{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-65-23","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-65-23)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-14","fingerprint":"ewai:eu:f8b9a4","proof":"sha256:05090879c8df74c67a0fb235a4f6ffa12c653cd1a8cf17aee4d85e16651022d7","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-65-23","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62023CJ0065","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Eighth Chamber)","paragraphs":[]},{"title":"19 December 2024 (\n *1\n )","paragraphs":["para_4","para_5","para_6"]},{"title":"MK","paragraphs":["para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26","para_27"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_30"]},{"title":"2","paragraphs":["para_32"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"3","paragraphs":[]},{"title":"Recitals 8, 10 and 155 of the GDPR are worded as follows:","paragraphs":["para_37","para_38","para_39"]},{"title":"(10)","paragraphs":["para_41","para_42"]},{"title":"(155)","paragraphs":["para_44"]},{"title":"4","paragraphs":[]},{"title":"Article 4 of that regulation, entitled ‘Definitions’, provides:","paragraphs":["para_47"]},{"title":"(1)","paragraphs":["para_49"]},{"title":"(2)","paragraphs":["para_51","para_52"]},{"title":"(7)","paragraphs":["para_54","para_55"]},{"title":"5","paragraphs":["para_57"]},{"title":"6","paragraphs":["para_59","para_60","para_61"]},{"title":"(c)","paragraphs":["para_63","para_64"]},{"title":"(f)","paragraphs":["para_66","para_67"]},{"title":"7","paragraphs":[]},{"title":"Article 6 of the GDPR, entitled ‘Lawfulness of processing’, provides:","paragraphs":["para_70"]},{"title":"(a)","paragraphs":["para_72"]},{"title":"(b)","paragraphs":["para_74"]},{"title":"(c)","paragraphs":["para_76"]},{"title":"(d)","paragraphs":["para_78"]},{"title":"(e)","paragraphs":["para_80"]},{"title":"(f)","paragraphs":["para_82","para_83","para_84","para_85"]},{"title":"(a)","paragraphs":[]},{"title":"Union law; or","paragraphs":[]},{"title":"(b)","paragraphs":["para_89","para_90","para_91"]},{"title":"8","paragraphs":["para_93","para_94"]},{"title":"2.   Paragraph 1 shall not apply if one of the following applies:","paragraphs":[]},{"title":"(a)","paragraphs":["para_97"]},{"title":"(b)","paragraphs":["para_99","para_100"]},{"title":"9","paragraphs":["para_102","para_103"]},{"title":"10","paragraphs":["para_105","para_106","para_107"]},{"title":"11","paragraphs":[]},{"title":"Article 99 of the GDPR, entitled ‘Entry into force and application’, is worded as follows:","paragraphs":["para_110"]},{"title":"2.   It shall apply from 25 May 2018.’","paragraphs":[]},{"title":"German law","paragraphs":[]},{"title":"12","paragraphs":["para_114","para_115","para_116","para_117"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"13","paragraphs":["para_120"]},{"title":"14","paragraphs":["para_122"]},{"title":"15","paragraphs":["para_124"]},{"title":"16","paragraphs":["para_126"]},{"title":"17","paragraphs":["para_128"]},{"title":"18","paragraphs":["para_130"]},{"title":"19","paragraphs":["para_132"]},{"title":"20","paragraphs":["para_134"]},{"title":"21","paragraphs":["para_136"]},{"title":"22","paragraphs":["para_138"]},{"title":"23","paragraphs":["para_140"]},{"title":"24","paragraphs":["para_142"]},{"title":"25","paragraphs":["para_144"]},{"title":"26","paragraphs":["para_146","para_147","para_148"]},{"title":"(2)","paragraphs":[]},{"title":"If the answer to Question 1 is in the affirmative:","paragraphs":["para_151"]},{"title":"(3)","paragraphs":[]},{"title":"If the answer to Question 2 is in the affirmative:","paragraphs":[]},{"title":"In such a case, to what is the judicial review to be limited?","paragraphs":[]},{"title":"(4)","paragraphs":["para_156"]},{"title":"(5)","paragraphs":["para_158"]},{"title":"(6)","paragraphs":["para_160"]},{"title":"Procedure before the Court","paragraphs":[]},{"title":"27","paragraphs":["para_163"]},{"title":"28","paragraphs":["para_165"]},{"title":"29","paragraphs":["para_167"]},{"title":"Admissibility of the request for a preliminary ruling","paragraphs":[]},{"title":"30","paragraphs":["para_170"]},{"title":"31","paragraphs":["para_172"]},{"title":"32","paragraphs":["para_174"]},{"title":"33","paragraphs":["para_176"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"The first question","paragraphs":[]},{"title":"34","paragraphs":["para_180"]},{"title":"35","paragraphs":["para_182"]},{"title":"36","paragraphs":["para_184"]},{"title":"37","paragraphs":["para_186"]},{"title":"38","paragraphs":["para_188"]},{"title":"39","paragraphs":["para_190"]},{"title":"40","paragraphs":["para_192"]},{"title":"41","paragraphs":["para_194"]},{"title":"42","paragraphs":["para_196"]},{"title":"43","paragraphs":["para_198"]},{"title":"44","paragraphs":["para_200"]},{"title":"45","paragraphs":["para_202"]},{"title":"46","paragraphs":["para_204"]},{"title":"47","paragraphs":["para_206"]},{"title":"48","paragraphs":["para_208"]},{"title":"49","paragraphs":["para_210"]},{"title":"50","paragraphs":["para_212"]},{"title":"The second