendant by submitting the bundle of documents.

When assessing the amount of compensation the Court took into consideration that the defendant, over a period of no less than 20 months, had not fulfilled the plaintiffs’ right of access. For that reason, it did not consider the damage of € 500.00 per month applied by the plaintiff as unreasonable.

What makes this decision unusual

The quite remarkable thing about this decision is that the plaintiff did not specifically state the precise nature of the non-material damage he allegedly incurred within the meaning of Article 82(1) GDPR.

There is currently some question as to whether any requirement for such statements would exist in light of the two referrals for preliminary ruling on this issue pending before the ECJ. In one of the above-mentioned referrals for preliminary ruling the position taken by the German Federal Labour Court [Bundesarbeitsgericht – BAG] is that it believed that the legal right to receive non-material compensation pursuant to Article 82(1) GDPR did not require the injured person to show any (further) non-material damage suffered by him or her beyond a violation of the GDPR, but that the violation itself already resulted in non-material damage requiring compensation (BAG, ECJ – Referral of 26 August 2021 – 8 AZR 253/20 (A) paragraph 33).

Subsequent to this referral for preliminary ruling, the BAG already held in one of its rulings that the preventive character and deterrent function of the right according to Article 82(1) GDPR could be assumed in the plaintiff’s favour (BAG, Judgment of 5 May 2022 – 2 AZR 363/21 paragraph 25).
The Oldenburg Labour Court followed this view in the decision referenced above.

Practical note

This decision of the labour court shows yet again that controllers have an obligation to comply with the rights of data subjects guaranteed in the GDPR within the time limits provided for in Article 12(3) and one which they need to take very seriously.

It also makes clear that providing the data subject with an unstructured collection of documents by no means suffices when it comes to fulfilling the data subject’s right of access or the right to receive a copy pursuant to Article 15 GDPR. Rather, a comprehensible presentation on the part of the controller enabling the data subject to understand to what extent the controller used the personal data of the data subject in accordance with Article 15(1) and (2) GDPR, including the purposes of processing or any recipients of personal data, is required.

Lastly, this decision, precisely in view of the referral question to be decided by the ECJ, will likely represent another quite significant step towards enhancing the tools of private enforcement of the GDPR. 

(Oldenburg Labour Court (3^rd Chamber), Partial Judgment of 9 February 2023 – 3 Ca 150/21)