Date source: 2026-07-16
Is an Employee Automatically Compensated for GDPR Violation? Published on July 17, 2026 - Entreprendre Service Public / Direction of Legal and Administrative Information (Prime Minister)
In a ruling handed down on June 24, 2026, the Court of Cassation reminds us that a GDPR violation does not automatically entitle an employee to damages. Entreprendre Service Public explains.
Image 1 Credits: Pormezz - stock.adobe.com
In this case, an employee working at a bank is terminated. The employer accuses the employee of intentionally failing several internal phishing awareness campaigns by entering abusive remarks. The employee is also accused of manipulating the results of an internal contest, as well as installing several unauthorized software programs on their work computer.
Contesting the legitimacy of his termination, the employee brings the case to the labor court. He argues that some of the evidence presented by the employer was obtained through the processing of his personal data: titleContent, in violation of GDPR provisions, and requests compensation for the resulting harm. The labor court rules in favor of the employee on the grounds of the illegal processing of personal data under GDPR. The employer appeals to the court of appeal.
The court of appeal upholds the ruling against the employer. It considers that processing personal data without the employee's prior consent is contrary to GDPR. As a result, the employee has the right to obtain compensation from the employer.
The employer appeals to the Court of Cassation. He argues that the employee must prove the existence of a concrete, moral or material harm resulting from the processing of their personal data to obtain compensation.
The Court of Cassation takes a different position from the court of appeal. It begins by recalling that according to Article 82 paragraph 1 of GDPR, each person who has suffered moral or material harm as a result of a GDPR violation has the right to obtain compensation. Thus, the employee must be able to demonstrate that they have suffered a moral or material harm.
The evidence produced by the employer had been obtained in violation of GDPR, however, it holds that their production “was indispensable and proportional to the pursued objective.” The processing of personal data contrary to GDPR does not guarantee, by itself, the existence of a harm.
It indicates that a simple GDPR violation does not, by itself, open the right to compensation. The employer does not have to compensate the employee. It therefore remands the case to a court of appeal.
Legal Texts and References
Any operation involving personal data, including: collection, recording, organization, storage, adaptation, modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, matching or interconnection, blocking, erasure, destruction
Source: Service-Public professionals