Google searches concerning job applicants have long been common practice among HR professionals. From an employment law perspective, they become particularly sensitive where a candidate’s digital footprint leads to the rejection of an application and the candidate subsequently claims compensation under Article 82(1) GDPR.
The dispute concerning a vacancy for a fully qualified lawyer at a university, which proceeded from the Düsseldorf Higher Labour Court (judgment of 10 April 2024, 12 Sa 1007/23) to the Federal Labour Court (judgment of 5 June 2025, 8 AZR 117/24), provides an almost textbook illustration of this issue. Both decisions establish a clear principle: liability under data protection law does not arise from the mere act of “Googling”, but from the relationship between the search, the duty to provide information and causation.
Article 82(1) GDPR requires three cumulative conditions: an infringement of the Regulation, damage and a causal link between the two. The Court of Justice of the European Union (judgment of 4 May 2023, C-300/21) has clarified that there is no threshold of seriousness for non-material damage and that punitive or deterrent considerations are not paramount. Rather, the right to compensation serves solely to compensate for the damage actually suffered. The Higher Labour Court and the Federal Labour Court have consistently applied these principles.
The decisive question is therefore: Which infringing act in the recruitment process actually gives rise to compensable material or non-material damage?
Google Searches Are Permissible, but Not in Secret!
The Düsseldorf Higher Labour Court makes clear that searching publicly accessible sources during the recruitment process is, in principle, permissible under data protection law (Düsseldorf Higher Labour Court, paragraphs 194 et seq.). This is based on Article 6(1), first subparagraph, point (b) GDPR: assessing a candidate’s suitability constitutes a pre-contractual measure taken at the applicant’s request and intended to prepare for the conclusion of a potential employment contract.
Where a name becomes “suspicious” in a specific context, as in the present case, where the applicant was known from criminal proceedings mentioned in a Wikipedia entry, a targeted Google search to establish suitability may be “absolutely necessary”. The Higher Labour Court expressly left open whether Googling applicants without any specific reason is legally permissible. A particular feature of the case was that the employer was a public-sector body and, as such, was required to establish and verify the applicant’s suitability (Article 33(2) of the German Basic Law). HR departments should therefore consider in advance whether Google searches should be used as a routine measure.
The focus of the legal assessment thus shifts: it is not whether a search is conducted, but how it is conducted and what happens afterwards that creates the risk. Once a search is undertaken, the employer falls squarely within the scope of the GDPR. The search constitutes the processing of personal data, for which the employer is the controller within the meaning of Article 4(7) GDPR.
The Duty to Provide Information Under Article 14 GDPR as a Liability Risk!
This is precisely where the duty to provide information under Article 14(1)(d) GDPR becomes relevant. Anyone who obtains personal data not from the data subject directly, but from third parties, as in the case of Google searches, must inform the data subject of the categories of personal data being processed. According to the Higher Labour Court, this information must be “sufficiently precise and specific” to enable the applicant to assess the risks associated with the processing.
The data subject must be informed of the existence of the processing operation and its purposes (Düsseldorf Higher Labour Court, paragraph 220). The casual remark during the interview that the applicant was “prominent” and had a Wikipedia entry was therefore insufficient. The decisive factor was not the mere existence of that entry, but the category of data being processed: a criminal conviction that had not become final.
By taking this conviction into account in its selection memorandum and recruitment decision without clearly informing the applicant of the processing, the university infringed Article 14(1)(d) GDPR. The Higher Labour Court classified this as a separate infringement directly related to the processing and awarded the applicant compensation of EUR 1,000 for the resulting loss of control over his personal data.
The applicant had become “a mere object of data processing”, and his entitlement to respect had been diminished. This constitutes the recognised head of damage under EU law arising from the “loss of control over one’s own data”.
Practical Recommendations: Transparent Google Searches
What does this mean for HR departments that do not wish to abandon Google as a source of information? The case law suggests a three-stage approach:
First, every internet search should be conducted for a specific reason and a defined purpose. The closer the connection between the information obtained and the requirements of the position, the easier it is to establish necessity within the meaning of Article 6(1)(b) GDPR. Routine, precautionary and comprehensive searches without specific grounds clearly fall within an area of legal risk. The Düsseldorf Higher Labour Court did not address this area in its decision.
Second, compliance with Article 14 GDPR is crucial. Employers who use data obtained from search engines or other third-party sources must inform applicants clearly, individually and in good time of the categories of data concerned, particularly where “sensitive” information, such as ongoing criminal proceedings or criminal convictions, is involved.
Third, the information provided must give applicants an opportunity to object, provide explanations or correct inaccuracies. Although this is not an express requirement of Article 14 GDPR, in practice it is the only way to minimise the loss of control over personal data emphasised by the Court of Justice of the European Union.
Employers who follow these recommendations significantly reduce the risk of claims for compensation for non-material damage under Article 82 GDPR. Google searches therefore remain permissible, but only as part of a transparent, documented and legally considered recruitment process.
Our lawyers at SPIEKER & JAEGER are available to provide expert legal assistance. Please do not hesitate to contact us.