Current court decision on timely data disclosure under Art. 15 GDPR - how quickly must an employer respond to a request for information?

The Duisburg Labor Court has now clarified in its ruling of 03.11.2023 (Ref. 5 Ca 877/23) that employers may only extend the maximum period of one month specified in the law in special circumstances, e.g. in the case of more complex requests. In simple cases, employers must react more quickly. Specifically, information provided after a period of more than one week is no longer immediate within the meaning of Art. 12 para. 3 GDPR and is therefore late. In the case decided by the labor court, the employer only responded to a request for information from a former applicant after more than 2 weeks and therefore too late. The employer had no longer stored any of the applicant's data, meaning that a particular difficulty that could have justified a longer deadline could not be established. As a result, the court ordered the employer to pay damages in the amount of EUR 750.00.

Employers are therefore advised to take data protection requests for information seriously and to respond to them promptly - if possible within one week. Nevertheless, employers should of course ensure that the information they provide is correct. If thorough processing is not possible within one week, the person requesting the information should be informed of this within the one-week period, stating the reasons.

If part of the request can be answered within the one-week period, employers are advised to provide partial information in advance in order to avoid claims for damages. Finally, if there is any doubt about the identity of the person requesting the information, the identity check to be carried out in this case anyway can also buy additional time.