Compensation for breach of GDPR in case of works agreement
An employee may be entitled to compensation for a breach of the General Data Protection Regulation if the employer transfers real personal data within the group to another company to test the cloud-based HR management software “Workday”. This was decided by the Federal Labor Court following a preliminary ruling of the European Court of Justice.
Background
The applicant is employed by the defendant, a company governed by German law, and is chairman of the works council set up within that company. Initially, that company processed certain personal data of its employees in the context of the use of software called ‘SAP’ (‘the SAP software’), including for accounting purposes, and it concluded, with its works council, several works agreements in that regard.
In 2017, the D group of companies introduced, throughout that group, the cloud-based software called ‘Workday’ as a single personnel information management system. In that context, the defendant transferred various personal data of its employees from the SAP software to a server of the D group’s parent company in the United States.
On 3 July 2017, the defendant and its works council concluded an agreement confirming acquiescence as regards the introduction of the Workday software, which prohibited, inter alia, the use of that software for human resources management purposes, such as the appraisal of a worker, during the test phase.
The only categories of data which could be transferred for the purpose of populating the Workday software were the personal identification number allocated to the worker within the D group, his or her surname, his or her first name, his or her telephone number, the date on which he or she took up his or her post in the company concerned, the date on which he or she took up his or her post in the D group, his or her place of work, the name of the company concerned as well as his or her work telephone number and work email address. The defendant also transmitted additional data about the plaintiff, such as information concerning his salary, private residential address, date of birth, marital status, social security number and tax ID.
The applicant brought before the Arbeitsgericht (Labor Court, Germany) and then before the Landesarbeitsgericht (Higher Labor Court) applications for access to certain information, erasure of data concerning him and the award of compensation. The applicant claimed, inter alia, that the defendant had transferred to the parent company’s server, personal data concerning him, some of which were not mentioned in the works agreement confirming acquiescence, particularly his private contact information, contractual and remuneration details, his national insurance and tax identification numbers, his nationality and his marital status.
The applicant claimed compensation for non-material damage under Article 82 (1) GDPR. The Federal Labor Court then suspended the appeal proceedings and referred the case to the European Court of Justice (ECJ) for a preliminary ruling. The ECJ has answered these questions in its decision of 19 December 2024 (case: C-65/23 K GmbH).
Decision of the Federal Labor Court
The appellant's appeal before the Federal Labor Court was partly successful. The appellant is entitled to compensation from the defendant pursuant to Art. 82 (1) GDPR. Processing of data was not necessary insofar as the defendant transferred personal data to the parent company other than that permitted under the works agreement which was held in breach of Art. 6 para. 1 subpara. 1 letter f GDPR where “processing is allowed if it is for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The plaintiff's non-material damage stems from the loss of control caused by the transfer of personal data to the parent company.
Source:
Federal Labor Court, press release of 8 May 2025.
