Data protection is relevant not only to a business’s customers but also its employees, a fact that employers ought to bear in mind given how costly violations of the General Data Protection Regulation can be for them.
The implementation of the GDPR has placed greater demands on businesses with respect to data protection. It is not only their customers who are affected by this but also their employees, who are equally entitled to demand information from their employer about how and what personal data of theirs is being used. Employers keen to avoid financial penalties should take this right seriously, cautions commercial law firm MTR Legal Rechtsanwälte, which advises its clients on data protection and IT law.
Data protection is increasingly taking center stage, not least within businesses, which is why employers need to make sure that their business complies with data protection regulations. Indeed, failure to comply with the provisions of the GDPR may mean having to pay compensation. Case in point: a ruling of Duisburg’s labor court – the Arbeitsgericht Duisburg – from March 23, 2023 (case ref.: 3 Ca 44/23).
An employee – the plaintiff in this case – had asserted his right to obtain information from his employer pursuant to Art. 15 GDPR. The employer complied with the employee’s request, supplying him with information before the end of the one-month deadline and providing a copy of the data it still held. Citing a lack of specific information about the retention period and the recipients of the data, the employee felt that the information provided was not comprehensive enough and also complained that the data copy was incomplete. The employer subsequently provided more specific information about the retention period and the data copy, but it omitted to provide any specifics about the recipients of the data. The employee responded by demanding monetary compensation in the amount of 2,000 euros.
The Arbeitsgericht Duisburg ruled in favor of the employee, finding that the employer was required to pay monetary compensation in accordance with Art. 82 GDPR. Going beyond the sum demanded by the plaintiff, the court ordered the employer to pay compensation to the tune of 10,000 euros.
The court reasoned that having known the identities of the recipients of the data, the employer ought to have disclosed this information to the employee. What’s more, the data provided about the retention period was said to be inadequate, all of which meant that the employer was in breach of the GDPR.
MTR Legal Rechtsanwälte advises businesses on matters relating to data protection.
Contact for more information!
➤ Lawyer data protection – learn more!
