What is GDPR Hopping?
More and more applicants are using the recruitment process not with the intention of securing a position, but to subsequently assert data protection rights under Article 15 of the GDPR. This practice is referred to as “GDPR hopping.” The objective is usually to confront employers with claims for information disclosure and compensation.
Typical patterns include multiple identical or highly similar applications, followed by standardized information requests. Shortly thereafter, applicants often demand compensation for non-material damages—commonly referred to as “pain and suffering”—allegedly due to delayed or incomplete responses.
How Can Employers Identify GDPR Hoppers?
Common indicators include:
- Applications showing no genuine interest in the position
- Significant distance between the applicant’s residence and the workplace
- Excessive or unrealistic salary expectations
- Standardized information requests, often phrased in legal terminology
- Rapid demands for compensation or settlement payments
These patterns suggest that the applicant’s goal is not a serious application, but the generation of claims.
Typical Claims: Access, Compensation, Pain and Suffering
GDPR hoppers generally rely on two points:
- Right of access under Article 15 GDPR – aiming to identify formal errors.
- Claims for non-material damages – frequently labeled as “pain and suffering.”
Courts, however, increasingly emphasize that delayed or incomplete responses do not automatically give rise to compensation. Moreover, mere “discomfort” is insufficient—concrete and demonstrable harm must be shown.
Case Law on GDPR Hopping
Although there are no landmark rulings specifically addressing GDPR hopping, the trend in jurisprudence is clear: information requests that are evidently intended solely to generate claims may be deemed abusive. Several courts have confirmed that merely alleging a loss of control over personal data is insufficient to justify a claim for non-material damages (for example, Federal Labour Court, judgment of 20 February 2025, Ref.: 8 AZR 61/24). Further details can be found in this LTO article (in German).
How Can Employers Respond?
- Take requests seriously, but verify: Not every claim is justified.
- Monitor deadlines: Avoid unnecessary delays.
- Documentation: Carefully record procedures and communications.
- Legal context: Courts require concrete evidence of damages.
- Prevention: Establish clear processes for handling applicant data.
By following these measures, employers can avoid unnecessary payments and protracted proceedings without violating their obligations.
Support from Our Law Firm
Our firm assists employers in correctly assessing and defending against GDPR hopping. We examine whether access rights genuinely exist, whether abuse is present, and which defense strategies are appropriate. Simultaneously, we develop preventive solutions to ensure recruitment processes remain GDPR-compliant and legally secure.
