This was decided by the Baden Baden Regional Court in the second instance in a ruling dated 24.08.2023 (Ref. 3 S 13/23).
In this case, the personal data of a customer of a company was processed privately, and thus misused and without consent.
How did that happen?
"A customer purchased a television and a wall mount from the defendant company in June 2022.
In this context, her name and address were recorded.
A few days later, she returned the wall mount and was inadvertently refunded the much higher purchase price for the television.
When the oversight was noticed in the company, an employee of the company wrote a message to the customer via her private account on a social network on the same day, drawing attention to the oversight and asking for feedback. The customer also received another message via Instagram on the same day, asking her to get in touch with the Instagram user's "boss"." (Quoted from the press release of the Baden Baden District Court)
Consequence
Well-intentioned, but unfortunately with fatal consequences.
According to the Baden Baden District Court, the GDPR correctly provides for the customer's right to information in accordance with Art. 15 para. 1 lit. c) GDPR. The right to information also applies with regard to the company's employees, who are considered recipients within the meaning of Art. 4 No. 9 GDPR, as the customer's personal data has been disclosed to them and they have processed it privately. This is because they used the personal data received on a private account on a social network.
Accordingly, the employees did not act in accordance with the company's instructions, but on their own authority. Therefore, they themselves are responsible for the processing of the personal data. The employees are therefore personally liable for the (possibly) unauthorized processing of the customer's personal data.