German Court Lowers Bar for Data Privacy Payouts in Hiring Blunders
Published on 07/27/2026 at 16:32 | Redaktion boerse-global.de
Germany’s highest civil court has ruled that even minor data protection slip-ups during job recruitment can trigger compensation claims, tightening the screws on employers handling sensitive applicant information.
The Federal Court of Justice (BGH) in Karlsruhe issued the decision on July 27, 2026, under case number VI ZR 97/22. The ruling clarifies that companies face financial liability for inadvertent data breaches in hiring processes—regardless of how trivial the mistake might seem.
A Misrouted Salary Offer Sparks Legal Battle
The case originated in a bank’s human resources department. An employee sent a job offer with a salary of 80,000 euros via email, but the message accidentally went to an uninvolved third party instead of the intended recipient.
The job applicant argued that this misdirection of sensitive financial data violated his personality rights and breached the General Data Protection Regulation (GDPR). He sued for compensation for non-material damages.
Lower courts had previously dismissed such minor infractions as insufficient to warrant payouts. The BGH has now overturned that approach, aligning German jurisprudence with European standards.
Data breaches in recruitment are not just a GDPR concern—they also highlight the need for robust data-handling processes across all areas of your business. A free Health & Safety Toolkit includes risk assessment templates and checklists that help you manage information securely alongside workplace hazards. Download the free Health & Safety Toolkit
European Court Guidance Reshapes National Rules
In its reasoning, the BGH leaned heavily on a landmark ruling from the European Court of Justice (ECJ) dated September 4, 2025. The ECJ had established that no threshold of severity exists for compensation claims under the GDPR.
According to the European judges, a mere violation of data protection rules suffices—as long as some damage results, even if subjectively minor. The BGH’s confirmation means companies must now account for liability risks stemming from administrative errors in recruitment.
Frankfurt Appeals Court to Set Specific Amount
While the BGH affirmed the principle of liability, the case is not fully resolved. It has been sent back to the Higher Regional Court (OLG) in Frankfurt, which must determine the exact compensation amount for the plaintiff based on the Karlsruhe guidelines.
For businesses and HR departments, the ruling tightens due diligence obligations. Experts stress that technical and organizational safeguards for data transfers in applicant management must become top priorities. Since the degree of harm no longer determines whether a claim exists, even small communication errors could spark a wave of lawsuits. The decision reinforces that personal data protection in employment law carries significant weight, with violations now facing consistent penalties.
Strengthening your compliance framework doesn't stop at data protection—your health and safety obligations are equally critical. A free toolkit aligned with the Health & Safety at Work Act 1974 provides 9 ready-to-use tools, including risk assessments and director liability guides, to help you stay compliant. Get the free Health & Safety at Work Act 1974 Toolkit
Disclaimer regarding our articles: No investment advice, no buy or sell recommendation. Information on prices, companies, and markets is provided without guarantee; changes are possible at any time. Stock market transactions can lead to substantial losses. Our articles are created and reviewed in whole or in part automatically with the support of AI.
