{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-655-23-62023cj0655","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-655-23-62023cj0655)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-15","fingerprint":"ewai:eu:8d311e","proof":"sha256:c1e190e82dcbd97ab077f5910f3f597065536d08da42a3980c34ec86b3638146","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-655-23-62023cj0655","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"Provisional text","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Fourth Chamber)","paragraphs":[]},{"title":"4 September 2025 ( * )","paragraphs":["para_4","para_5","para_6"]},{"title":"IP","paragraphs":["para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20"]},{"title":"Judgment","paragraphs":["para_22","para_23"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"3         Recitals 1, 10, 11, 75, 85 and 146 of the GDPR are worded as follows:","paragraphs":["para_27","para_28","para_29","para_30","para_31","para_32","para_33","para_34","para_35","para_36","para_37","para_38"]},{"title":"5         Article 4 of that regulation, headed ‘Definitions’, provides:","paragraphs":["para_40","para_41","para_42","para_43","para_44","para_45","para_46","para_47","para_48","para_49","para_50","para_51","para_52","para_53","para_54","para_55","para_56","para_57","para_58","para_59","para_60","para_61","para_62","para_63","para_64","para_65","para_66","para_67"]},{"title":"(d)      the personal data have been unlawfully processed;","paragraphs":["para_69","para_70","para_71","para_72","para_73","para_74","para_75","para_76","para_77","para_78","para_79","para_80","para_81","para_82","para_83","para_84","para_85","para_86","para_87"]},{"title":"(b)      the intentional or negligent character of the infringement;","paragraphs":["para_89","para_90","para_91"]},{"title":"17       Article 84 of that regulation, headed ‘Penalties’, states, in paragraph 1:","paragraphs":["para_93"]},{"title":"German law","paragraphs":["para_95","para_96","para_97","para_98","para_99"]},{"title":"20       Paragraph 823 of the BGB, headed ‘Obligation to make good damage’, states:","paragraphs":["para_101","para_102","para_103","para_104","para_105"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":["para_107","para_108","para_109","para_110","para_111","para_112","para_113","para_114","para_115","para_116","para_117","para_118","para_119","para_120","para_121","para_122","para_123","para_124"]},{"title":"(3)      If the answers to [points (a) and (b) of the first question] are in the negative:","paragraphs":["para_126","para_127","para_128","para_129","para_130"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"The first, second and third questions","paragraphs":["para_133","para_134","para_135","para_136","para_137","para_138","para_139","para_140","para_141","para_142","para_143","para_144","para_145","para_146","para_147","para_148","para_149"]},{"title":"The fourth question","paragraphs":["para_151","para_152","para_153","para_154","para_155","para_156","para_157","para_158","para_159","para_160","para_161","para_162"]},{"title":"The fifth question","paragraphs":["para_164","para_165","para_166","para_167","para_168","para_169","para_170","para_171","para_172"]},{"title":"The sixth question","paragraphs":["para_174","para_175","para_176","para_177","para_178","para_179","para_180","para_181","para_182","para_183"]},{"title":"Costs","paragraphs":["para_185"]},{"title":"On those grounds, the Court (Fourth Chamber) hereby rules:","paragraphs":["para_187","para_188"]},{"title":"2.       Article 82(1) of Regulation 2016/679","paragraphs":["para_190"]},{"title":"3.       Article 82(1) of Regulation 2016/679","paragraphs":["para_192"]},{"title":"4.       Article 82(1) of Regulation 2016/679","paragraphs":["para_194","para_195","para_196"]}],"paragraphs":[{"text":"Provisional text","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Fourth Chamber)","paragraph_id":"para_2"},{"text":"4 September 2025 ( * )","paragraph_id":"para_3"},{"text":"( Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Rights of the data subject – Article 17 – Right to erasure of data – Article 18 – Right to restriction of processing – Article 79 – Right to an effective j …","paragraph_id":"para_4"},{"text":"In Case C‑655/23,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Bundesgerichtshof (Federal Court of Justice, Germany), made by decision of 26 September 2023, received at the Court on 7 November 2023, in the proceedings","paragraph_id":"para_6"},{"text":"IP","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"Quirin Privatbank AG,","paragraph_id":"para_9"},{"text":"THE COURT (Fourth Chamber),","paragraph_id":"para_10"},{"text":"composed of I. Jarukaitis, President of the Chamber, N. Jääskinen (Rapporteur), A. Arabadjiev, M. Condinanzi and R. Frendo, Judges,","paragraph_id":"para_11"},{"text":"Advocate General: M. Campos Sánchez-Bordona,","paragraph_id":"para_12"},{"text":"Registrar: A. Calot Escobar,","paragraph_id":"para_13"},{"text":"having regard to the written procedure,","paragraph_id":"para_14"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_15"},{"text":"–        IP, by M. Rodenhausen, Rechtsanwältin,","paragraph_id":"para_16"},{"text":"–        Quirin Privatbank AG, by F. Buchmann, Rechtsanwalt,","paragraph_id":"para_17"},{"text":"–        the European Commission, by A. Bouchagiar and M. Heller, acting as Agents,","paragraph_id":"para_18"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 20 March 2025,","paragraph_id":"para_19"},{"text":"gives the following","paragraph_id":"para_20"},{"text":"Judgment","paragraph_id":"para_21"},{"text":"1         