In addition to the company, managers are also liable for damages due to violations of the GDPR. This is evident from a ruling by the OLG Dresden (Case no.: 4 U 1158/21).
Legally, it is disputed whether, in addition to the company, managers can also be held liable for data protection breaches towards the affected parties. The OLG Dresden has now affirmed this liability in a noteworthy ruling dated November 30, 2021, according to the law firm MTR Rechtsanwälte.
The statements of the Higher Regional Court of Dresden on the facts are sparse. As far as can be seen, the plaintiff wanted to be admitted to a registered association. Therefore, the manager had a detective investigate the plaintiff’s past. It apparently emerged that the plaintiff had already committed a crime. The manager forwarded the investigation results to the board, which then rejected the membership application.
The plaintiff asserted claims for damages due to a violation of data protection pursuant to Art. 82 GDPR. The LG Dresden awarded him in the first instance damages, though not in the demanded amount of 21,000 euros, but at least in the amount of 5,000 euros. The damages were to be borne jointly and severally by the association and the manager. The OLG Dresden confirmed this judgment in the appeals process. The unlawful data processing by the defendants justified the claim for damages for non-material harm. The spying and forwarding of the results also exceeded the de minimis threshold.
According to Art. 82 para. 1 GDPR,any person who has suffered material or non-material damage as a result of a violation of this regulation has the right to compensation from the responsible party or the processor..
The OLG Dresden stated that the manager of a GmbH is a responsible party in terms of the GDPR, in addition to the company. This means that the manager is also liable for claims for damages. The OLG did not allow an appeal.
If other courts follow the legal opinion of the OLG Dresden, it could have significant consequences for the liability risks of managers.
Experienced lawyers can provide advice on data protection violations.