question","paragraphs":[]},{"title":"51","paragraphs":["para_215"]},{"title":"52","paragraphs":["para_217"]},{"title":"53","paragraphs":["para_219"]},{"title":"54","paragraphs":["para_221"]},{"title":"55","paragraphs":["para_223"]},{"title":"56","paragraphs":["para_225"]},{"title":"57","paragraphs":["para_227"]},{"title":"58","paragraphs":["para_229"]},{"title":"59","paragraphs":["para_231"]},{"title":"60","paragraphs":["para_233"]},{"title":"The third question","paragraphs":[]},{"title":"61","paragraphs":["para_236"]},{"title":"Costs","paragraphs":[]},{"title":"62","paragraphs":["para_239"]},{"title":"On those grounds, the Court (Eighth Chamber) hereby rules:","paragraphs":["para_241","para_242","para_243","para_244"]},{"title":"Article 88(1) of Regulation 2016/679","paragraphs":["para_246","para_247","para_248"]}],"paragraphs":[{"text":"62023CJ0065","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Eighth Chamber)","paragraph_id":"para_2"},{"text":"19 December 2024 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 88(1) and (2) – Processing in the context of employment – Employees’ personal data – More specific rules provided for by a Member State pursuant to …","paragraph_id":"para_4"},{"text":"In Case C‑65/23,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Bundesarbeitsgericht (Federal Labour Court, Germany), made by decision of 22 September 2022, received at the Court on 8 February 2023, in the proceedings","paragraph_id":"para_6"},{"text":"MK","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"K GmbH,","paragraph_id":"para_9"},{"text":"THE COURT (Eighth Chamber),","paragraph_id":"para_10"},{"text":"composed of N. Jääskinen (Rapporteur), President of the Ninth Chamber, acting as President of the Eighth Chamber, M. Gavalec and I. Ziemele, Judges,","paragraph_id":"para_11"},{"text":"Advocate General: L. Medina,","paragraph_id":"para_12"},{"text":"Registrar: A. Calot Escobar,","paragraph_id":"para_13"},{"text":"having regard to the written procedure,","paragraph_id":"para_14"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_15"},{"text":"–","paragraph_id":"para_16"},{"text":"MK, by J. Zäh, Rechtsanwalt,","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"K GmbH, by B. Geck, Rechtsanwältin,","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"Ireland, by M. Browne, Chief State Solicitor, A. Joyce and M. Tierney, acting as Agents, and by D. Fennelly, Barrister-at-Law,","paragraph_id":"para_21"},{"text":"–","paragraph_id":"para_22"},{"text":"the Italian Government, by G. Palmieri, acting as Agent, and by G. Natale, avvocato dello Stato,","paragraph_id":"para_23"},{"text":"–","paragraph_id":"para_24"},{"text":"the European Commission, by A. Bouchagiar, M. Heller and H. Kranenborg, acting as Agents,","paragraph_id":"para_25"},{"text":"having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,","paragraph_id":"para_26"},{"text":"gives the following","paragraph_id":"para_27"},{"text":"Judgment","paragraph_id":"para_28"},{"text":"1","paragraph_id":"para_29"},{"text":"This request for a preliminary ruling concerns the interpretation of Article 82(1) and of Article 88(1) and (2), read in conjunction with Article 5, Article 6(1) and Article 9(1) and (2), of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of …","paragraph_id":"para_30"},{"text":"2","paragraph_id":"para_31"},{"text":"The request has been made in proceedings between MK, a natural person, and K GmbH, his employer, concerning compensation for the non-material damage which that person claims to have suffered on account of the processing of his personal data by that company on the basis of a works agreement.","paragraph_id":"para_32"},{"text":"Legal context","paragraph_id":"para_33"},{"text":"European Union law","paragraph_id":"para_34"},{"text":"3","paragraph_id":"para_35"},{"text":"Recitals 8, 10 and 155 of the GDPR are worded as follows:","paragraph_id":"para_36"},{"text":"‘(8)","paragraph_id":"para_37"},{"text":"Where this Regulation provides for specifications or restrictions of its rules by Member State law, Member States may, as far as necessary for coherence and for making the national provisions comprehensible to the persons to whom they apply, incorporate elements of this Regulation into their national law.","paragraph_id":"para_38"},{"text":"…","paragraph_id":"para_39"},{"text":"(10)","paragraph_id":"para_40"},{"text":"In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the [European] Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in …","paragraph_id":"para_41"},{"text":"…","paragraph_id":"para_42"},{"text":"(155)","paragraph_id":"para_43"},{"text":"Member State law or collective agreements, including ‘works agreements’, may provide for specific rules on the processing of employees’ personal data in the employment context, in particular for the conditions under which personal data in the employment context may be processed on the basis of the c …","paragraph_id":"para_44"},{"text":"4","paragraph_id":"para_45"},{"text":"Article 4 of that regulation, entitled ‘Definitions’, provides:","paragraph_id":"para_46"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_47"},{"text":"(1)","paragraph_id":"para_48"},{"text":"“personal