This request for a preliminary ruling concerns the interpretation of Articles 17, 18, 79, 82 and 84 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).","paragraph_id":"para_22"},{"text":"2         The request has been made in proceedings between IP, a natural person, and Quirin Privatbank AG, a company, concerning a claim brought by IP seeking, first, an order that that company refrain from making a further unauthorised disclosure of his personal data to a third party and, second, compensation for the non-material damage allegedly suffered following the initial disclosure of those data.","paragraph_id":"para_23"},{"text":"Legal context","paragraph_id":"para_24"},{"text":"European Union law","paragraph_id":"para_25"},{"text":"3         Recitals 1, 10, 11, 75, 85 and 146 of the GDPR are worded as follows:","paragraph_id":"para_26"},{"text":"‘(1)      The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.","paragraph_id":"para_27"},{"text":"…","paragraph_id":"para_28"},{"text":"(10)      In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the [European] Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equi …","paragraph_id":"para_29"},{"text":"(11)      Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States.","paragraph_id":"para_30"},{"text":"…","paragraph_id":"para_31"},{"text":"(75)      The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular where the processing may give rise to discrimination, identity theft or fraud, f …","paragraph_id":"para_32"},{"text":"…","paragraph_id":"para_33"},{"text":"(85)      A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, …","paragraph_id":"para_34"},{"text":"…","paragraph_id":"para_35"},{"text":"(146)      The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation. The controller or processor should be exempt from liability if it proves that it is not in any way responsible for the damage. The concept of damage …","paragraph_id":"para_36"},{"text":"4         Article 1 of the GDPR, headed ‘Subject matter and objectives’, provides, in paragraph 2:","paragraph_id":"para_37"},{"text":"‘This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.’","paragraph_id":"para_38"},{"text":"5         Article 4 of that regulation, headed ‘Definitions’, provides:","paragraph_id":"para_39"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_40"},{"text":"(1)      “personal data” means any information relating to an identified or identifiable natural person (“data subject”); …","paragraph_id":"para_41"},{"text":"(2)      “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as … disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_42"},{"text":"…","paragraph_id":"para_43"},{"text":"(7)      “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; …","paragraph_id":"para_44"},{"text":"…","paragraph_id":"para_45"},{"text":"(10)      “third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;","paragraph_id":"para_46"},{"text":"…","paragraph_id":"para_47"},{"text":"(12)      “personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;","paragraph_id":"para_48"},{"text":"…’","paragraph_id":"para_49"},{"text":"6         Chapter II of the GDPR, headed ‘Principles’, comprises Articles 5 to 11 of that regulation.","paragraph_id":"para_50"},{"text":"7         Article 5 of that regulation, headed ‘Principles relating to processing of personal data’, provides:","paragraph_id":"para_51"},{"text":"‘1.      Personal data shall be:","paragraph_id":"para_52"},{"text":"(a)      processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);","paragraph_id":"para_53"},{"text":"(b)      collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes … (“purpose limitation”);","paragraph_id":"para_54"},{"text":"(c)      adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);","paragraph_id":"para_55"},{"text":"…","paragraph_id":"para_56"},{"text":"(f)      processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).","paragraph_id":"para_57"},{"text":"2.      The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’","paragraph_id":"para_58"},{"text":"8         Article 6 of that regulation, headed ‘Lawfulness of processing’, provides, in paragraph 1:","paragraph_id":"para_59"},{"text":"‘Processing shall be lawful only if and to the extent that at least one of the following applies:","paragraph_id":"para_60"},{"text":"(a)      the data subject has given consent to the processing of his or her personal data for one or more specific purposes;","paragraph_id":"para_61"},{"text":"…’","paragraph_id":"para_62"},{"text":"9         Chapter III of the GDPR, headed ‘Rights of the data subject’, comprises Articles 12 to 23 of that regulation.","paragraph_id":"para_63"},{"text":"10       Contained in Section 3 of Chapter III, headed ‘Rectification and erasure’, Article 17 of that regulation, itself headed ‘Right to erasure (‘right to be forgotten’)’, provides, in paragraph 1:","paragraph_id":"para_64"},{"text":"‘The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:","paragraph_id":"para_65"},{"text":"…","paragraph_id":"para_66"},{"text":"(c)      the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);","paragraph_id":"para_67"},{"text":"(d)      the personal data have been unlawfully processed;","paragraph_id":"para_68"},{"text":"…’","paragraph_id":"para_69"},{"text":"11       Similarly contained in Section 3, Article 18 of that regulation, headed ‘Right to restriction of processing’, provides, in paragraph 1:","paragraph_id":"para_70"},{"text":"‘The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:","paragraph_id":"para_71"},{"text":"…","paragraph_id":"para_72"},{"text":"(b)      