BAG – 8 AZR 91/22

4 February 2026

Avalang: Created page with “{{COURTdecisionBOX |Jurisdiction=Germany |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=BAG |Court_Original_Name=Bundesarbeitsgericht |Court_English_Name=Federal Labour Court |Court_With_Country=BAG (Germany) |Case_Number_Name=8 AZR 91/22 |ECLI= |Original_Source_Name_1=openJur |Original_Source_Link_1=https://openjur.de/u/2496033.html |Original_Source_Language_1=German |Original_Source_Language__Code_1=DE |Original_Source_Name_2= |Original_Source_Link_…”

{{COURTdecisionBOX

|Case_Number_Name=8 AZR 91/22
|ECLI=

|Date_Decided=20.06.2024
|Date_Published=20.06.2024
|Year=2024

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Initial_Contributor=avalang
|
}}

A court held that delayed or incomplete access to personal data under [[Article 15 GDPR|Article 15 GDPR]] without concrete immaterial damage beyond a hypothetical loss of control warrants no compensation under [[Article 82 GDPR|Article 82 GDPR]].

== English Summary ==

=== Facts ===
The data subject was employed by the controller and requested access to information under [[Article 15 GDPR#1|Article 15(1) GDPR]] regarding a transfer decision and a disciplinary warning.

The controller responded within the deadline, providing documents and partially redacted records.
The data subject claimed the information was incomplete and asserted that years of delayed access left them unable to assess how the personal data was processed.

They sought immaterial damages under [[Article 82 GDPR#1|Article 82(1) GDPR]], arguing a loss of control and uncertainty, alternatively relying on national liability doctrines.

In the original decision, the labor court dismissed the claim. After a revision, the higher court awarded €2,000 in damages. Both parties appealed to the Federal Labor Court.

=== Holding ===
First, the court opined that mere infringement of the right of access, and the abstract “loss of control” inherent in any such infringement, does not constitute compensable damage, as [[Article 82 GDPR|Article 82 GDPR]] requires a distinct, concrete harm causally linked to the violation.

It considered that negative feelings or fears may qualify as immaterial damage only if objectively justified; a purely hypothetical risk of data misuse is insufficient. Unlike a data breach, delayed or incomplete access does not itself increase misuse risk. As no concrete harm was substantiated, neither GDPR-based nor alternative national-law damage claims succeeded.

Hence, the court denied any compensation under [[Article 82 GDPR#1|Article 82(1) GDPR]], as the data subject failed to demonstrate an immaterial damage had occurred.

== Comment ==
Parallel decision in BAG 8 AZR 124/23.

== Further Resources ==
”Share blogs or news articles here!”

== English Machine Translation of the Decision ==
The decision below is a machine translation of the German original. Please refer to the German original for more details.

<pre>
Judgment

Upon the defendant’s appeal on points of law, the judgment of the Berlin-Brandenburg Regional Labor Court of November 18, 2021 – 10 Sa 443/21 – is set aside insofar as it partially amended the judgment of the Berlin Labor Court of January 21, 2021 – 27 Ca 11237/19 – on the plaintiff’s appeal, while the plaintiff’s appeal on points of law is dismissed.

The plaintiff’s appeal against the judgment of the Berlin Labor Court of January 21, 2021 – 27 Ca 11237/19 – is dismissed in its entirety.

The plaintiff shall bear the costs of the appeal and the proceedings on points of law.

Facts

The parties are in dispute – insofar as relevant to the proceedings on points of law – regarding a claim for compensation under Article 82(1) GDPR.

The plaintiff was employed by the defendant as a cook for many years. By letter dated July 22, 2019, the plaintiff, through his attorney, requested information from the defendant regarding two matters, pursuant to Article 15(1) of the GDPR, by August 26, 2019. The letter of request contains the following excerpt:

“You issued a transfer order to our client. We reject this as unlawful. We are required to provide full information pursuant to Article 15 of the GDPR regarding the consultation with the works council and its subsequent consent. The transfer must be rescinded.

Furthermore, you issued a warning on May 29, 2019. This warning was issued unjustly and, along with all related correspondence, must be removed from our client’s personnel file. The facts you have presented are inaccurate. …

With regard to this incident as well, we request information from you, pursuant to Article 15 of the GDPR, concerning all data relating to our client.”

The defendant responded with a letter dated August 23, 2019, enclosing several documents, as follows:

“…

In your letter, you are asserting a right to information under Article 15 of the General Data Protection Regulation (GDPR), requesting full information regarding the transfer, the consultation with the works council, and the granting of its consent, as well as information on all data concerning our client regarding the warning issued for the incident of May 5, 2019. We would like to respond as follows:

Regarding your client’s transfer to the P site, we would like to inform you that we are upholding the transfer. A copy of the works council consultation and the works council’s consent is enclosed with this letter.

