Real employee data inside the test system: what loss of control is worth

The case

A German employer, part of a group whose parent company sits in the United States, prepares the move to a single cloud HR system. Between 24 April and 18 May 2017 it uploads employee data from its own HR software to a parent-company area, in order to feed the new system for testing. On 3 July 2017 it signs a tolerance agreement with the works council listing exactly which fields may be transferred for test purposes: staff number, surname, first name, hire date, group entry date, place of work, company, business phone and business e-mail. Nine items. What was actually transferred also included salary, home address, date of birth, marital status, social security number and tax ID.

Testing with real data is not forbidden

"Processing personal data in order to test new HR software may be justified by the employer's legitimate interests under Article 6(1), first subparagraph, point (f), provided that depersonalised "dummy data" are not sufficient to achieve the test purpose."

This is the point almost every report skipped. The court did not say real data in a test environment are prohibited: it said the excess was not necessary. And it drew that from the agreement itself: if the parties settled on nine fields being enough to test, they wrote down that the tenth was not needed. The employer had already ruled out its own necessity argument.

Two hundred euro, and how they were calculated

Article 82 requires three cumulative conditions: an infringement, damage — including non-material damage — and a causal link between them. Here the damage is the loss of control over the data, which counts even when brief, provided the data subject proves it. The amount reflected the sensitivity of the data — below the Article 9 threshold — the circle of recipients, wider but confined to the group, and how long the loss of control lasted. The gravity of fault did not count: Article 82 has a compensatory function, and the court ruled out any increase for intent.

A delayed access reply, by contrast, pays nothing

In its judgment of 20 February 2025 (8 AZR 61/24) the same chamber rejected a claim based on a late Article 15 reply: the delay does not in itself produce a loss of control, only a postponement of the information. Discomfort or a negative emotional state are not enough; what is required is a concrete fear of misuse that a court can review. This is a distinction worth explaining to clients before the first request arrives: the right of access remains fully enforceable and authorities do sanction it — the Norwegian decision from January shows that clearly — but individual compensation runs on a different and narrower track.

A works agreement does not lower the GDPR floor

This part travels well beyond Germany, wherever collective agreements shape the processing of employee data. The court left section 26(1) of the German Federal Data Protection Act unapplied because it does not satisfy Article 88: a national employment rule counts as a more specific provision only if it adds suitable and specific measures safeguarding human dignity and fundamental rights, not if it repeats the Regulation. Failing that, processing in the employment context is governed directly by the GDPR.