the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;","paragraph_id":"para_73"},{"text":"(c)      the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;","paragraph_id":"para_74"},{"text":"…’","paragraph_id":"para_75"},{"text":"12       Chapter VIII of the GDPR, headed ‘Remedies, liability and penalties’, comprises Articles 77 to 84 of that regulation.","paragraph_id":"para_76"},{"text":"13       Article 77 of the GDPR is headed ‘Right to lodge a complaint with a supervisory authority’, and Article 78 of that regulation is headed ‘Right to an effective judicial remedy against a supervisory authority’.","paragraph_id":"para_77"},{"text":"14       Article 79 of that regulation, headed ‘Right to an effective judicial remedy against a controller or processor’, provides in paragraph 1:","paragraph_id":"para_78"},{"text":"‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.’","paragraph_id":"para_79"},{"text":"15       As set out in Article 82 of the GDPR, headed ‘Right to compensation and liability’:","paragraph_id":"para_80"},{"text":"‘1.      Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.","paragraph_id":"para_81"},{"text":"…","paragraph_id":"para_82"},{"text":"3.      A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.","paragraph_id":"para_83"},{"text":"…’","paragraph_id":"para_84"},{"text":"16       Article 83 of that regulation, headed ‘General conditions for imposing administrative fines’, provides, in paragraph 2:","paragraph_id":"para_85"},{"text":"‘… When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:","paragraph_id":"para_86"},{"text":"(a)      the nature, gravity and duration of the infringement taking into account the nature, scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;","paragraph_id":"para_87"},{"text":"(b)      the intentional or negligent character of the infringement;","paragraph_id":"para_88"},{"text":"(c)      any action taken by the controller or processor to mitigate the damage suffered by data subjects;","paragraph_id":"para_89"},{"text":"…","paragraph_id":"para_90"},{"text":"(k)      any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.’","paragraph_id":"para_91"},{"text":"17       Article 84 of that regulation, headed ‘Penalties’, states, in paragraph 1:","paragraph_id":"para_92"},{"text":"‘Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive.’","paragraph_id":"para_93"},{"text":"German law","paragraph_id":"para_94"},{"text":"18       Article 2(1) of the Grundgesetz für die Bundesrepublik Deutschland (Basic Law of the Federal Republic of Germany) of 23 May 1949 (BGBl. 1949 I, p. 1), in the version applicable to the dispute in the main proceedings, is worded as follows:","paragraph_id":"para_95"},{"text":"‘Every person shall have the right to free development of his or her personality in so far as he or she does not violate the rights of others or offend against the constitutional order or the moral law.’","paragraph_id":"para_96"},{"text":"19       Paragraph 253 of the Bürgerliches Gesetzbuch (German Civil Code), in the version applicable to the dispute in the main proceedings (‘the BGB’), headed ‘Non-material damage’, provides:","paragraph_id":"para_97"},{"text":"‘(1)      Money may be sought as compensation for non-material damage only in the cases specified by law.","paragraph_id":"para_98"},{"text":"(2)      Where damages are to be paid on account of bodily injury, damage to health, freedom or sexual self-determination, fair compensation in monetary terms for non-material damage may also be sought.’","paragraph_id":"para_99"},{"text":"20       Paragraph 823 of the BGB, headed ‘Obligation to make good damage’, states:","paragraph_id":"para_100"},{"text":"‘(1)      Any person who, with intent or through negligence, unlawfully injures the life, body, health, freedom, property or other right of another person shall be obliged to compensate that other person for the resulting damage.","paragraph_id":"para_101"},{"text":"(2)      The same obligation shall be imposed on a person who infringes a law which is intended to protect another person. If, according to the contents of that law, it may also be infringed without fault, the obligation to provide compensation shall exist only in the event of fault.’","paragraph_id":"para_102"},{"text":"21       Paragraph 1004 of the BGB, headed ‘Right to cessation and injunctive relief’, provides in subparagraph 1:","paragraph_id":"para_103"},{"text":"‘If ownership is interfered with otherwise than by dispossession or withholding of possession, the owner may demand that the person responsible cease the interference in question. If further interference with ownership is to be apprehended, the owner may seek injunctive relief.’","paragraph_id":"para_104"},{"text":"22       According to the order for reference, Paragraph 1004 of the BGB is applicable by analogy, in the main proceedings, to the infringement of absolute rights or to the infringement of a law intended to protect another person within the meaning of Paragraphs 823(1) and (2) of the BGB, respectively.","paragraph_id":"para_105"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_106"},{"text":"23       The applicant in the main proceedings applied, through an online professional social networking platform, for a position with Quirin Privatbank, a company incorporated under German law. Subsequently, an employee of that company used that network’s electronic messaging service to send to a t …","paragraph_id":"para_107"},{"text":"24       The applicant in the main proceedings brought an action before the Landgericht Darmstadt (Regional