Wann tritt ein Verstoß gegen die DSGVO im Bewerbungsprozess auf?

Ein Verstoß gegen die DSGVO ist gegeben, wenn ich als Arbeitgeber Bewerberdaten ohne rechtliche Grundlage verarbeite, lösche oder das Auskunftsrecht gemäß Art. 15 DSGVO nicht oder verspätet erfülle.

Sind Arbeitgeber verpflichtet, Bewerbern Informationen über ihre Daten bereitzustellen?

Ja. Als Arbeitgeber bin ich verpflichtet, Bewerbern auf Anfrage vollständige Informationen über die gespeicherten personenbezogenen Daten, die Verarbeitungszwecke und die Speicherfristen bereitzustellen.

Ist es einem Unternehmen gestattet, Bewerbungsunterlagen ohne Weiteres zu löschen?

Im Prinzip ja – jedoch erst nach Erfüllung meiner Auskunftspflichten. Wenn die Löschung erfolgt, bevor ich die geforderte DSGVO-Auskunft erteilt habe, kann dies einen Rechtsverstoß darstellen.

Hat ein Bewerber das Recht, Schadensersatz gemäß Art. 82 DSGVO zu fordern?

Ein Anspruch auf Schadensersatz kann geltend gemacht werden, wenn ein materieller oder immaterieller Schaden nachgewiesen wird. Ein reiner Verstoß gegen die DSGVO reicht hierfür nicht automatisch aus.

Reicht „emotionales Ungemach“ aus, um Schadensersatz nach DSGVO zu verlangen?

Nach der derzeitigen Rechtsprechung des Arbeitsgerichts Düsseldorf ist dies nicht der Fall. Ein bloßes Unwohlsein oder ein abstrakter Kontrollverlust über Daten genügt in der Regel nicht, es sei denn, es liegt eine konkrete Beeinträchtigung vor.

Welche Bedeutung hat immaterieller Schaden im Kontext der DSGVO?

Ein immaterieller Schaden kann beispielsweise bei nachweisbarer psychischer Belastung, Angstzuständen oder gravierender Beeinträchtigung der Persönlichkeitsrechte gegeben sein – jedoch nicht bei lediglich bestehender Ungewissheit.

Wie entschied das Arbeitsgericht Düsseldorf in diesem speziellen Fall?

Das Gericht wies den Schadensersatzanspruch zurück, da kein spezifischer immaterieller Schaden nachgewiesen wurde, obwohl ein potenzieller Verstoß gegen Art. 15 DSGVO gegeben war.

Was führt dazu, dass das Verfahren derzeit beim EuGH läuft?

Das Bundesarbeitsgericht hat das Verfahren gestoppt, um eine Klärung durch den EuGH zur Auslegung von Art. 82 DSGVO abzuwarten.

Welche Fragen möchte ich vom EuGH geklärt haben?

Der EuGH wird darüber entscheiden, ob eine Verletzung des Auskunftsrechts oder die Ungewissheit über die Datenverarbeitung als ersatzfähiger immaterieller Schaden betrachtet werden kann.

Welche Relevanz hat das Verfahren für den Arbeitgeber?

Die Entscheidung kann tiefgreifende Auswirkungen auf Haftungsrisiken im Bewerbungsverfahren haben. Ich als Arbeitgeber muss die DSGVO-Pflichten künftig noch gewissenhafter beachten, um Schadensersatzforderungen zu vermeiden.

TURGERLEGAL - Expertise. Reliability. Dedication

Compensation after GDPR violation: Deleted application documents spark legal debate

Expert article in labor law

Compensation for GDPR violations: Deleted application documents lead to legal disputes

A current case is before the labor courts and could have far-reaching consequences for employers: An applicant is demanding damages for a GDPR violation after a company deleted his application documents – allegedly in accordance with the General Data Protection Regulation (GDPR). However, the applicant criticizes the fact that he was not provided with any information beforehand about the processing of his personal data. According to him, this lack of transparency caused him emotional distress.

Now the crucial question under labor law and data protection law arises: Is this "emotional discomfort" sufficient to assert a claim for damages under Article 82 GDPR? The case has now reached the European Court of Justice (ECJ).

GDPR violation in the application process: Claim for damages due to deleted documents

An applicant for a position in receivables management received no feedback and no information about their stored data. On my own initiative, I wrote a rejection letter and requested access to and a copy of my data in accordance with Article 15 of the GDPR.

The company informed me, however, that all application documents had been deleted "in accordance with the GDPR." I considered this a deliberate violation of the right to information and demanded compensation.

