Damages under the GDPR due to testing of cloud-based HR Software

Federal Labour Court, Judgment of 8 May 2025 – 8 AZR 209/21

If an employer transfers personal data within a corporate group to another group company for the purpose of testing a cloud-based HR software (“Workday”) and transmits this information (partially) without sufficient legal basis, this constitutes a violation of the General Data Protection Regulation (GDPR). Such a violation may give rise to a claim for damages by the employee.

Facts of the case

In 2017, the defendant company planned to implement Workday as a uniform HR software system throughout the group. For testing purposes, the defendant transferred personal data of its employees – including that of the claimant – from the previously used HR software to the group’s parent company.

The preliminary test operation of Workday was regulated in a works agreement. According to this, the defendant was permitted to transmit the name, date of hire, work location, company name, and business telephone number and email address of its employees.

However, the defendant also transmitted other personal data not covered by the works agreement. This included, in particular, salary information, private residential address, date of birth, marital status, social security number, and the claimant’s tax identification number.

The claimant disagreed with this action and demanded damages of € 3,000.00 from the defendant under Article 82 (1) GDPR.

The lower court dismissed the claim (Regional Labour Court of Baden-Württemberg, judgment of 25 February 2021 – 17 Sa 37/20). It found that the alleged loss of control over the claimant’s data was not sufficient to constitute compensable damage within the meaning of the GDPR.

Referral by the Federal Labour Court

By order dated 22 September 2022 (8 AZR 209/21 (A)), the Federal Labour Court suspended the appeal proceedings and referred several questions to the Court of Justice of the European Union (CJEU) for a preliminary ruling.

The key issue for the Federal Labour Court was whether a works agreement that forms the basis for the processing of personal data for employment purposes must not only meet the requirements of Article 88 (2) GDPR but also fully comply with the other provisions of the GDPR.

In its response (judgment of 19 December 2024 – C-65/23), the CJEU clarified that works agreements must comply with all legal requirements and limitations set out in the GDPR (namely Articles 5, 6 (1), and 9 (1) and (2) GDPR) and that they are subject to full judicial review.

Decision

The claimant’s appeal before the Federal Labour Court was partially successful. The claimant is entitled to compensation from the defendant in the amount of € 200.00 pursuant to Article 82 (1) GDPR.

Insofar as the defendant transferred personal data not covered by the works agreement to the group’s parent company, this was not necessary within the meaning of Article 6 (1)(f) GDPR. The corresponding data transmission thus violated the GDPR.

This violation also justified a claim for damages by the claimant, as the transfer of personal data to the group’s parent company resulted in a loss of control.

However, the Federal Labour Court did not have to examine whether the works agreement itself complied with the requirements of the GDPR as outlined by the CJEU. The claimant clarified during the oral hearing before the Federal Labour Court that he was not asserting a violation on that basis.

Practical note

The rulings by the CJEU and the Federal Labour Court demonstrate two key points:

First, the CJEU’s decision has a significant impact on works agreements as an independent legal basis for the processing of personal data. While such agreements may still serve as a legal basis for data processing, their existence is not a “free pass” for processing: works agreements themselves must comply with the provisions of the GDPR. In other words, concluding a works agreement does not permit any reduction of the GDPR's level of protection to the detriment of employees.

Second, the Federal Labour Court ’s decision shows that when a works agreement serves as the basis for processing personal data, the actual data processing must remain within the boundaries established by that agreement.

If employers do not comply with these requirements, they expose themselves to the risk of claims for damages and regulatory fines.