{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-667-21","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-667-21)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-11","fingerprint":"ewai:eu:20b464","proof":"sha256:85e4d21cfd9f571b7dade7fcc6dc1106670def2375503f78518cd803db122fd5","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-667-21","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62021CJ0667","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Third Chamber)","paragraphs":[]},{"title":"21 December 2023 (\n *1\n )","paragraphs":["para_4","para_5","para_6"]},{"title":"ZQ","paragraphs":["para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26","para_27"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_30"]},{"title":"2","paragraphs":["para_32"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"3","paragraphs":[]},{"title":"Recitals 4 to 8, 10, 35, 51 to 53, 75 and 146 of the GDPR are worded as follows:","paragraphs":["para_37","para_38"]},{"title":"(5)","paragraphs":["para_40"]},{"title":"(6)","paragraphs":["para_42"]},{"title":"(7)","paragraphs":["para_44"]},{"title":"(8)","paragraphs":["para_46","para_47"]},{"title":"(10)","paragraphs":["para_49","para_50"]},{"title":"(35)","paragraphs":["para_52","para_53"]},{"title":"(51)","paragraphs":["para_55"]},{"title":"(52)","paragraphs":["para_57"]},{"title":"(53)","paragraphs":["para_59","para_60"]},{"title":"(75)","paragraphs":["para_62","para_63"]},{"title":"(146)","paragraphs":["para_65"]},{"title":"4","paragraphs":["para_67","para_68"]},{"title":"5","paragraphs":[]},{"title":"Article 4 of that regulation, headed ‘Definitions’, provides:","paragraphs":["para_71"]},{"title":"(1)","paragraphs":["para_73"]},{"title":"(2)","paragraphs":["para_75","para_76"]},{"title":"(7)","paragraphs":["para_78","para_79"]},{"title":"(15)","paragraphs":["para_81","para_82"]},{"title":"6","paragraphs":["para_84"]},{"title":"7","paragraphs":["para_86","para_87"]},{"title":"(a)","paragraphs":["para_89","para_90"]},{"title":"(f)","paragraphs":["para_92","para_93"]},{"title":"8","paragraphs":["para_95","para_96"]},{"title":"(a)","paragraphs":["para_98"]},{"title":"(b)","paragraphs":["para_100"]},{"title":"(c)","paragraphs":["para_102"]},{"title":"(d)","paragraphs":["para_104"]},{"title":"(e)","paragraphs":["para_106"]},{"title":"(f)","paragraphs":["para_108","para_109"]},{"title":"9","paragraphs":["para_111","para_112"]},{"title":"2.   Paragraph 1 shall not apply if one of the following applies:","paragraphs":["para_114"]},{"title":"(b)","paragraphs":["para_116","para_117"]},{"title":"(h)","paragraphs":["para_119","para_120","para_121","para_122"]},{"title":"10","paragraphs":["para_124"]},{"title":"11","paragraphs":["para_126","para_127"]},{"title":"12","paragraphs":["para_129","para_130"]},{"title":"(a)","paragraphs":["para_132"]},{"title":"(b)","paragraphs":["para_134","para_135"]},{"title":"13","paragraphs":["para_137"]},{"title":"14","paragraphs":[]},{"title":"Under Article 82 of that regulation, entitled ‘Right to compensation and liability’:","paragraphs":["para_140","para_141","para_142","para_143"]},{"title":"15","paragraphs":["para_145","para_146","para_147"]},{"title":"(a)","paragraphs":["para_149"]},{"title":"(b)","paragraphs":["para_151","para_152"]},{"title":"(d)","paragraphs":["para_154","para_155"]},{"title":"(k)","paragraphs":["para_157","para_158","para_159"]},{"title":"16","paragraphs":[]},{"title":"Article 84 of that regulation, entitled ‘Penalties’, provides, in paragraph 1 thereof:","paragraphs":["para_162"]},{"title":"German law","paragraphs":[]},{"title":"17","paragraphs":["para_165"]},{"title":"18","paragraphs":["para_167"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"19","paragraphs":["para_170"]},{"title":"20","paragraphs":["para_172"]},{"title":"21","paragraphs":["para_174"]},{"title":"22","paragraphs":["para_176"]},{"title":"23","paragraphs":["para_178"]},{"title":"24","paragraphs":["para_180"]},{"title":"25","paragraphs":["para_182"]},{"title":"26","paragraphs":["para_184"]},{"title":"27","paragraphs":["para_186"]},{"title":"28","paragraphs":["para_188"]},{"title":"29","paragraphs":["para_190"]},{"title":"30","paragraphs":["para_192"]},{"title":"31","paragraphs":["para_194"]},{"title":"32","paragraphs":["para_196"]},{"title":"33","paragraphs":["para_198"]},{"title":"34","paragraphs":["para_200"]},{"title":"35","paragraphs":["para_202","para_203","para_204"]},{"title":"(2)","paragraphs":["para_206"]},{"title":"(3)","paragraphs":["para_208"]},{"title":"(4)","paragraphs":["para_210"]},{"title":"(5)","paragraphs":["para_212"]},{"title":"The questions referred for a preliminary ruling","paragraphs":[]},{"title":"The first