A German court held that the surveillance of an employee by means of a private detective gives rise to non-material damages under Article 82 GDPR , even if no further negative consequence was claimed by the data subject. The controller, an employer, hired a private detective to monitor the data subject, an employee, during a sick leave. Surveillance measures were due to the fact the controller had reasons to doubt that the data subject was actually sick. As a matter of fact, eventually the controller used the information collected in this way to fire the data subject.
The latter appealed the decision before a labour court, claiming that the decision was unlawful. They also claimed non-material damages in violation of their personality right due to the surveillance. At the outset, the court confirmed the unlawfulness of the surveillance measure.
According to the court, regardless of whether the controlled tried to base the processing on contract Article 6 1 b GDPR or legitimate interest Article 6 1 f GDPR , the requirement of necessity was not met in the present case. By choosing to monitor the data subject by means of a private detective, the controller did not adopt the less intrusive measure and also violated the principle of data minimisation. As a matter of fact, a negative consequence stemming from the violation must be proved.
At the same time, it is not necessary that such a consequence reaches a certain threshold of seriousness to be compensated. The court found that the surveillance of the data subject by means of a private detective necessarily entailed a negative consequence.
As a consequence of the surveillance, the data subject themselves became "the object of the processing" with complete loss of control over their personal data. The decision below is a machine translation of the German original.
