Skip to content

You are here:

Request for information - A violation of the GDPR would not already constitute a basis for claiming compensation

Thanks to the General Data Protection Regulation (GDPR), employees have the right to seek information from their employer as to whether their personal data is being processed by the employer and, if so, then for what purpose and to what extent. If the employer fails to provide the appropriate information, then the employee can claim compensation.

The Düsseldorf Regional Labour Court (Landesarbeitsgericht, LAG) recently stated this in its ruling of 28.11.2023 (case reference: 3 Sa 285/23). The court’s decision related to an employee who had been employed at a company for one month up to the end of 2016. Some four years later, he demanded information from his former employer about his personal data in the context of the GDPR. He was provided with the appropriate information. A good two years later, in October 2022 he then again requested information and asked for a data copy. The employer allowed several deadlines to expire and their initial reply was incomplete. It was only after several more requests that the employer provided complete information. The employee brought a legal action and demanded financial compensation of admittedly no less than €2,000. To substantiate this, the employee pointed out that their right to request information had been infringed several times. While the LAG dismissed the claim, nevertheless, it also clarified that the employer had violated the GDPR. However, this had not resulted in the former employee being able to claim financial compensation. The judges believed that a mere infringement of GDPR requirements was not sufficient grounds for triggering eligibility to financial compensation for non-material damages (such as, e.g., information that is not provided). This compensation is based on the assumption that the employees concerned are able to demonstrate that they have suffered damages. 

Recommendation: If they are able to do so then the respective employer will normally have to pay up. Companies should thus always take seriously any claims asserted under the GDPR.

Back to top of page