data” means any information relating to an identified or identifiable natural person (“data subject”); …","paragraph_id":"para_49"},{"text":"(2)","paragraph_id":"para_50"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means …","paragraph_id":"para_51"},{"text":"…","paragraph_id":"para_52"},{"text":"(7)","paragraph_id":"para_53"},{"text":"“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; …","paragraph_id":"para_54"},{"text":"…’","paragraph_id":"para_55"},{"text":"5","paragraph_id":"para_56"},{"text":"Chapter II of the GDPR, entitled ‘Principles’, comprises Articles 5 to 11 of that regulation.","paragraph_id":"para_57"},{"text":"6","paragraph_id":"para_58"},{"text":"Article 5 of that regulation, entitled ‘Principles relating to processing of personal data’, provides:","paragraph_id":"para_59"},{"text":"‘1.   Personal data shall be:","paragraph_id":"para_60"},{"text":"…","paragraph_id":"para_61"},{"text":"(c)","paragraph_id":"para_62"},{"text":"adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);","paragraph_id":"para_63"},{"text":"…","paragraph_id":"para_64"},{"text":"(f)","paragraph_id":"para_65"},{"text":"processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).","paragraph_id":"para_66"},{"text":"2.   The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’","paragraph_id":"para_67"},{"text":"7","paragraph_id":"para_68"},{"text":"Article 6 of the GDPR, entitled ‘Lawfulness of processing’, provides:","paragraph_id":"para_69"},{"text":"‘1.   Processing shall be lawful only if and to the extent that at least one of the following applies:","paragraph_id":"para_70"},{"text":"(a)","paragraph_id":"para_71"},{"text":"the data subject has given consent to the processing of his or her personal data for one or more specific purposes;","paragraph_id":"para_72"},{"text":"(b)","paragraph_id":"para_73"},{"text":"processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;","paragraph_id":"para_74"},{"text":"(c)","paragraph_id":"para_75"},{"text":"processing is necessary for compliance with a legal obligation to which the controller is subject;","paragraph_id":"para_76"},{"text":"(d)","paragraph_id":"para_77"},{"text":"processing is necessary in order to protect the vital interests of the data subject or of another natural person;","paragraph_id":"para_78"},{"text":"(e)","paragraph_id":"para_79"},{"text":"processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;","paragraph_id":"para_80"},{"text":"(f)","paragraph_id":"para_81"},{"text":"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.","paragraph_id":"para_82"},{"text":"Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.","paragraph_id":"para_83"},{"text":"2.   Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.","paragraph_id":"para_84"},{"text":"3.   The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:","paragraph_id":"para_85"},{"text":"(a)","paragraph_id":"para_86"},{"text":"Union law; or","paragraph_id":"para_87"},{"text":"(b)","paragraph_id":"para_88"},{"text":"Member State law to which the controller is subject.","paragraph_id":"para_89"},{"text":"… That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, a …","paragraph_id":"para_90"},{"text":"…’","paragraph_id":"para_91"},{"text":"8","paragraph_id":"para_92"},{"text":"Article 9 of that regulation, entitled ‘Processing of special categories of personal data’, is worded as follows:","paragraph_id":"para_93"},{"text":"‘1.   Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.","paragraph_id":"para_94"},{"text":"2.   Paragraph 1 shall not apply if one of the following applies:","paragraph_id":"para_95"},{"text":"(a)","paragraph_id":"para_96"},{"text":"the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;","paragraph_id":"para_97"},{"text":"(b)","paragraph_id":"para_98"},{"text":"processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;","paragraph_id":"para_99"},{"text":"…’","paragraph_id":"para_100"},{"text":"9","paragraph_id":"para_101"},{"text":"In Chapter VIII of the GDPR, entitled ‘Remedies, liability and penalties’, Article 82 of that regulation, itself entitled ‘Right to compensation and liability’, provides, in paragraph 1:","paragraph_id":"para_102"},{"text":"‘Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.’","paragraph_id":"para_103"},{"text":"10","paragraph_id":"para_104"},{"text":"In Chapter IX of the GDPR, entitled ‘Provisions relating to specific processing situations’, Article 88 of that regulation, itself entitled ‘Processing in the context of employment’, provides, in paragraphs 1 and 2:","paragraph_id":"para_105"},{"text":"‘1.   Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context, in particular for the purposes of the recruitment, the performance of t …","paragraph_id":"para_106"},{"text":"2.   Those rules shall include suitable and specific measures to safeguard the data subject’s human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.’","paragraph_id":"para_107"},{"text":"11","paragraph_id":"para_108"},{"text":"Article 99 of the GDPR, entitled ‘Entry into force and application’, is worded as follows:","paragraph_id":"para_109"},{"text":"‘1.   