If a federal authority transfers its employees„ personnel files to state employees, this can lead to a “loss of control" over personal data and give rise to a claim for damages under Art. 82 GDPR. This was decided by the Federal Court of Justice (BGH) (Ref.: VI ZR 365/22 of 11 February 2025).

All processes and data relating to the civil servant relationship are recorded in the civil servant's personnel file. It is not uncommon for employers to transfer the management of personnel files to another organisation, for example in the case of an assignment or secondment.) In doing so, the employer remains bound by the data protection regulations and must rule out legal uncertainties for the employees concerned and the employees entrusted with file management. The employer must guarantee not only the principles of personnel file law, such as the truthfulness and completeness of the personnel file, but above all the necessary integrity and confidentiality. Only data protection-compliant personnel file management can prevent potential claims for damages from arising.

In the case decided by the BGH, a federal civil servant working at the Federal Institute for Geosciences and Natural Resources sued for non-material damages because her personnel file was not managed and administered by federal employees but by the state of Lower Saxony. In contrast to previous instances at the Regional Court of Hanover and the Higher Regional Court of Celle, the BGH ruled in favour of the civil servant and affirmed non-material damages due to the transfer of the personnel file to state employees and the plaintiff's loss of control over her personal data stored in her personnel file.“ This file management by state employees was not covered by § 111a para. 1 BBG a.F. in conjunction with § 26 BDSG, Art. § Section 26 BDSG, Art. 88 GDPR and violates Art. 5 para. 1 lit. a) GDPR and Art. 28 GDPR.

„With this landmark judgement, the Federal Court of Justice has further lowered the requirements for an immaterial claim for damages,“ says lawyer Zeynep Kenar. „Even the loss of control over personal data can be sufficient to justify an immaterial claim for damages, without the need for a specific violation of the general right of personality or a serious impairment.“