German Court Ruling Tightens Data-Leak Compensation Rules as Government Unveils Labour Overhaul

A bank that accidentally leaked a job applicant’s salary details through the professional network Xing now faces a damages claim after Germany’s highest civil court ruled that losing control over personal data can be enough to trigger compensation — even without proof of tangible harm.

The Federal Court of Justice (BGH) decision on June 23, 2026 (case reference VI ZR 97/22) clarified that individuals can seek non-material damages under the EU’s General Data Protection Regulation if they have a justified fear that leaked information could be misused. The ruling aligns with European Court of Justice precedent, which recognises that negative emotions such as anxiety can constitute a compensable injury. However, a mere procedural violation of the GDPR without any demonstrable consequences does not qualify. The BGH sent the case back to the Higher Regional Court of Frankfurt to determine the exact compensation amount.

The stakes for employers are rising. On December 18, 2025, the Higher Regional Court of Celle raised a fine against a company from €700,000 to €900,000 for installing more than 80 cameras across sales floors and break rooms, storing footage for up to 60 days. The court stressed that European data protection authorities’ guidelines must be used when calculating penalties, adding that no grace period exists for GDPR compliance.

Private detective surveillance of sick employees also faces strict limits. A Spanish labour court in A Coruña annulled the dismissal of a woman who had suffered a stroke and was then monitored by her employer. Filming her routine activities like grocery shopping did not prove she was fit for work. In Germany, the Federal Labour Court (case 8 AZR 225/23) permits such surveillance only when there is a concrete suspicion of a serious breach of duty — and only as the least intrusive measure available.

Coalition’s ‘Upswing’ Package Targets AI, Fixed-Term Contracts

On July 2, 2026, the CDU/CSU and SPD presented their reform package “Upswing and Employment.” A key provision would allow fixed-term contracts without a specific reason for up to 48 months, valid through the end of 2030. Starting January 1, 2027, the written-form requirement for such contracts would be abolished.

For companies adopting digital tools, the package strengthens works council co-determination rights when deploying artificial intelligence systems. Legal experts advise negotiating framework company agreements to ensure compliance with both the EU AI Act and data protection rules.

Messaging, WhatsApp Jokes, and the Limits of Employer Control

When employees use tools like Microsoft Teams or Slack, employers can ban private use outright. If a ban is in place, monitoring is permissible as long as it is transparent. Where private use is allowed, surveillance is only justified in exceptional cases — such as a concrete suspicion of a criminal offence — and must involve the company’s data protection officer.

Even posting shift schedules has rules: Names and working hours are acceptable, but details about illnesses, absences, or reasons for leave must not be displayed publicly. Digital schedules require password protection.

A case from the Schleswig-Holstein Regional Labour Court (case 1 Sa 104/25) on August 19, 2025, showed that a WhatsApp joke about a colleague shared within a closed group does not justify immediate dismissal — as long as it had no significant external impact. A written warning is considered the more proportionate response.

en | boerse | 69841125 |