Due to the lack of notification of an applicant, the employer did not comply with its obligation to provide information regarding the collection of personal data in accordance with Art. 14 I GDPR. The Federal Labor Court (BAG) has now conclusively confirmed the existing claim for compensation under Art. 82 (1) GDPR in the amount of €1,000 against the University of Düsseldorf. However, there are no further claims. The BAG also confirmed the legality of the rejection for the position in the legal department (BAG, judgment of June 5, 2025, Ref.: 8 AZR 117/24).

Background

During the application process, an employee of the University of Düsseldorf googled the plaintiff and became aware of several ongoing criminal proceedings against the applicant for (attempted) fraud. The plaintiff had pretended to have applied for various positions and subsequently asserted claims for compensation under the General Equal Treatment Act (AGG) with reference to his severe disability due to the rejections he had received (so-called AGG hopping).

Following the interview for the position of legal advisor, the plaintiff also wanted to assert claims for compensation against the University of Düsseldorf under the AGG due to the rejection. In his opinion, his competitor should not have been hired despite her better exam grades due to her younger age. In addition, the plaintiff questioned the legality of the application procedure with regard to the Google search carried out by the employee of the University of Düsseldorf. The information regarding the ongoing criminal proceedings against him should not have been used as the basis for the application process, especially as there was no final conviction by the Munich Regional Court. In any case, the data collection process should not have been carried out without informing the applicant in advance. Due to the lack of notification, there were therefore violations of the GDPR, which could justify a corresponding claim for damages.

Requirements for an admissible internet search

In principle, googling applicants is permissible if this is considered necessary pursuant to Art. 6 para. 1 lit. b) GDPR, for example in order to better check the suitability of applicants for the position offered. In this context, the court stated that the plaintiff had provided concrete evidence for an in-depth search based on his own conduct. In the public sector in particular, this was already necessary on the basis of Article 33 (2) of the Basic Law in order to be able to adequately assess the applicant’s ability and suitability for a position in the public sector.

According to the Regional Labor Court (LAG), however, this does not change the fact that the applicant should have been informed about the data collection process (LAG Düsseldorf, judgment of April 10, 2024, Ref.: 12 Sa 1007/23). Art. 14 GDPR is intended to ensure transparent data processing so that the data subject is aware of the data collected about them and can weigh up the corresponding risks and effects.

Transparency in online searches

The BAG confirmed that the plaintiff had become the object of data processing through the Google search. In particular, the plaintiff should have been informed that the University of Düsseldorf had become aware of this information as a result of its research, due to the fact that the conviction had not yet become final. The resulting assumption of lack of suitability in relation to the advertised position was not transparently communicated to the applicant. The BAG therefore also affirmed that the data collection had a negative impact on the ongoing application process and thus caused damage. The loss of control of the collected data therefore constitutes damage that is also causally based on the breach of the duty to inform under Art. 14 para. 1 GDPR. However, the BAG denied a higher claim for damages and found the € 1,000 already set by the LAG to be sufficient. When assessing the amount of the claim, it was more a question of appropriate compensation than of sanctioning the defendant.

Rejection based on the information obtained

The BAG also came to the conclusion that the appointment decision of the University of Düsseldorf had been flawless. The BAG denied that the position had been wrongly filled with the younger applicant and thus justified a claim for compensation by the plaintiff, referring to the so-called best selection in the context of filling public positions. It was also not objectionable that the University of Düsseldorf had based its decision on the information from the Google search. Due to the ongoing criminal proceedings, there were justified doubts about the character suitability of the plaintiff. In particular, the plaintiff would also have been entrusted with the handling of AGG cases as part of the advertised position, so that a conflict of interest would already exist in this regard.

You can read more about the interplay between employment law and data protection in our article Employment law meets data protection.