A German ruling shows that employers who google applicants without prior notice risk damages under the GDPR.


A quick Google search can get expensive for employers in Germany. In April 2024, the Regional Labor Court (LAG) Düsseldorf ordered a university to pay 1,000 euros in damages after it researched a job applicant online without telling him (case no. 12 Sa 1007/23). The reason was a failure to meet the GDPR's information duties.

What happened

Before making its hiring decision, the university had googled the applicant and found a Wikipedia entry referencing a criminal conviction. That information influenced the decision, and the applicant was never told beforehand.


The court ruled this a clear breach of the information duties under Articles 13 and 14 GDPR and awarded 1,000 euros in damages under Article 82 GDPR.

Why this matters for employers in Germany

Simply pointing to a source found online is not enough. Applicants must be informed precisely enough to assess the risks of the data being processed.


That applies just as much to a quick Google search as it does to structured background checks involving criminal record extracts, education verification, or sanctions list screening.

The two most common mistakes

The first mistake is informing applicants only after making an offer, or worse, only after rejecting them. The second is relying on a blanket clause in the application form to cover the information duty. According to the court, neither is enough.

How to get it right

Swiss provider Validato has built prior notification directly into its screening process. Before any check begins, applicants receive a clear overview of the planned modules, sources, and purpose, and only then give documented, electronic consent.


For German companies in regulated sectors such as financial services, critical infrastructure, or IT, the ruling sends a clear signal: background checks must not only be factually accurate, they must also be procedurally transparent.