TURGERLEGAL - Expertise. Reliability. Dedication

Compensation after GDPR violation: Deleted application documents spark legal debate

Expert article in labor law

Compensation for GDPR violations: Deleted application documents lead to legal disputes

A current case is before the labor courts and could have far-reaching consequences for employers: An applicant is demanding damages for a GDPR violation after a company deleted his application documents – allegedly in accordance with the General Data Protection Regulation (GDPR). However, the applicant criticizes the fact that he was not provided with any information beforehand about the processing of his personal data. According to him, this lack of transparency caused him emotional distress.
Now the crucial question under labor law and data protection law arises: Is this "emotional discomfort" sufficient to assert a claim for damages under Article 82 GDPR? The case has now reached the European Court of Justice (ECJ).

GDPR violation in the application process: Claim for damages due to deleted documents

An applicant for a position in receivables management received no feedback and no information about their stored data. On my own initiative, I wrote a rejection letter and requested access to and a copy of my data in accordance with Article 15 of the GDPR.
The company informed me, however, that all application documents had been deleted "in accordance with the GDPR." I considered this a deliberate violation of the right to information and demanded compensation.
I justified this with a loss of control over my personal data and the resulting emotional distress. Furthermore, I incurred considerable time and effort, as well as the risk of legal costs, simply because my employer failed to comply with their data protection obligations. In my opinion, such emotional distress also constitutes compensable damage under the GDPR.
Do you have questions about GDPR violations in the application process, or would you like to assert your rights as an employee? Contact me now – I will review your claims and represent you with dedication.

Düsseldorf Labor Court: No entitlement to damages for mere loss of control over applicant data

The Düsseldorf Labour Court (judgment of 12 March 2024 – 13 Ca 5385/23) dismissed the claim of an applicant who demanded compensation pursuant to Article 82 Paragraph 1 GDPR. The judges determined that no compensable non-material damage had occurred.
The plaintiff argued that the loss of control over his personal data – caused by the lack of a right to access his data and the deletion of his application documents – had led to „emotional distress.“ However, the court made it clear that a mere violation of the GDPR is not sufficient to establish a claim for damages.
According to the court, concrete damage must be proven, as also emphasized by the ECJ and some legal scholars. The mere loss of control without demonstrable impairment of physical or psychological integrity does not meet this requirement. The company's assertion that the documents were deleted is also insufficient as proof of misuse or serious impairment.
Do you want to know when a GDPR violation in employment law actually leads to claims for damages? I will review your case individually and enforce your rights. Contact me now for a free consultation!

The Federal Labour Court (BAG) discontinues the proceedings – the European Court of Justice (ECJ) is to decide on damages under the GDPR's duty to provide information.

The Regional Labor Court upheld the lower court's decision on appeal. The case is now before the Federal Labor Court (BAG), but was suspended by order of June 24, 2025 (8 AZR 4/25). This is due to a pending request for a preliminary ruling from the Federal Court of Justice (BGH) to the European Court of Justice (ECJ) dated May 6, 2025.
The ECJ is to clarify whether Article 82(1) and (2) GDPR (liability and right to compensation) is to be interpreted in such a way that a breach of the right of access under Article 15 GDPR – for example, through delayed or incomplete information – can give rise to a claim for non-material damages.
Furthermore, the Federal Office of Public Health (BAG) would like to know whether the uncertainty regarding the processing of personal data and the associated restriction on verifying the lawfulness and asserting rights is already considered non-material damage within the meaning of Article 82 GDPR.
This decision could have significant consequences for claims for damages arising from GDPR violations in employment law. I offer comprehensive advice on your rights – request a free consultation now.
Make an inquiry now
We will be happy to provide you with comprehensive, personal advice on your concerns.

FAQs – Frequently Asked Questions about compensation for GDPR violations

A violation of the GDPR occurs if, as an employer, I process or delete applicant data without a legal basis, or fail to comply with the right of access pursuant to Art. 15 GDPR, or do so belatedly.
Yes. As an employer, I am obliged to provide applicants with complete information upon request about the personal data stored, the purposes of processing, and the retention periods.

In principle, yes – but only after I have fulfilled my obligations to provide information. If the data is deleted before I have provided the requested GDPR information, this could constitute a legal violation.

A claim for damages can be made if material or immaterial damage is proven. A mere violation of the GDPR is not automatically sufficient for this.
According to the current case law of the Düsseldorf Labor Court, this is not the case. Mere unease or an abstract loss of control over data is generally insufficient, unless there is a concrete impairment.
Intangible damage can occur, for example, in cases of demonstrable psychological distress, anxiety, or serious infringement of personal rights – but not in cases of mere uncertainty.
The court rejected the claim for damages because no specific non-material damage had been proven, although there was a potential violation of Article 15 GDPR.
The Federal Labour Court has stopped the proceedings in order to await clarification from the ECJ on the interpretation of Article 82 GDPR.
The ECJ will decide whether a violation of the right to information or uncertainty about data processing can be considered compensable non-material damage.
This decision could have profound implications for liability risks in the application process. As an employer, I will have to comply with GDPR obligations even more diligently in the future to avoid claims for damages.

Area of law

Streit im Büro-Mobile
Personalgespräch-Mobile

Happy to help you

Contact

Your law firm TURGERLEGAL.

address

Kurfürstendamm 195
10707 Berlin

Opening hours

Mon. – Fri. 10:00 – 17:00

Contact

en_US