BGH - VI ZR 97/22
German court awards damages for GDPR violation in job application data leak.
Germany's Federal Court of Justice ruled that a job applicant is entitled to non-material damages after their personal data, including salary expectations, was mistakenly disclosed to a third party by a bank. The court confirmed the disclosure was unlawful under GDPR and that the applicant's concern over data misuse constituted sufficient damage, referring the case back to determine the exact compensation amount.
AI summary of the linked source. Not reviewed by an editor. How this works
Run BGH?
Get an email when a new story names BGH, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA German bank mistakenly disclosed a job applicant's personal data — including sensitive salary expectations — to an unauthorized third party, violating GDPR's core principles of data minimization and accuracy. Germany's Federal Court of Justice (BGH) confirmed that even the applicant's subjective concern about potential misuse of their data constitutes sufficient 'non-material damage' to warrant compensation under GDPR Article 82. This ruling reinforces that organizations cannot treat accidental disclosures as harmless administrative errors — any unauthorized sharing of personal data carries real legal and financial consequences. The case highlights how internal data handling workflows, particularly during recruitment processes, must be tightly controlled to prevent misdirected communications.