II.

Regarding the warning issued on May 29, 2019, we would like to inform you that the facts presented by your client are inaccurate. Furthermore…” Contrary to your assertion, the issued warning letter made no mention of a “residential unit manager” (female), but only of the “residential unit director” (male). Although the residential unit manager was indeed not on duty on May 5, 2019, this does not alter the fact that a residential unit director was present on that day. Furthermore, you overlook the fact that Mr. F was not named as a witness in the warning letter, but merely referred to his statement. A copy of the statement, including the log entry—which we have redacted for data protection reasons, removing the passages not pertaining to the incident of May 5, 2019—is enclosed with this letter. …”

The plaintiff, referring to his original request for information and without substantively challenging the information already provided, maintains that the defendant has not fully complied with his rights to information under Article 15(1) of the GDPR. Due to the years-long delay in providing information, he remains in the dark about essential aspects of data processing and is prevented from verifying whether and how the defendant processes his personal data. The defendant therefore owes him non-material damages pursuant to Article 82(1) GDPR. This claim is asserted alternatively on the grounds of contractual liability, alternatively on the grounds of quasi-contractual liability, and alternatively on the grounds of tortious liability. Compensation in the total amount of €8,000.00 is appropriate in view of the long duration of the infringement.

The plaintiff has requested, insofar as relevant to the appeal proceedings,

that the defendant be ordered to pay him compensation, the amount of which is left to the court’s discretion, but should not be less than €8,000.00, plus interest at a rate of five percentage points above the respective base interest rate from the date the action was filed.

The defendant has requested that the action be dismissed.

The Labor Court dismissed the action to that extent. Upon the plaintiff’s appeal, the Regional Labor Court partially amended the judgment of the Labor Court and granted the claim for damages in the amount of €2,000.00. With the appeal on points of law admitted by the Regional Labor Court, the plaintiff seeks compensation exceeding €2,000.00, while the defendant seeks the partial reversal of the appellate judgment and the complete dismissal of the plaintiff’s appeal.

Reasons

The defendant’s appeal on points of law is admissible and well-founded. The plaintiff’s admissible appeal on points of law, however, is unsuccessful.

I. The plaintiff’s and the defendant’s appeals on points of law are admissible by virtue of the admission granted in the operative part of the appellate judgment and are also admissible in all other respects. This is not precluded by the fact that the Regional Labor Court stated in its reasoning that an appeal on points of law was not admissible because the statutory requirements were not met. According to Section 72 Paragraph 1 Sentence 2 of the Labor Court Act (ArbGG) in conjunction with… Pursuant to Section 64 Paragraph 3a Sentence 1 of the German Labor Court Act (ArbGG), the decision as to whether or not leave to appeal must be included in the operative part of the judgment. This provision was enacted for reasons of legal certainty and clarity. As a result, it is clear at the time of pronouncement of the decision whether the losing party can challenge the judgment by way of appeal and whether the winning party must still expect to have to pursue an appeal (see Federal Labor Court [BAG] March 19, 2003 – 5 AZN 751/02 – Section II 2 of the grounds, BAGE 105, 308). Leave to appeal granted in the operative part of the judgment cannot be effectively restricted or excluded in the grounds for the decision (see Federal Labor Court [BAG] October 2, 2018 – 5 AZR 376/17 – para. 11 with further references, BAGE 163, 326). Furthermore, the appeals are not subject to any other admissibility concerns.

II. The defendant’s appeal is well-founded, while the plaintiff’s is unfounded. The Regional Labor Court erred in partially amending the Labor Court’s judgment on the plaintiff’s appeal and granted the claim in the amount of €2,000.00 plus interest. The admissible claim is entirely unfounded. The plaintiff has no claim against the defendant for compensation for non-material damages under Article 82(1) GDPR. In this respect, it is unnecessary to decide whether Article 15(1) GDPR is superseded in the employment relationship by the right to inspect personnel files under Section 83(1) of the German Works Constitution Act (BetrVG) (see Franzen, NZA 2020, 1593, 1596), whether a violation of the right of access under Article 15(1) and (3) GDPR can even give rise to a claim under Article 82(1) GDPR (see Federal Labor Court, May 5, 2022 – 2 AZR 363/21 – para. 11), and whether the plaintiff has even demonstrated a violation of his right of access under Article 15(1) GDPR with regard to the information provided. In the present case, contrary to the opinion of the Regional Labor Court, the plaintiff has in any event not demonstrated any damage within the meaning of Article 82(1) GDPR.

1. The requirement of damages and the corresponding burden of proof on the plaintiff have been sufficiently clarified by the recent decisions of the Court of Justice of the European Union (see, in this regard, Federal Labour Court, 25 April 2024 – 8 AZR 209/21 (B) – para. 5 et seq.).