This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .","paragraph_id":"para_110"},{"text":"2.   It shall apply from 25 May 2018.’","paragraph_id":"para_111"},{"text":"German law","paragraph_id":"para_112"},{"text":"12","paragraph_id":"para_113"},{"text":"Paragraph 26 of the Bundesdatenschutzgesetz (Federal Law on data protection) of 30 June 2017 (BGBl. 2017 I, p. 2097; ‘the BDSG’), entitled ‘Data processing for the purposes of the employment relationship’, provides, in subparagraphs 1 and 4:","paragraph_id":"para_114"},{"text":"‘(1)   Employees’ personal data may be processed for the purposes of an employment relationship where this is necessary for the decision on the establishment of an employment relationship or, after the establishment of the employment relationship, for its implementation or termination or for the exe …","paragraph_id":"para_115"},{"text":"…","paragraph_id":"para_116"},{"text":"(4)   The processing of personal data, including special categories of personal data of employees, for the purposes of an employment relationship is permitted on the basis of collective agreements. In this context, the negotiating partners shall comply with Article 88(2) of [the GDPR].’","paragraph_id":"para_117"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_118"},{"text":"13","paragraph_id":"para_119"},{"text":"The applicant in the main proceedings is employed by the defendant in the main proceedings, a company governed by German law, and is chairman of the works council set up within that company.","paragraph_id":"para_120"},{"text":"14","paragraph_id":"para_121"},{"text":"Initially, that company processed certain personal data of its employees in the context of the use of software called ‘SAP’ (‘the SAP software’), including for accounting purposes, and it concluded, with its works council, several works agreements in that regard.","paragraph_id":"para_122"},{"text":"15","paragraph_id":"para_123"},{"text":"In 2017, the D group of companies, to which the defendant in the main proceedings belongs (‘the D group’), introduced, throughout that group, the cloud-based software called ‘Workday’ (‘the Workday software’) as a single personnel information management system. In that context, the defendant in the main proceedings transferred various personal data of its employees from the SAP software to a server of the D group’s parent company in the United States.","paragraph_id":"para_124"},{"text":"16","paragraph_id":"para_125"},{"text":"On 3 July 2017, the defendant in the main proceedings and its works council concluded an agreement confirming acquiescence as regards the introduction of the Workday software (‘the works agreement confirming acquiescence’), which prohibited, inter alia, the use of that software for human resources m …","paragraph_id":"para_126"},{"text":"17","paragraph_id":"para_127"},{"text":"In that context, the applicant in the main proceedings brought, before the Arbeitsgericht (Labour Court, Germany) and then before the Landesarbeitsgericht (Higher Labour Court, Germany) – which have territorial jurisdiction – applications for access to certain information, erasure of data concerning …","paragraph_id":"para_128"},{"text":"18","paragraph_id":"para_129"},{"text":"As he did not obtain full satisfaction, the applicant in the main proceedings brought an appeal on a point of law before the Bundesarbeitsgericht (Federal Labour Court, Germany), which is the referring court. Only that applicant’s claim for compensation, on the basis of the GDPR, for the non-materia …","paragraph_id":"para_130"},{"text":"19","paragraph_id":"para_131"},{"text":"As regards the unlawfulness of that processing, the applicant in the main proceedings claims, first, that that processing was not necessary for the purposes of the employment relationship, for which the defendant in the main proceedings at the time used the SAP software, or for the purpose of testin …","paragraph_id":"para_132"},{"text":"20","paragraph_id":"para_133"},{"text":"The defendant in the main proceedings contends that the processing at issue complies with the requirements of the GDPR, that the burden of proof lies with the applicant in the main proceedings and that he has not demonstrated either the existence of non-material damage or a causal link between a possible infringement of that regulation and the alleged damage.","paragraph_id":"para_134"},{"text":"21","paragraph_id":"para_135"},{"text":"The referring court takes the view that the operations challenged by the applicant in the main proceedings fall within the material scope of the GDPR, since they constitute ‘processing’ of ‘personal data’ of that ‘data subject’, within the meaning of Article 4(1) and (2) of that regulation. In addit …","paragraph_id":"para_136"},{"text":"22","paragraph_id":"para_137"},{"text":"In that context, the referring court asks, in the first place, whether a provision of national law governing the processing of personal data for the purposes of employment relationships which provides, in essence, that