Court, Darmstadt, Germany) seeking an order that Quirin Privatbank, first, refrain from any processing of his personal data in connection with his application that would reiterate the unauthor …","paragraph_id":"para_108"},{"text":"25       By judgment of 26 May 2020, the court of first instance ordered Quirin Privatbank to refrain from the actions referred to in the application and to pay the applicant in the main proceedings damages of EUR 1 000, plus interest. Quirin Privatbank appealed against that judgment.","paragraph_id":"para_109"},{"text":"26       By judgment of 2 March 2022, the Oberlandesgericht Frankfurt (Higher Regional Court, Frankfurt, Germany) varied that judgment in part. It held that the applicant in the main proceedings was entitled, under Article 17(1) of the GDPR, to require Quirin Privatbank to refrain in the future from …","paragraph_id":"para_110"},{"text":"27       The applicant in the main proceedings and Quirin Privatbank each brought an appeal on a point of law ( Revision ) against that judgment before the Bundesgerichtshof (Federal Court of Justice, Germany), which is the referring court. Before that court, the former continues to pursue his initial claims, while the latter contends that those claims should be dismissed in their entirety.","paragraph_id":"para_111"},{"text":"28       The referring court considers that the operations challenged by the applicant in the main proceedings come within the scope of the GDPR. It states that those operations constitute ‘processing’ of ‘personal data’ of the ‘data subject’ and that Quirin Privatbank is the ‘controller’, within th …","paragraph_id":"para_112"},{"text":"29       That court asks, first, whether the GDPR confers on a person whose personal data have been unlawfully processed the right to require the controller to refrain from repeating such unlawful processing, including where that person has not requested the erasure of his or her data. In the light …","paragraph_id":"para_113"},{"text":"30       Second, in the event that those questions are answered in the affirmative, the referring court seeks to determine, in the light of its own case-law based on Article 2 of the Basic Law of the Federal Republic of Germany and on a combined application of Paragraphs 823 and 1004 of the BGB, whe …","paragraph_id":"para_114"},{"text":"31       Third, should both parts of its first question be answered in the negative, that court wishes to know whether it follows from a combined reading of Articles 79 and 84 of the GDPR, relating, respectively, to the right to an effective judicial remedy against the controller and to penalties in …","paragraph_id":"para_115"},{"text":"32       Fourth, the referring court is uncertain of the conditions to which the right to compensation for damage under Article 82(1) of the GDPR, read in the light of recitals 75 and 85 of that regulation, is subject. It asks, more specifically, what elements make it possible to establish ‘non-mate …","paragraph_id":"para_116"},{"text":"33       Fifth, the referring court is uncertain whether the seriousness of the fault on the part of the controller is to be taken into consideration when assessing compensation for non-material damage payable under Article 82(1) of the GDPR. It states that, under German law, monetary compensation f …","paragraph_id":"para_117"},{"text":"34       Sixth, if either part of its first question or its third question is answered in the affirmative, the referring court wishes to know whether a data subject’s right to require the controller to refrain from a further infringement of the GDPR constitutes a relevant criterion for reducing or not awarding compensation for non-material damage under Article 82(1) of that regulation, as would be possible under German law.","paragraph_id":"para_118"},{"text":"35       In those circumstances, the Bundesgerichtshof (Federal Court of Justice) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_119"},{"text":"‘(1)      (a)      Must Article 17 of the GDPR be interpreted as meaning that a data subject whose personal data have been unlawfully disclosed by the controller through onward transfer has the right to obtain a prohibitory injunction against the controller prohibiting further unlawful onward transfer of those data if the data subject does not request the controller to erase the data?","paragraph_id":"para_120"},{"text":"(b)      Can such a right to obtain a prohibitory injunction (also) arise from Article 18 of the GDPR or any another provision thereof?","paragraph_id":"para_121"},{"text":"(2)      If the answers to [points (a) and/or (b) of the first question] are in the affirmative:","paragraph_id":"para_122"},{"text":"(a)      Does the right to obtain a prohibitory injunction under EU law exist only if a risk of further infringements of the data subject’s rights under the GDPR is to be apprehended in the future (risk of recurrence)?","paragraph_id":"para_123"},{"text":"(b)      Is the existence of the risk of recurrence presumed, where applicable, by reason of the existing infringement of the GDPR?","paragraph_id":"para_124"},{"text":"(3)      If the answers to [points (a) and (b) of the first question] are in the negative:","paragraph_id":"para_125"},{"text":"Must Article 84 of the GDPR, in conjunction with Article 79 thereof, be interpreted as permitting the national court to confer on the data subject whose personal data were unlawfully disclosed by the controller through onward transfer, in addition to the right to obtain compensation for material or …","paragraph_id":"para_126"},{"text":"(4)      Must Article 82(1) of the