I justified this with a loss of control over my personal data and the resulting emotional distress. Furthermore, I incurred considerable time and effort, as well as the risk of legal costs, simply because my employer failed to comply with their data protection obligations. In my opinion, such emotional distress also constitutes compensable damage under the GDPR.

Do you have questions about GDPR violations in the application process, or would you like to assert your rights as an employee? Contact me now – I will review your claims and represent you with dedication.

Düsseldorf Labor Court: No entitlement to damages for mere loss of control over applicant data

The Düsseldorf Labour Court (judgment of 12 March 2024 – 13 Ca 5385/23) dismissed the claim of an applicant who demanded compensation pursuant to Article 82 Paragraph 1 GDPR. The judges determined that no compensable non-material damage had occurred.

The plaintiff argued that the loss of control over his personal data – caused by the lack of a right to access his data and the deletion of his application documents – had led to „emotional distress.“ However, the court made it clear that a mere violation of the GDPR is not sufficient to establish a claim for damages.

According to the court, concrete damage must be proven, as also emphasized by the ECJ and some legal scholars. The mere loss of control without demonstrable impairment of physical or psychological integrity does not meet this requirement. The company's assertion that the documents were deleted is also insufficient as proof of misuse or serious impairment.

Do you want to know when a GDPR violation in employment law actually leads to claims for damages? I will review your case individually and enforce your rights. Contact me now for a free consultation!

The Federal Labour Court (BAG) discontinues the proceedings – the European Court of Justice (ECJ) is to decide on damages under the GDPR's duty to provide information.

The Regional Labor Court upheld the lower court's decision on appeal. The case is now before the Federal Labor Court (BAG), but was suspended by order of June 24, 2025 (8 AZR 4/25). This is due to a pending request for a preliminary ruling from the Federal Court of Justice (BGH) to the European Court of Justice (ECJ) dated May 6, 2025.

The ECJ is to clarify whether Article 82(1) and (2) GDPR (liability and right to compensation) is to be interpreted in such a way that a breach of the right of access under Article 15 GDPR – for example, through delayed or incomplete information – can give rise to a claim for non-material damages.

Furthermore, the Federal Office of Public Health (BAG) would like to know whether the uncertainty regarding the processing of personal data and the associated restriction on verifying the lawfulness and asserting rights is already considered non-material damage within the meaning of Article 82 GDPR.

This decision could have significant consequences for claims for damages arising from GDPR violations in employment law. I offer comprehensive advice on your rights – request a free consultation now.

Make an inquiry now

We will be happy to provide you with comprehensive, personal advice on your concerns.

FAQs – Frequently Asked Questions about compensation for GDPR violations

When does a violation of the GDPR occur in the application process?

A violation of the GDPR occurs if, as an employer, I process or delete applicant data without a legal basis, or fail to comply with the right of access pursuant to Art. 15 GDPR, or do so belatedly.

Are employers obligated to provide applicants with information about their data?

Yes. As an employer, I am obliged to provide applicants with complete information upon request about the personal data stored, the purposes of processing, and the retention periods.

Is a company allowed to simply delete application documents?

In principle, yes – but only after I have fulfilled my obligations to provide information. If the data is deleted before I have provided the requested GDPR information, this could constitute a legal violation.

Does an applicant have the right to claim damages pursuant to Article 82 GDPR?

A claim for damages can be made if material or immaterial damage is proven. A mere violation of the GDPR is not automatically sufficient for this.

Is "emotional distress" sufficient grounds to claim damages under the GDPR?

According to the current case law of the Düsseldorf Labor Court, this is not the case. Mere unease or an abstract loss of control over data is generally insufficient, unless there is a concrete impairment.

What is the significance of non-material damage in the context of the GDPR?

Intangible damage can occur, for example, in cases of demonstrable psychological distress, anxiety, or serious infringement of personal rights – but not in cases of mere uncertainty.

How did the Düsseldorf Labour Court rule in this specific case?

The court rejected the claim for damages because no specific non-material damage had been proven, although there was a potential violation of Article 15 GDPR.

What is the reason the case is currently before the European Court of Justice?

The Federal Labour Court has stopped the proceedings in order to await clarification from the ECJ on the interpretation of Article 82 GDPR.

What questions would I like the European Court of Justice to clarify?

The ECJ will decide whether a violation of the right to information or uncertainty about data processing can be considered compensable non-material damage.

What relevance does this procedure have for the employer?

This decision could have profound implications for liability risks in the application process. As an employer, I will have to comply with GDPR obligations even more diligently in the future to avoid claims for damages.