such processing carried out on the basis of collective agreements is lawful subje …","paragraph_id":"para_138"},{"text":"23","paragraph_id":"para_139"},{"text":"In the second place, if its first question is answered in the affirmative, the referring court asks whether the parties to such a collective agreement are entitled to a margin of discretion which should be subject only to limited judicial review as regards the assessment of the necessity of the proc …","paragraph_id":"para_140"},{"text":"24","paragraph_id":"para_141"},{"text":"In the third place, if the answer to its second question is in the affirmative, the referring court wishes to know the assessment criteria to which it should, where appropriate, limit its judicial review.","paragraph_id":"para_142"},{"text":"25","paragraph_id":"para_143"},{"text":"Lastly, the fourth to sixth questions initially submitted by that court, before being withdrawn by it, concerned, in essence, the right to compensation for non-material damage under Article 82(1) of the GDPR.","paragraph_id":"para_144"},{"text":"26","paragraph_id":"para_145"},{"text":"In those circumstances, the Bundesarbeitsgericht (Federal Labour Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_146"},{"text":"‘(1)","paragraph_id":"para_147"},{"text":"Is a national legal provision that has been adopted pursuant to Article 88(1) of [the GDPR] – such as Paragraph 26(4) of the [BDSG] – and which provides that the processing of personal data, including special categories of personal data, of employees for the purposes of the employment relationship i …","paragraph_id":"para_148"},{"text":"(2)","paragraph_id":"para_149"},{"text":"If the answer to Question 1 is in the affirmative:","paragraph_id":"para_150"},{"text":"May a national legal provision adopted pursuant to Article 88(1) of [the GDPR] – such as Paragraph 26(4) of the BDSG – be interpreted as meaning that the parties to a collective agreement (in this case, the parties to a works agreement) are entitled to a margin of discretion in assessing the necessity of data processing within the meaning of Article 5, Article 6(1) and Article 9(1) and (2) of [the GDPR] that is subject to only limited judicial review?","paragraph_id":"para_151"},{"text":"(3)","paragraph_id":"para_152"},{"text":"If the answer to Question 2 is in the affirmative:","paragraph_id":"para_153"},{"text":"In such a case, to what is the judicial review to be limited?","paragraph_id":"para_154"},{"text":"(4)","paragraph_id":"para_155"},{"text":"Is Article 82(1) of [the GDPR] to be interpreted as meaning that a person is entitled to compensation for non-material damage when his or her personal data have been processed contrary to the requirements of [the GDPR], or does the right to compensation for non-material damage additionally require that the data subject demonstrate non-material damage – of some weight – suffered by him or her?","paragraph_id":"para_156"},{"text":"(5)","paragraph_id":"para_157"},{"text":"Does Article 82(1) of [the GDPR] have a specific or general preventive character, and must that be taken into account in the assessment of the amount of non-material damage to be compensated at the expense of the controller or processor on the basis of Article 82(1) of [the GDPR]?","paragraph_id":"para_158"},{"text":"(6)","paragraph_id":"para_159"},{"text":"Is the degree of fault on the part of the controller or processor a decisive factor in the assessment of the amount of non-material damage to be compensated on the basis of Article 82(1) of [the GDPR]? In particular, can non-existent or minor fault on the part of the controller or processor be taken into account in their favour?’","paragraph_id":"para_160"},{"text":"Procedure before the Court","paragraph_id":"para_161"},{"text":"27","paragraph_id":"para_162"},{"text":"By decision of the President of the Court of 24 January 2024, the judgments of 4 May 2023, Österreichische Post(Non-material damage in connection with the processing of personal data) ( C‑300/21 , EU:C:2023:370 ); of 14 December 2023, Natsionalna agentsia za prihodite ( C‑340/21 , EU:C:2023:986 ); o …","paragraph_id":"para_163"},{"text":"28","paragraph_id":"para_164"},{"text":"By decision of the President of the Court of 15 March 2024, the proceedings were stayed, pursuant to Article 55(1)(b) of the Rules of Procedure of the Court of Justice, pending receipt of the reply to the question thus raised.","paragraph_id":"para_165"},{"text":"29","paragraph_id":"para_166"},{"text":"By written communication received at the Court on 8 May 2024, the referring court informed the Court that it was withdrawing its fourth to sixth questions, but was maintaining its first to third questions.","paragraph_id":"para_167"},{"text":"Admissibility of the request for a preliminary ruling","paragraph_id":"para_168"},{"text":"30","paragraph_id":"para_169"},{"text":"The defendant in the main proceedings contends that the first to third questions are inadmissible on the ground that they are not relevant to the outcome of the dispute before the referring court. In essence, it claims that the applicant