Workday test with real data: 200 euros in damages

Software testing with real HR data

New HR software has to be tested before it goes live. The most convenient way to do that is with data that is already there: the real data of the workforce. One company took this route in 2017, and the Federal Labour Court (BAG) awarded damages for it in a judgment of 8 May 2025 (8 AZR 209/21). The sum of 200 euros is modest. The reasoning is worth reading for every HR department currently introducing a cloud solution.

The case: a group of companies planned to introduce the cloud-based software Workday as a uniform system for HR administration. For this purpose, a German group company transferred personal data of its employees from the existing HR software to the parent company in the USA. Workday was populated with this data for testing purposes. The claimant, an organisational programmer and chair of the works council, was one of those affected.

What the works agreement allowed

The provisional test operation was governed by a works agreement, that is, an agreement between employer and works council. The agreement permitted the transfer of certain data, including name, start date, place of work, company, and business telephone number and email address.

The employer transferred considerably more: salary information, the private home address, the date of birth, marital status, the social security number and the tax ID. The claimant therefore demanded 3,000 euros in compensation for his non-material damage. His argument: the employer had exceeded the limits of the works agreement.

The labour court and the regional labour court dismissed the claim. In 2022, the Federal Labour Court stayed the proceedings and referred questions on the interpretation of EU law to the European Court of Justice. The ECJ answered them in a judgment of 19 December 2024 (C-65/23). The claimant's appeal was partly successful.

Damages under Art. 82 GDPR

The basis of the claim is Art. 82(1) of the General Data Protection Regulation (GDPR). Anyone who suffers damage as a result of an infringement of the GDPR can claim compensation from the controller. This also applies to non-material damage, that is, a disadvantage that cannot be quantified in money. Three things have to come together: an infringement, damage, and a connection between the two.

For the BAG, the infringement was obvious. Employer and works council had limited the permission to a list of data categories. The court concluded from this that only these data were necessary for the test. The employer did not itself claim that it had needed salary, address or tax ID for the test. The excess transfer was therefore not necessary and infringed the GDPR.

The employer could not rely on the general German provision on employee data protection. The BAG disapplied it because it lacks the safeguards that the GDPR requires for such national special rules.

Loss of control and the 200 euros

According to the BAG, the damage lies in the loss of control. Anyone who finds their data at another group company without any permission covering it has lost control over it. That is enough, even if the loss is brief and the damage slight. The person affected only has to prove that they suffered this loss of control.

The timeline is remarkable. The data flowed as early as 2017, while the GDPR has only applied since 25 May 2018. But the employer remained the controller for the data in Workday afterwards as well. It made no effort to have the data transferred back or deleted, and neither happened. Anyone who uploads test data once and then forgets about it continues to process it.

The claimant wanted 3,000 euros; he received 200 euros plus interest. In setting the amount, the BAG took three circumstances into account: the sensitivity of the data, the wider circle of recipients, which was nevertheless confined to the group, and the duration of the loss of control. Specially protected data such as health data were not involved.

The fact that the data went to the USA played no role in the amount. Nor did it matter whether the infringement was intentional. The claim is meant to compensate the damage, not to punish the employer. In the senate's view, 200 euros were necessary, but also sufficient.

What the judgment means for companies

The first message is reassuring. The BAG does not rule out tests with real data. Such tests can be justified by the employer's legitimate interest where depersonalised dummy data is not sufficient for the purpose of the test. Anyone wanting to use real data therefore needs an answer as to why made-up test data will not do. And they may only transfer the categories of data that the test genuinely requires.

The second message concerns the works agreement. In the judgment, it became the benchmark for which data were necessary. Anyone who agrees a list of data categories with the works council is bound by it. Any transfer going beyond that is an infringement for that reason alone. Works agreement and data flow must therefore match, field by field. Before exporting from the legacy system, someone should compare the export fields with the list in the agreement. For works councils, the decision is an argument for listing the data categories precisely in agreements on IT systems. It was exactly this list that gave the claimant his claim.

Third, responsibility does not end with the upload. The employer remains the controller, even if the data sits with the parent company in the USA and several bodies jointly determine purposes and means. As long as the data remains in the test system, the loss of control continues. A test operation therefore needs a fixed end date and a date for deletion.

What the BAG left open

The BAG did not examine whether the works agreement itself met the requirements of the GDPR. At the oral hearing, the claimant had made clear that he was no longer challenging the transfer of the permitted data. The judgment therefore does not answer when a works agreement is sufficient as a legal basis for processing employee data. The works council's signature alone is thus no guarantee that a test is lawful.