GDPR be interpreted as meaning that mere negative feelings such as annoyance, displeasure, dissatisfaction, worry and fear, which are in themselves part of the general risk of life and often part of everyday experience, are sufficient for the assumption of non-material damage within the meaning of that provision? Or is a disadvantage to the natural person concerned which goes beyond those feelings necessary for the assumption of damage?","paragraph_id":"para_127"},{"text":"(5)      Must Article 82(1) GDPR to be interpreted as meaning that the degree of fault of the controller or processor or its employees constitutes a relevant criterion in assessing the amount of non-material damage to be compensated?","paragraph_id":"para_128"},{"text":"(6)      If the answers to [points (a) or (b) of the first question or the third question] are in the affirmative:","paragraph_id":"para_129"},{"text":"Must Article 82(1) of the GDPR be interpreted as meaning that, in assessing the amount of non-material damage to be compensated, the fact that the data subject concerned has a right to obtain a prohibitory injunction in addition to the right to compensation can be taken into account as reducing the claim?’","paragraph_id":"para_130"},{"text":"Consideration of the questions referred","paragraph_id":"para_131"},{"text":"The first, second and third questions","paragraph_id":"para_132"},{"text":"36       By its first, second and third questions, which it is appropriate to examine together, the referring court asks, in essence, whether the provisions of the GDPR must be interpreted as providing, for the data subject concerned by the unlawful processing of personal data, in the event that tha …","paragraph_id":"para_133"},{"text":"37       As a preliminary point, it must be borne in mind that, in interpreting a provision of EU law, it is necessary to consider not only its wording but also its context and the objectives pursued by the legislation of which it forms part (judgment of 4 October 2024, Lindenapotheke , C‑21/23, EU:C:2024:846, paragraph 52 and the case-law cited).","paragraph_id":"para_134"},{"text":"38       In that regard, in the first place, it should be noted that the GDPR is based on the existence of a right enjoyed by every natural person to protection with regard to the processing of personal data concerning him or her. That protection is a fundamental right, enshrined in Article 8(1) of …","paragraph_id":"para_135"},{"text":"39       In accordance with the Court’s settled case-law, any processing of personal data must observe the principles governing the processing of such data and the rights of the ‘data subject’, within the meaning of Article 4(1) of the GDPR, which are set out, respectively, in Chapters II and III of …","paragraph_id":"para_136"},{"text":"40       As the Advocate General observed, in essence, in points 32, 34 and 38 of his Opinion, Article 8 of the Charter declares, in paragraph 1, the right to the protection of personal data, but also requires, in paragraph 2, that those data be processed in compliance with certain conditions, which …","paragraph_id":"para_137"},{"text":"41       In the second place, the Court has repeatedly held that EU law, including the provisions of the Charter, does not have the effect of requiring Member States to establish remedies other than those established by national law, unless it is apparent from the overall scheme of the national lega …","paragraph_id":"para_138"},{"text":"42       In the present case, it should be pointed out as a preliminary observation that the situation at issue in the main proceedings concerns not the possibility for a national court to adopt interim measures, but the possibility for the data subject to obtain, on the merits, by means of preventive legal action, an injunction prohibiting the controller from committing a further infringement of those rights.","paragraph_id":"para_139"},{"text":"43       In that regard, it should be noted that the GDPR contains no provisions which provide, explicitly or implicitly, that the data subject enjoys, as envisaged by the referring court, a right to obtain, as a preventive measure and by means of judicial proceedings, an order that the controller o …","paragraph_id":"para_140"},{"text":"44       As regards Chapter VIII of the GDPR, it must be borne in mind that that chapter governs, inter alia, the legal remedies available to protect the rights of data subjects whose personal data have been processed in a manner alleged to be contrary to the provisions of that regulation. The prote …","paragraph_id":"para_141"},{"text":"45       It is clear from the wording of the provisions of Chapter VIII of the GDPR that none of those provisions require Member States to provide for a preventive remedy such as that described in paragraph 42 above. In particular, the wording of Article 79(1) of that regulation merely provides that …","paragraph_id":"para_142"},{"text":"46       That said, having regard to the wording of the provisions of Chapter VIII of the GDPR and, in particular, to the recognition, by Article 79(1) thereof, of the right of each data subject to an effective judicial remedy where he or she considers that his or her rights under that regulation ha …","paragraph_id":"para_143"},{"text":"47       In that regard, it should be noted that, although the GDPR seeks to ensure the harmonisation of national legislation on the protection of personal data which is, in principle, full, the fact remains that several provisions of that regulation expressly make it possible for Member States to l …","paragraph_id":"para_144"},{"text":"48       