Claim for damages by an applicant

A company does not have much time to respond to data protection requests. If a former applicant wants to know whether their data has been stored, this must be answered “without delay”.

According to the DPA and GDPR, a request for information from an employer must be answered immediately, and in any case within one month. The Duisburg Labour Court ruled that this in no way means that the employer always has one month.

A service provider had advertised for a receivables management clerk. An applicant submitted his personal documents, but received a rejection. More than 6 years later, the applicant contacted the service provider again by email and requested information in accordance with the GDPR as to whether and what personal data was stored about him. He set the company a deadline of 30 days to respond.

The company did not respond until one day after the deadline set by the applicant had expired. The applicant therefore contacted the company again by email after the 30-day deadline had expired and reminded it of his concerns. The company then issued negative information to the former applicant, stating that it had not stored any of the applicant’s data.

The former applicant then asked the company to explain why it had not previously provided this information. The company replied that it had provided the information in due time with regard to Article 12 GDPR. The former applicant took a different view. In his opinion, the company had violated Article 12 GDPR by providing the information late. He demanded that the company pay monetary compensation in the amount of EUR 1,000. The company did not comply with this request, so the former applicant brought an action before the labour court and demanded payment of compensation in the amount of EUR 2,000 due to an alleged violation of the GDPR by the company.

The labour court awarded the former applicant compensation in the amount of EUR 750. According to Art. 12 para. 3 GDPR, the controller must provide the data subject with information without undue delay and in any case within one month of receipt of the request. The company had failed to fulfil this obligation by replying too late.