This page has been automatically translated. Please refer to the page in French if needed.
Labor law
GDPR violation: is the employee systematically compensated?
Publié le 17 juillet 2026 - Entreprendre Service Public / (Prime Minister)
In a judgment delivered on 24 June 2026, the Cour de cassation recalls that a violation of the GDPR does not automatically lead to the award of damages to the employee. Undertake Public Service explains.
In this case, an employee employed in a bank is dismissed. The employer accused him of willfully failing several internal phishing awareness campaigns by seizing abusive comments. He is also accused of having manipulated the results of an internal competition, as well as of having installed on his workstation several unauthorized software programs.
Contesting the legitimacy of his dismissal, the employee refers the matter to the labor court. He argues that some of the evidence produced by the employer was obtained through a processing of personal data, in breach of the provisions of the GDPR (General Data Protection Regulation), and therefore seeks compensation for the damage suffered. The Labor Court condemns the employer for the processing of personal data contrary to the GDPR. The latter goes before the Court of Appeal.
The Court of Appeal upheld the employer's conviction. It considers that the processing of personal data without the prior consent of the employee is contrary to the GDPR. As a result, the employee is entitled to compensation from his employer.
The employer refers the matter to the Court of Cassation. He argues that the employee must prove the existence of a concrete, moral or material damage, arising from the processing of his personal data in order to obtain compensation.
The Court of Cassation takes a different position from that of the Court of Appeal. It begins by recalling that according to Article 82(1) of the GDPR, every person who has suffered moral or material damage in violation of the GDPR has the right to obtain compensation. Thus, the employee must be able to demonstrate that he has suffered moral or material damage.
The evidence produced by the employer had been obtained in breach of the GDPR, however, it holds that their production « was indispensable and proportionate to the objective pursued ». The processing of personal data contrary to the GDPR does not guarantee, on its own, the existence of harm.
It states that the mere breach of the GDPR does not, in itself, entitle the applicant to compensation. The employer does not have to compensate the employee. It therefore refers the case to a court of appeal.