It is true that the provisions of Chapter VIII of the GDPR do not specifically include such an opening clause which would expressly allow Member States to provide for the possibility for a data subject wishing to prevent the controller from infringing the substantive provisions of that regu …","paragraph_id":"para_145"},{"text":"49       That interpretation is confirmed by the objectives pursued by the GDPR. That regulation seeks, inter alia, as stated in recital 10 thereof, to ensure a consistent and high level of protection of natural persons with regard to the processing of their personal data. In addition, recital 11 of …","paragraph_id":"para_146"},{"text":"50       The possibility for the data subject to bring a legal action seeking an order requiring a controller to refrain, in future, from infringing the substantive provisions of the GDPR does not undermine those objectives but is, in fact, such as to enhance the effectiveness of those provisions an …","paragraph_id":"para_147"},{"text":"51       It follows that the GDPR does not preclude a legal remedy in the form of an injunction aimed at preventing a possible infringement of the substantive provisions of that regulation, in particular through a potential reiteration of unlawful processing, from being available on the basis of provisions of the law of a Member State law which are applicable before the national court seised.","paragraph_id":"para_148"},{"text":"52       In the light of all of the foregoing, the answer to the first, second and third questions is that the provisions of the GDPR must be interpreted as not providing, for the data subject concerned by the unlawful processing of personal data, in the event that that data subject does not request …","paragraph_id":"para_149"},{"text":"The fourth question","paragraph_id":"para_150"},{"text":"53       By its fourth question, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as meaning that the concept of ‘non-material damage’ contained in that provision encompasses negative feelings experienced by the data subject as a result of the unauthorised …","paragraph_id":"para_151"},{"text":"54       It should be observed that Article 82(1) of the GDPR provides that any person who has suffered material or non-material damage as a result of an infringement of that regulation is entitled to receive compensation from the controller or processor for the damage suffered.","paragraph_id":"para_152"},{"text":"55       In accordance with settled case-law, having regard to the absence of any reference in Article 82(1) of the GDPR to the domestic law of the Member States, the concept of ‘non-material damage’, within the meaning of that provision, must be given an autonomous and uniform definition specific t …","paragraph_id":"para_153"},{"text":"56       In that regard, the Court has repeatedly held, in particular in the light of recitals 75, 85 and 146 of the GDPR, that the mere infringement of that regulation is not sufficient to confer a right to compensation under Article 82(1) thereof. The existence of ‘damage’, material or non-materia …","paragraph_id":"para_154"},{"text":"57       In the present case, the referring court states that the applicant in the main proceedings relies, in essence, in respect of the non-material damage which he claims to have suffered as a result of the infringement of the GDPR at issue, on ‘the fear of the data being passed on to third parti …","paragraph_id":"para_155"},{"text":"58       In that regard, in the first place, it follows from the Court’s case-law that Article 82(1) of the GDPR precludes a national rule or practice which makes compensation for ‘non-material damage’, within the meaning of that provision, subject to the condition that the damage suffered by the da …","paragraph_id":"para_156"},{"text":"59       In the second place, as the European Commission stated in its written observations, situations such as those relied on in the dispute in the main proceedings relating to ‘damage to reputation’ resulting from a personal data breach or a ‘loss of control’ over such data are expressly included among the examples of possible damage listed in recitals 75 and 85 of the GDPR.","paragraph_id":"para_157"},{"text":"60       In particular, the Court has pointed out that it is apparent from the illustrative list of types of ‘damage’ that may be suffered by data subjects set out in the first sentence of recital 85 of the GDPR that the EU legislature intended to include in that concept, inter alia, mere ‘loss of c …","paragraph_id":"para_158"},{"text":"61       In the third place, the Court has previously held that the fear experienced by a data subject that his or her personal data will be misused in the future as a result of an infringement of the GDPR, is capable, in itself, of constituting ‘non-material damage’, within the meaning of Article 8 …","paragraph_id":"para_159"},{"text":"62       Therefore, while the feelings mentioned by the referring court, in particular fear or annoyance, may also form part of the general risk inherent in everyday life, as that court itself observes, such negative feelings are capable of constituting ‘non-material damage’, within the meaning of A …","paragraph_id":"para_160"},{"text":"63       In the fourth place and lastly, that interpretation is consistent with the wording of Article 82(1) of the GDPR, read in the light of recitals 85 and 146 of that regulation, which encourage the acceptance of a broad interpretation of the concept of ‘non-material damage’, within the meaning …","paragraph_id":"para_161"},{"text":"64       In the light of