in the main proceedings does not challenge the content of the …","paragraph_id":"para_170"},{"text":"31","paragraph_id":"para_171"},{"text":"In that connection, according to settled case-law, it is solely for the national court before which the dispute has been brought, and which must assume responsibility for the subsequent judicial decision, to determine, in the light of the particular circumstances of the case, both the need for a pre …","paragraph_id":"para_172"},{"text":"32","paragraph_id":"para_173"},{"text":"In the present case, the first to third questions concern the interpretation of several provisions of EU law, specifically Article 88 of the GDPR, read in conjunction with Articles 5, 6 and 9 thereof. In addition, the referring court takes the view that the limits laid down by the works agreement ap …","paragraph_id":"para_174"},{"text":"33","paragraph_id":"para_175"},{"text":"It follows that the request for a preliminary ruling is admissible.","paragraph_id":"para_176"},{"text":"Consideration of the questions referred","paragraph_id":"para_177"},{"text":"The first question","paragraph_id":"para_178"},{"text":"34","paragraph_id":"para_179"},{"text":"By its first question, the referring court asks, in essence, whether Article 88(1) and (2) of the GDPR must be interpreted as meaning that a provision of national law which concerns the processing of personal data for the purposes of employment relationships and has been adopted pursuant to Article …","paragraph_id":"para_180"},{"text":"35","paragraph_id":"para_181"},{"text":"In that regard, it should be recalled that the GDPR seeks to ensure the harmonisation of national legislation on the protection of personal data which is, in principle, complete. However, certain provisions of that regulation make it possible for Member States to lay down additional, stricter or der …","paragraph_id":"para_182"},{"text":"36","paragraph_id":"para_183"},{"text":"Article 88 of the GDPR, on the processing of personal data in the context of employment, determines the conditions under which Member States may provide for ‘more specific rules’, by law or by collective agreements, to ensure the protection of the rights and freedoms of employees concerned by such p …","paragraph_id":"para_184"},{"text":"37","paragraph_id":"para_185"},{"text":"According to settled case-law, the terms of a provision of EU law, such as Article 88 of the GDPR, which makes no express reference to the law of the Member States for the purposes of determining its meaning and scope must normally be given an autonomous and uniform interpretation throughout the Eur …","paragraph_id":"para_186"},{"text":"38","paragraph_id":"para_187"},{"text":"First, it is apparent from the wording of Article 88 of the GDPR that paragraph 1 of that article requires that the ‘more specific rules’ permitted by that provision have a normative content specific to the area regulated, which is distinct from the general rules of that regulation, while paragraph …","paragraph_id":"para_188"},{"text":"39","paragraph_id":"para_189"},{"text":"However, that wording does not provide any express indication as to whether the ‘more specific rules’ that the Member States thus have the possibility of adopting must seek to ensure compliance only with the requirements laid down in Article 88(2) of the GDPR or also with those of other provisions of that regulation, so that the processing of personal data carried out pursuant to such rules should also comply with those latter provisions.","paragraph_id":"para_190"},{"text":"40","paragraph_id":"para_191"},{"text":"Secondly, as regards the objectives of Article 88 of the GDPR, the Court has previously held that that article constitutes an ‘opening clause’ and that the option given to Member States by paragraph 1 thereof, in the light of the specific features of such processing, is explained, in particular, by …","paragraph_id":"para_192"},{"text":"41","paragraph_id":"para_193"},{"text":"In addition, the Court has stated that, when the Member States exercise the option granted to them by Article 88 of the GDPR, they must use their discretion under the conditions and within the limits laid down by the provisions of that regulation and must therefore legislate in such a way as not to …","paragraph_id":"para_194"},{"text":"42","paragraph_id":"para_195"},{"text":"However, in order not to undermine all of those objectives, and in particular that of ensuring a high level of protection for employees where their personal data are processed in the employment context, Article 88 of the GDPR cannot be interpreted as meaning that the ‘more specific rules’ which the …","paragraph_id":"para_196"},{"text":"43","paragraph_id":"para_197"},{"text":"It follows that Article 88(1) and (2) of the GDPR must be interpreted as meaning that, even where Member States rely on that article in order to introduce, into their respective national legal systems, ‘more specific rules’, by law or by collective agreements, the requirements arising from the other …","paragraph_id":"para_198"},{"text":"44","paragraph_id":"para_199"},{"text":"Thirdly, the