The Regional (Labour) Court in Schleswig-Holstein (Germany) has recently passed a judgement ordering the personal data controller to pay EUR 2,000 in compensation of non-material damage for the violation of personal data, as a result of publishing a promotional video featuring the employee without its informed and written consent.
Namely, the plaintiff in this case was employed with the controller, and – when making a video for the purposes of advertising of the subject employer (which was then published on YouTube) – it verbally agreed to be filmed in his work environment, on which occasion, however, the respective data subject was not informed in detail about the purpose of this filming and its rights in that regard.
The plaintiff subsequently objected to the use of the subject video and claimed damages, following which the controller removed it from YouTube.
According to the judgement, the operator violated the provisions of the GDPR by making a video of the plaintiff and publishing it without the plaintiff’s written consent and notification on the purpose of personal data processing, and the right to withdraw the given consent.
In addition to the above, the court took the position that the plaintiff does not need to prove that the damage occurred, given that, according to the provision 82(1) of the GDPR, a breach of the GDPR itself constitutes non-material damage.
The court also confirmed that the damage endured in this case can amount to a maximum of EUR 2,000, since the controller did not film the employee in private situation, nor did it discriminate the said data subject, as well as given that there was prior verbal consent of the employee. Additionally, the damage was mitigated by removing the disputed video immediately upon receiving the employee’s request.
The right to the compensation of damages according to the Law on Personal Data Protection
Provisions of Article 86 of the Law on Personal Data Protection (Official Gazette of RS no. 87/2018) stipulate that a person who suffered material or non-material damage due to the violation of provisions of this piece of regulation is entitled to the monetary compensation from the controller, i.e., processor who caused such damage. The controller is responsible for damage, while the processor shall be held accountable only provided that it did not act in accordance with the obligations prescribed by this law which directly apply to it, or in case it acted outside or contrary to the instructions of the controller, issued in accordance with the law.
If material or non-material damage is caused by illegal processing carried out by competent authority for special purposes, i.e., by violation of provisions of the law relating to the processing of such data, a person who endured damage shall be entitled to the compensation from the controller or another competent authority against whom a claim for damages can be filed, in accordance with the law.
Controller, i.e., processor shall be released from responsibility for damage if it proves that it is in no way responsible for its occurrence.
If the processing is carried out by several controllers, i.e., processors, or jointly by the controller and the processor, provided that they are responsible for the damage, each controller, i.e., processor shall be responsible for the entire amount of damages. If the controller or processor pays the entire amount of compensation of damages, it shall be entitled to claim return of a part of the paid amount from other controllers, i.e., processors, which corresponds to their responsibility for the occurrence of damage.
This article is to be considered as exclusively informative, with no intention to provide legal advice. If you should need additional information, please contact us directly.
By Lara Maksimovic, Senior Associate, PR Legal