+++ FEDERAL COURT OF JUSTICE: GDPR DAMAGES FOR MISDIRECTED XING MESSAGE +++
The Federal Court of Justice has ruled that the accidental transmission of a confidential Xing message to an uninvolved third party may give rise to a claim for non-material damages under Article 82(1) GDPR. The message had contained information about an ongoing application process, salary expectations and a specific salary offer. By sending it to the wrong recipient, personal data had been disclosed without a legal basis. The court holds that non-material damage could already result from even a temporary loss of control over personal data or from a well-founded fear that the data might be misused. In the case at hand, the third party had read the message and approached the applicant about it. The appellate court must now determine the amount of damages. The Federal Court of Justice rejected a claim for injunctive relief under the GDPR; a claim under national law also failed because there was no risk of recurrence.
To the judgment of the Federal Court of Justice (dated 23 June 2026, VI ZR 97/22, in German)
+++ SAXON HIGHER ADMINISTRATIVE COURT: VIDEO HEARING FROM AN UNSAFE THIRD COUNTRY MAY BE REFUSED +++
The Saxon Higher Administrative Court has determined that the remote participation of an adviser located abroad in a video hearing may be refused. A cross-border video hearing could involve the transfer of personal data to a third country, in this case the United States. If, in the absence of an adequacy decision and appropriate safeguards, the transfer were permissible only exceptionally on the basis of the explicit consent of all data subjects under Article 49(1), first subparagraph, point (a) GDPR, the court could take into account, when exercising its discretion under Section 102a(2) of the German Code of Administrative Court Procedure, that it would remain uncertain before the oral hearing whether all participants and thus all data subjects would give valid consent. This uncertainty could impede reliable advance planning of the hearing.
To the decision of the Saxon Higher Administrative Court (dated 15 June 2026, 7 C 35/24, in German)
+++ SIEGBURG LABOUR COURT: EUR 1,000 DAMAGES FOR DISCLOSING A DIAGNOSIS IN A WHATSAPP GROUP +++
The Siegburg Labour Court has prohibited a hospital physician from further disclosing a colleague’s health data and ordered her to pay EUR 1,000 in non-material damages. Without authorisation, the physician had shared the colleague’s diagnosis in a WhatsApp group of several physicians that was used to coordinate holiday planning, sick leave notifications and shift coverage. She had also ridiculed the colleague’s illness before the other group members. In the court’s view, this constituted an unlawful disclosure of health data. The risk of recurrence required for the injunction continued to exist despite the claimant’s subsequent change of workplace because the physician had shown no acknowledgement of wrongdoing during the proceedings. The judgment is not yet final.
To the press release of the Siegburg Labour Court (dated 13 July 2026; judgment dated 22 May 2026, 1 Ca 1741/25, in German)
+++ ARNSBERG LOCAL COURT: INITIAL ACCESS REQUEST MAY BE ABUSIVE +++
Following the preliminary ruling proceedings it had initiated before the European Court of Justice, the Arnsberg Local Court has ruled that the initial access request in the case at hand could be rejected as excessive and abusive. The ECJ had previously clarified that even a first request under Article 15 GDPR may be abusive if the controller demonstrates that the request is not intended to obtain information about the processing and verify its lawfulness, but is made solely to artificially create the conditions for a subsequent claim for damages (see Privacy Ticker March 2026). Having assessed the circumstances, the Local Court concluded that such an abusive intention existed in this case. As indications, it considered, among other things, the voluntary provision of data that was not required, the short interval between subscribing to the newsletter and submitting the access request, and publicly available information about a comparable pattern of serial conduct by the defendant. The counterclaim for access and damages was therefore dismissed.
To the judgment of the Arnsberg Local Court (dated 1 July 2026, 42 C 434/23, in German)