context of Article 88 of the GDPR supports that interpretation.","paragraph_id":"para_200"},{"text":"45","paragraph_id":"para_201"},{"text":"Article 88 of the GDPR appears in Chapter IX thereof, entitled ‘Provisions relating to specific processing situations’, while Articles 5, 6 and 9 of that regulation appear in Chapter II thereof, entitled ‘Principles’, which is therefore more general in scope. Furthermore, it is clear from the wordin …","paragraph_id":"para_202"},{"text":"46","paragraph_id":"para_203"},{"text":"In addition, it is settled case-law that any processing of personal data must observe the principles governing the processing of such data and the rights of the data subject set out, respectively, in Chapters II and III of the GDPR. In particular, it must comply with the principles relating to the p …","paragraph_id":"para_204"},{"text":"47","paragraph_id":"para_205"},{"text":"As regards, specifically, the relationship between Article 88 of the GDPR and other provisions of that regulation, the Court has stated, in particular in the light of recital 8 thereof, that, notwithstanding the possible existence of ‘more specific rules’ adopted by the Member States on the basis of …","paragraph_id":"para_206"},{"text":"48","paragraph_id":"para_207"},{"text":"Similarly, the obligations resulting from Article 9 of the GDPR must be complied with when any processing of personal data covered by that regulation is carried out, including where there are ‘more specific rules’ adopted pursuant to Article 88(1) thereof. That Article 9, which governs the processin …","paragraph_id":"para_208"},{"text":"49","paragraph_id":"para_209"},{"text":"Thus, where the law of a Member State contains ‘more specific rules’, within the meaning of Article 88(1) of the GDPR, the processing of personal data covered by those rules must comply not only with the conditions laid down in paragraphs 1 and 2 of that article, but also with those laid down in Articles 5, 6 and 9 of that regulation, as interpreted by the case-law of the Court.","paragraph_id":"para_210"},{"text":"50","paragraph_id":"para_211"},{"text":"In the light of the foregoing, the answer to the first question is that Article 88(1) and (2) of the GDPR must be interpreted as meaning that a provision of national law which concerns the processing of personal data for the purposes of employment relationships and has been adopted pursuant to Artic …","paragraph_id":"para_212"},{"text":"The second question","paragraph_id":"para_213"},{"text":"51","paragraph_id":"para_214"},{"text":"By its second question, the referring court asks, in essence, whether Article 88(1) of the GDPR must be interpreted as meaning that, where a collective agreement falls within the scope of that provision, the margin of discretion that the parties to that agreement have to determine whether the proces …","paragraph_id":"para_215"},{"text":"52","paragraph_id":"para_216"},{"text":"First of all, it must be recalled that, as has been stated in paragraph 41 above, the Member States exercising the option granted to them by Article 88 of the GDPR must use their discretion under the conditions and within the limits laid down by the provisions of that regulation, thereby ensuring th …","paragraph_id":"para_217"},{"text":"53","paragraph_id":"para_218"},{"text":"As regards the scope of the judicial review that may be carried out with regard to such specific rules, the Court has already held that it is for the national court seised, which alone has jurisdiction to interpret national law, to assess whether those rules do indeed comply with the conditions and …","paragraph_id":"para_219"},{"text":"54","paragraph_id":"para_220"},{"text":"Those considerations also apply to the parties to a collective agreement referred to in Article 88 of the GDPR, such as that at issue in the main proceedings. As the European Commission stated, in essence, in its written observations, the parties to a collective agreement are to be entitled to a mar …","paragraph_id":"para_221"},{"text":"55","paragraph_id":"para_222"},{"text":"Thus, notwithstanding the margin of discretion that Article 88 of the GDPR leaves to the parties to a collective agreement, the judicial review carried out with regard to such an agreement must, like that relating to a rule of national law adopted pursuant to that provision, be able to cover without any restriction compliance with all of the conditions and limits laid down by the provisions of that regulation for the processing of personal data.","paragraph_id":"para_223"},{"text":"56","paragraph_id":"para_224"},{"text":"Next, it should be stated that such judicial review must, specifically, seek to verify whether the processing of such data is necessary, within the meaning of Articles 5, 6 and 9 of the GDPR. In other words, Article 88 of that regulation cannot be interpreted as meaning that the parties to a collect …","paragraph_id":"para_225"},{"text":"57","paragraph_id":"para_226"},{"text":"It is true, as the referring court and Ireland have observed in essence, that the parties to a collective agreement are generally