the foregoing considerations, the answer to the fourth question is that Article 82(1) of the GDPR must be interpreted as meaning that the concept of ‘non-material damage’ contained in that provision encompasses negative feelings experienced by the data subject as a result of …","paragraph_id":"para_162"},{"text":"The fifth question","paragraph_id":"para_163"},{"text":"65       By its fifth question, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as allowing the degree of seriousness of the fault on the part of the controller to be taken into account for the purpose of assessing the compensation for non-material damage payable under Article 82(1).","paragraph_id":"para_164"},{"text":"66       In that regard, it is apparent from the case-law of the Court that, since the GDPR does not contain any provision intended to define the rules on the assessment of damages payable under the right to compensation enshrined in Article 82 of that regulation, national courts must, to that end, …","paragraph_id":"para_165"},{"text":"67       In the present case, the referring court asks whether the degree of seriousness of the fault of the person responsible for the damage, which is a criterion provided for in German law for assessing financial compensation for non-material damage, could also apply to compensation for non-material damage under Article 82 of the GDPR.","paragraph_id":"para_166"},{"text":"68       It follows from the judgments of the Court, some of which were delivered after the present request for a preliminary ruling was lodged, that the fifth question must be answered in the negative.","paragraph_id":"para_167"},{"text":"69       The Court has held that, in view of the compensatory function of the right to compensation under Article 82 of the GDPR, national courts are required to ensure ‘full and effective’ compensation for the damage suffered, as stated in recital 146 of that regulation, without there being any nee …","paragraph_id":"para_168"},{"text":"70       In contrast to what is provided for in Article 83 of the GDPR for administrative fines, the criteria for which are not applicable mutatis mutandis in the context of Article 82 of that regulation, the right to compensation provided for in Article 82, in particular in the case of non-material …","paragraph_id":"para_169"},{"text":"71       Thus, first, establishing the liability of the controller under Article 82 of the GDPR is subject to fault on the part of the controller, which is presupposed unless the controller proves that it is not in any way responsible for the event giving rise to the damage and, second, Article 82 d …","paragraph_id":"para_170"},{"text":"72       More specifically, the exclusively compensatory function of the right to compensation provided for in Article 82(1) of the GDPR precludes the severity and possible intentional nature of the infringement of that regulation by the controller being taken into account for the purpose of compens …","paragraph_id":"para_171"},{"text":"73       In the light of the foregoing, the answer to the fifth question is that Article 82(1) of the GDPR must be interpreted as precluding the degree of seriousness of the fault on the part of the controller from being taken into account for the purpose of assessing the compensation for non-material damage payable under that article.","paragraph_id":"para_172"},{"text":"The sixth question","paragraph_id":"para_173"},{"text":"74       The sixth question is raised in the event that the Court answers either one part of the first question or the third question in the affirmative, that is to say, if it were to be held, in essence, that a right to require the controller to refrain in future from a further personal data breach …","paragraph_id":"para_174"},{"text":"75       In order to clarify the subject matter of the sixth question, the referring court states that, according to German law and its own case-law, the fact that a person who has suffered non-material damage has sought, or obtained, an order requiring the person responsible for that damage to refr …","paragraph_id":"para_175"},{"text":"76       Thus, by its question, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as meaning that the fact that the data subject has obtained, under the applicable national law, an injunction prohibiting the reiteration of an infringement of that regulation, …","paragraph_id":"para_176"},{"text":"77       In that regard, it must be borne in mind that, as mentioned in paragraph 66 above, the GDPR contains no provisions defining the rules for assessing damages payable under Article 82 of that regulation, with the result that national courts must, to that end, apply the domestic rules of each Member State relating to the extent of financial compensation, subject to compliance with the principles of equivalence and effectiveness of EU law.","paragraph_id":"para_177"},{"text":"78       In particular, it should be noted that the criteria for assessing the compensation payable in the context of actions intended to safeguard the rights which individuals derive from Article 82 of the GDPR, criteria which are prescribed within the legal system of each Member State, must ensure …","paragraph_id":"para_178"},{"text":"79       The Court has previously accepted that, within the limits stemming from the principle of effectiveness, certain circumstances may influence the assessment of compensation payable under Article 82 of the GDPR, especially in order to restrict that compensation. It has been held that, where th …","paragraph_id":"para_179"},{"text":"80       In the present case, the question