The requirement of damages and the corresponding burden of proof on the plaintiff have been sufficiently clarified by the recent decisions of the Court of Justice of the European Union (see, in this regard, Federal Labour Court, 25 April 2024 – 8 AZR 209/21 (B) – para. 5 et seq.). a) It is clear from the wording of Article 82(1) GDPR that the existence of “damage” is one of the prerequisites for the claim for damages provided for in that provision, as is the existence of an infringement of the General Data Protection Regulation and a causal link between the damage and the infringement, these three prerequisites being cumulative (ECJ 25 January 2024 – C-687/21 – [MediaMarktSaturn] para. 58; 14 December 2023 – C-340/21 – [Natsionalna agentsia za prihodite] para. 77; 4 May 2023 – C-300/21 – [Österreichische Post] para. 32). The right to compensation, particularly in the case of non-material damage, has a compensatory function, since monetary compensation based on Article 82(1) GDPR is intended to fully compensate for the specific damage suffered as a result of the infringement of this Regulation, and does not serve a deterrent or punitive function (ECJ 25 January 2024 – C-687/21 – [MediaMarktSaturn] para. 50; 21 December 2023 – C-667/21 – [Krankenversicherung Nordrhein] para. 87). The damage need not have reached a certain degree of severity (ECJ 14 December 2023 – C-456/22 – [Gemeinde Ummendorf] para. 16 and – C-340/21 – [Natsionalna agentsia za prihodite] para. 78; 4 May 2023 – C-300/21 – [Österreichische Post] para. 51).

… (b) With regard to the burden of proof, the Court of Justice of the European Union has clarified that a person claiming compensation for non-material damage under Article 82(1) GDPR must prove not only the infringement of provisions of that Regulation, but also that such damage has resulted from that infringement (CJEU 11 April 2024 – C-741/21 – [juris] para. 35; 25 January 2024 – C-687/21 – [MediaMarktSaturn] paras. 60 et seq.). Since Recital 85 of the GDPR expressly includes the “loss of control” among the damage that can be caused by a breach of personal data protection, the Court has ruled that the loss of control over such data – even if temporary – constitutes “non-material damage” within the meaning of the GDPR. Article 82(1) GDPR may provide for a claim for damages, provided the data subject proves that they have actually suffered such damage – however minor it may be (ECJ 11 April 2024 – C-741/21 – [juris] para. 42; 25 January 2024 – C-687/21 – [MediaMarktSaturn] para. 66). The fear of a data subject, triggered by a breach of the General Data Protection Regulation, that their personal data may be misused by third parties, may in itself constitute “non-material damage” within the meaning of the GDPR. Article 82(1) GDPR applies (ECJ 25 January 2024 – C-687/21 – [MediaMarktSaturn] para. 65; 14 December 2023 – C-340/21 – [Natsionalna agentsia za prihodite] paras. 79 et seq.). However, a purely hypothetical risk of misuse by an unauthorized third party cannot give rise to compensation (ECJ 25 January 2024 – C-687/21 – [MediaMarktSaturn] para. 68). Rather, the national court must examine whether the concern about the misuse of data can be considered justified under the given specific circumstances and with regard to the data subject (ECJ 14 December 2023 – C-340/21 – [Natsionalna agentsia za prihodite] para. 85).

c) In light of the recent case law of the Court of Justice of the European Union regarding the requirement of damage and the corresponding burden of proof on the plaintiff, the Senate is of the opinion that the referral from the Federal Court of Justice of 26 September 2023 (- VI ZR 97/22 – para. 30 et seq.) is irrelevant. The Federal Court of Justice asked the Court of Justice of the European Union whether Article 82(1) GDPR should be interpreted as meaning that mere negative feelings such as anger, resentment, dissatisfaction, worry, and anxiety are sufficient to establish non-material damage, or whether a disadvantage to the data subject that goes beyond these feelings is required for the establishment of damage. This question has been answered by the case law of the Court of Justice of the European Union following the referral from the German Federal Court of Justice, at least with regard to concerns about data loss or unlawful data use (contra Rombach/Hoeren WuB 2024, 28, 32; Scharpf jurisPR-ITR 8/2024 Note 5 under C; see also German Federal Court of Justice, 12 December 2023 – VI ZR 277/22 – para. 6).

aa) According to the case law of the Court of Justice of the European Union, negative feelings (“fear”) in such situations can give rise to a claim for compensation for non-material damage. However, simply invoking a particular emotional state is not sufficient, because, as explained above, the court must examine whether the feeling, taking into account the specific circumstances, “can be considered justified” (ECJ 14 December 2023 – C-340/21 – [Natsionalna agentsia za prihodite] para. 85). This necessarily requires the application of an objective standard (see also Halder/Maluszczak jurisPR-ITR 3/2024 note 4 under D; Sorber/Lohmann BB 2023, 1652, 1655; Peisker/Zhou BB 2024, 308, 310; contra Rudkowski NZA 2024, 1, 7). In this context, inter alia, The objective determination of the risk of data misuse is of importance (see Arning/Dirkers DB 2024, 381, 383).