well placed to assess whether data processing is necessary in a given professional context, since those parties usually have extensive knowledge of the specific needs ari …","paragraph_id":"para_227"},{"text":"58","paragraph_id":"para_228"},{"text":"Therefore, an interpretation of Article 88 of the GDPR according to which national courts could not carry out a full judicial review with regard to a collective agreement, in particular in order to ascertain whether the justifications put forward by the parties to that agreement establish that the p …","paragraph_id":"para_229"},{"text":"59","paragraph_id":"para_230"},{"text":"Lastly, it must be stated that, if the national court seised were to find, following its review, that certain provisions of the collective agreement concerned do not comply with the conditions and limits laid down by the GDPR, it would then be required to disregard those provisions, in accordance with the case-law referred to in paragraph 53 above.","paragraph_id":"para_231"},{"text":"60","paragraph_id":"para_232"},{"text":"In the light of the foregoing considerations, the answer to the second question is that Article 88(1) of the GDPR must be interpreted as meaning that, where a collective agreement falls within the scope of that provision, the margin of discretion that the parties to that agreement have to determine …","paragraph_id":"para_233"},{"text":"The third question","paragraph_id":"para_234"},{"text":"61","paragraph_id":"para_235"},{"text":"In view of the answer to the second question, there is no need to answer the third question.","paragraph_id":"para_236"},{"text":"Costs","paragraph_id":"para_237"},{"text":"62","paragraph_id":"para_238"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_239"},{"text":"On those grounds, the Court (Eighth Chamber) hereby rules:","paragraph_id":"para_240"},{"text":"1.","paragraph_id":"para_241"},{"text":"Article 88(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),","paragraph_id":"para_242"},{"text":"must be interpreted as meaning that a provision of national law which concerns the processing of personal data for the purposes of employment relationships and has been adopted pursuant to Article 88(1) of that regulation must have the effect of requiring its addressees to comply not only with the requirements arising from Article 88(2) of that regulation, but also with those arising from Article 5, Article 6(1) and Article 9(1) and (2) thereof.","paragraph_id":"para_243"},{"text":"2.","paragraph_id":"para_244"},{"text":"Article 88(1) of Regulation 2016/679","paragraph_id":"para_245"},{"text":"must be interpreted as meaning that, where a collective agreement falls within the scope of that provision, the margin of discretion that the parties to that agreement have to determine whether the processing of personal data is ‘necessary’, within the meaning of Article 5, Article 6(1) and Article 9(1) and (2) of that regulation, does not prevent the national court from carrying out a full judicial review in that regard.","paragraph_id":"para_246"},{"text":"[Signatures]","paragraph_id":"para_247"},{"text":"(\n *1\n ) Language of the case: German.","paragraph_id":"para_248"}],"word_count":7506,"cites":["C-184/89","C-187/00","C-300/21","C-340/21","C-456/22","C-667/21","C-687/21","C-182/22","C-189/22","C-34/21","C-268/21","C-757/22","C-21/23"],"cited_by":[],"sha256":"a0e108025f5d4ba932dc20cde856bf7a937e6264f3f595cc07516c81eb8279aa","source_url":"https://publications.europa.eu/resource/celex/62023CJ0065.ENG.xhtml.ECR_62023CJ0065_EN_01.html","fetched_at":"2026-10-02T01:06:47.357+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-65-23","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-65-23","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-65-23","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-65-23","verification":{"stored_sha256":"a0e108025f5d4ba932dc20cde856bf7a937e6264f3f595cc07516c81eb8279aa","recomputed_sha256":"a0e108025f5d4ba932dc20cde856bf7a937e6264f3f595cc07516c81eb8279aa","intact":true,"checked_at":"2026-10-14T11:55:41.221Z"}},"hash":"sha256:05090879c8df74c67a0fb235a4f6ffa12c653cd1a8cf17aee4d85e16651022d7","version":"legal-2026-10-14","expires":"2026-10-15T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-14+legal-2026-10-14+2026-10-14T08:26:07","content_hash":"sha256:05090879c8df74c67a0fb235a4f6ffa12c653cd1a8cf17aee4d85e16651022d7","revalidate_after":"2026-10-14T12:55:41.813Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-65-23","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-65-23"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-65-23"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-65-23"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-65-23","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-bde15c070b0920e8befb1b85233c8cd7","response_hash":"sha256:05090879c8df74c67a0fb235a4f6ffa12c653cd1a8cf17aee4d85e16651022d7"}},"freshness":{"freshness_class":"live","as_of":"2026-11-02T17:00:55.434Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-65-23&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":15922}}