referred seeks to determine whether, within the scope of Article 82 of the GDPR, a national court may take into account the fact that the data subject has been granted a prohibitory injunction in order to reduce the damages that may be awarded to that data …","paragraph_id":"para_180"},{"text":"81       It is apparent from the case-law referred to in paragraphs 78 and 79 above that a form of compensation provided for by the applicable national law may be regarded as compatible with the GDPR only in so far as that form of compensation is in line with the principles of equivalence and effectiveness of EU law, which presupposes, inter alia, that it is capable of ensuring that compensation for the damage suffered by the data subject is full and effective.","paragraph_id":"para_181"},{"text":"82       In particular, compensation payable under Article 82 of that regulation cannot be awarded, in part or in full, in the form of a prohibitory injunction, since the right to compensation for damage provided for in Article 82 fulfils an exclusively compensatory function, as recalled in paragrap …","paragraph_id":"para_182"},{"text":"83       In the light of the foregoing, the answer to the sixth question is that Article 82(1) of the GDPR must be interpreted as precluding the fact that the data subject has obtained, under the applicable national law, an injunction prohibiting the reiteration of an infringement of that regulation …","paragraph_id":"para_183"},{"text":"Costs","paragraph_id":"para_184"},{"text":"84       Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_185"},{"text":"On those grounds, the Court (Fourth Chamber) hereby rules:","paragraph_id":"para_186"},{"text":"1.       The provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),","paragraph_id":"para_187"},{"text":"must be interpreted as not providing, for the data subject concerned by the unlawful processing of personal data, in the event that that data subject does not request that his or her data be erased, a judicial remedy enabling him or her to obtain, as a preventive measure, an order that the controlle …","paragraph_id":"para_188"},{"text":"2.       Article 82(1) of Regulation 2016/679","paragraph_id":"para_189"},{"text":"must be interpreted as meaning that the concept of ‘non-material damage’ in that provision encompasses negative feelings experienced by the data subject as a result of an unauthorised transmission of his or her personal data to a third party, such as fear or annoyance, which are caused by a loss of …","paragraph_id":"para_190"},{"text":"3.       Article 82(1) of Regulation 2016/679","paragraph_id":"para_191"},{"text":"must be interpreted as precluding the degree of fault on the part of the controller from being taken into account for the purpose of assessing the compensation for non-material damage payable under that article.","paragraph_id":"para_192"},{"text":"4.       Article 82(1) of Regulation 2016/679","paragraph_id":"para_193"},{"text":"must be interpreted as precluding the fact that the data subject has obtained, under the applicable national law, an injunction to prohibit the reiteration of an infringement of that regulation, enforceable against the controller, from being taken into account in order to reduce the extent of the financial compensation for non-material damage payable under that article or, a fortiori, to replace that compensation.","paragraph_id":"para_194"},{"text":"[Signatures]","paragraph_id":"para_195"},{"text":"*       Language of the case: German.","paragraph_id":"para_196"}],"word_count":9728,"cites":["C-21/23","C-659/22","C-507/23","C-710/23","C-65/23","C-530/23","C-313/23","C-316/23","C-332/23","C-687/21","C-200/23","C-300/21","C-590/22","C-456/22"],"sha256":"9885748a3726abdc33e2fe467a50051b1387807b8baae8e6d2c43c92e459e2ae","source_url":"https://publications.europa.eu/resource/celex/62023CJ0655","fetched_at":"2026-09-30T17:30:34.141+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-655-23-62023cj0655","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-655-23-62023cj0655","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-655-23-62023cj0655","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-655-23-62023cj0655","verification":{"stored_sha256":"9885748a3726abdc33e2fe467a50051b1387807b8baae8e6d2c43c92e459e2ae","recomputed_sha256":"9885748a3726abdc33e2fe467a50051b1387807b8baae8e6d2c43c92e459e2ae","intact":true,"checked_at":"2026-10-15T07:26:22.597Z"}},"hash":"sha256:c1e190e82dcbd97ab077f5910f3f597065536d08da42a3980c34ec86b3638146","version":"legal-2026-10-15","expires":"2026-10-16T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-15+legal-2026-10-15+2026-10-15T06:23:03","content_hash":"sha256:c1e190e82dcbd97ab077f5910f3f597065536d08da42a3980c34ec86b3638146","revalidate_after":"2026-10-15T08:26:23.218Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-655-23-62023cj0655","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-655-23-62023cj0655"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-655-23-62023cj0655"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-655-23-62023cj0655"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":1},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-655-23-62023cj0655","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-c7bd50a4b791c82138a047e23595ce62","response_hash":"sha256:c1e190e82dcbd97ab077f5910f3f597065536d08da42a3980c34ec86b3638146"}},"freshness":{"freshness_class":"live","as_of":"2026-11-02T23:39:35.285Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-655-23-62023cj0655&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":16035}}