bb) This is not contradicted by the fact that, according to the case law of the Court of Justice of the European Union, Article 82(1) GDPR does not require that a disadvantage suffered be perceptible or that an impairment be objectively verifiable (CJEU 14 December 2023 – C-456/22 – [Municipality of Ummendorf] para. 17). The Court merely clarified that there is no “de minimis threshold.” The objective standard regarding the existence of damage as such must be distinguished from this. If the damage consists of negative feelings that are not provable in themselves, the national court must assess the overall situation and ultimately also the credibility of the respective plaintiff on the basis of a substantiated presentation of the facts. If there is a violation of the General Data Protection Regulation within the meaning of Article 82(1) GDPR, the national court must consider the overall situation and ultimately also the credibility of the respective plaintiff. If, according to Article 82(1) GDPR, the court’s assessment of evidence pursuant to Section 286(1) of the German Code of Civil Procedure (ZPO) is found to be detrimental to the plaintiff as a protected person, the standard of proof regarding the occurrence and extent of the damage is reduced pursuant to Section 287(1) ZPO (see Federal Labor Court, May 5, 2022 – 2 AZR 363/21 – para. 14).

2. The plaintiff argued that, due to the years-long delay in providing information, he remains in the dark about essential aspects of the data processing and is prevented from verifying whether and how the defendant processes his personal data. Based on the case law of the Court of Justice of the European Union, the plaintiff has thus failed to demonstrate non-material damage.

2. a) Contrary to the opinion of the Regional Labour Court, damage cannot be assumed solely on the grounds that a breach of the right of access under Article 15(1) GDPR – even if such a breach could in principle give rise to a claim under Article 82(1) GDPR – results in a loss of control because it prevents verification of whether personal data is being processed lawfully. While the right of access under Article 15(1) GDPR serves the purpose of enabling data subjects to exercise their rights to rectification, erasure, restriction of processing, and objection to processing under Articles 16 to 18 and 21 GDPR (see CJEU 4 May 2023 – C-487/21 – [Austrian Data Protection Authority], para. 35), such a loss of control necessarily accompanies any breach of the right of access under Article 15(1) GDPR. It is therefore not suitable for establishing damage that is distinguishable from a mere violation of Article 15(1) GDPR (contra Brandt/Goffart NZA 2024, 240, 242). The independent requirement of damage would thus become meaningless. It would always be fulfilled. However, this is incompatible with the Court of Justice’s understanding of Article 82(1) GDPR, as well as with the requirements of national procedural law, which demands a substantiated demonstration of damage (see LAG Rheinland-Pfalz, February 8, 2024 – 5 Sa 154/23 – point II 1 b of the grounds; LAG Baden-Württemberg, July 27, 2023 – 3 Sa 33/22 – point B II 1 b of the grounds; Barrein/Fuhlrott NZA 2024, 443, 446).

This is incompatible with the Court’s understanding of Article 82(1) GDPR, as well as with the requirements of national procedural law, which demands a substantiated demonstration of damage (see LAG Rheinland-Pfalz, February 8, 2024 – 5 Sa 154/23 – point II 1 b of the grounds; LAG Baden-Württemberg, July 27, 2023 – 3 Sa 33/22 – point B II 1 b of the grounds; Barrein/Fuhlrott NZA 2024, 443, 446). b) Insofar as the plaintiff argues that he is prevented from verifying whether and how the defendant processes his personal data, he merely presents a hypothetical risk of misuse. The plaintiff fails to demonstrate an objectively increased risk of misuse with regard to the personal data affected by the right to information. Unlike a data breach, the security of the data does not deteriorate directly due to the lack of information. In the present case, the plaintiff would have needed to provide further explanations as to why there should be more than a hypothetical risk of misuse of his personal data.

c) Insofar as the plaintiff’s submissions—even if only hinted at—indicate negative feelings in the form of a fear of data misuse, these cannot be considered justified under the given circumstances. Simply invoking such fears is insufficient. An objective standard must be applied to determine whether the feeling can be considered justified. In this context, particular attention must be paid to the objective risk of abuse, for which there is insufficient evidence in the present case.

3. Insofar as the plaintiff has alternatively claimed damages based on contractual, alternatively quasi-contractual, and alternatively tortious liability under national law, there is also a lack of sufficiently substantiated damages.

III. The decision on costs is based on Sections 91(1) and 97(1) of the German Code of Civil Procedure (ZPO).
</pre>

FTC Secures Landmark Settlement with Express Scripts to Lower Drug Costs for American Patients

Ss. v Bratislave – BA-1S/27/2022