question","paragraphs":[]},{"title":"36","paragraphs":["para_216"]},{"title":"37","paragraphs":["para_218"]},{"title":"38","paragraphs":["para_220"]},{"title":"39","paragraphs":["para_222"]},{"title":"40","paragraphs":["para_224"]},{"title":"41","paragraphs":["para_226"]},{"title":"42","paragraphs":["para_228"]},{"title":"43","paragraphs":["para_230"]},{"title":"44","paragraphs":["para_232"]},{"title":"45","paragraphs":["para_234"]},{"title":"46","paragraphs":["para_236"]},{"title":"47","paragraphs":["para_238"]},{"title":"48","paragraphs":["para_240"]},{"title":"49","paragraphs":["para_242"]},{"title":"50","paragraphs":["para_244"]},{"title":"51","paragraphs":["para_246"]},{"title":"52","paragraphs":["para_248"]},{"title":"53","paragraphs":["para_250"]},{"title":"54","paragraphs":["para_252"]},{"title":"55","paragraphs":["para_254"]},{"title":"56","paragraphs":["para_256"]},{"title":"57","paragraphs":["para_258"]},{"title":"58","paragraphs":["para_260"]},{"title":"The second question","paragraphs":[]},{"title":"59","paragraphs":["para_263"]},{"title":"60","paragraphs":["para_265"]},{"title":"61","paragraphs":["para_267"]},{"title":"62","paragraphs":["para_269"]},{"title":"63","paragraphs":["para_271"]},{"title":"64","paragraphs":["para_273"]},{"title":"65","paragraphs":["para_275"]},{"title":"66","paragraphs":["para_277"]},{"title":"67","paragraphs":["para_279"]},{"title":"68","paragraphs":["para_281"]},{"title":"69","paragraphs":["para_283"]},{"title":"70","paragraphs":["para_285"]},{"title":"The third question","paragraphs":[]},{"title":"71","paragraphs":["para_288"]},{"title":"72","paragraphs":["para_290"]},{"title":"73","paragraphs":["para_292"]},{"title":"74","paragraphs":["para_294"]},{"title":"75","paragraphs":["para_296"]},{"title":"76","paragraphs":["para_298"]},{"title":"77","paragraphs":["para_300"]},{"title":"78","paragraphs":["para_302"]},{"title":"79","paragraphs":["para_304"]},{"title":"The fourth question","paragraphs":[]},{"title":"80","paragraphs":["para_307"]},{"title":"81","paragraphs":["para_309"]},{"title":"82","paragraphs":["para_311"]},{"title":"83","paragraphs":["para_313"]},{"title":"84","paragraphs":["para_315"]},{"title":"85","paragraphs":["para_317"]},{"title":"86","paragraphs":["para_319"]},{"title":"87","paragraphs":["para_321"]},{"title":"The fifth question","paragraphs":[]},{"title":"88","paragraphs":["para_324"]},{"title":"89","paragraphs":["para_326"]},{"title":"90","paragraphs":["para_328"]},{"title":"91","paragraphs":["para_330"]},{"title":"92","paragraphs":["para_332"]},{"title":"93","paragraphs":["para_334"]},{"title":"94","paragraphs":["para_336"]},{"title":"95","paragraphs":["para_338"]},{"title":"96","paragraphs":["para_340"]},{"title":"97","paragraphs":["para_342"]},{"title":"98","paragraphs":["para_344"]},{"title":"99","paragraphs":["para_346"]},{"title":"100","paragraphs":["para_348"]},{"title":"101","paragraphs":["para_350"]},{"title":"102","paragraphs":["para_352"]},{"title":"103","paragraphs":["para_354"]},{"title":"Costs","paragraphs":[]},{"title":"104","paragraphs":["para_357"]},{"title":"On those grounds, the Court (Third Chamber) hereby rules:","paragraphs":["para_359","para_360","para_361","para_362"]},{"title":"Article 9(3) of Regulation 2016/679","paragraphs":["para_364","para_365"]},{"title":"Article 9(2)(h) and Article 6(1) of Regulation 2016/679","paragraphs":["para_367","para_368"]},{"title":"Article 82(1) of Regulation 2016/679","paragraphs":["para_370","para_371"]},{"title":"Article 82 of Regulation 2016/679","paragraphs":["para_373","para_374","para_375"]}],"paragraphs":[{"text":"62021CJ0667","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Third Chamber)","paragraph_id":"para_2"},{"text":"21 December 2023 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 6(1) – Conditions for lawful processing – Article 9(1) to (3) – Processing of special categories of data – Data concerning health – Assessment of an …","paragraph_id":"para_4"},{"text":"In Case C‑667/21,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Bundesarbeitsgericht (Federal Labour Court, Germany), made by decision of 26 August 2021, received at the Court on 8 November 2021, in the proceedings","paragraph_id":"para_6"},{"text":"ZQ","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts,","paragraph_id":"para_9"},{"text":"THE COURT (Third Chamber),","paragraph_id":"para_10"},{"text":"composed of K. Jürimäe, President of the Chamber, N. Piçarra, M. Safjan, N. Jääskinen (Rapporteur) and M. Gavalec, Judges,","paragraph_id":"para_11"},{"text":"Advocate General: M. Campos Sánchez‑Bordona,","paragraph_id":"para_12"},{"text":"Registrar: A. Calot Escobar,","paragraph_id":"para_13"},{"text":"having regard to the written procedure,","paragraph_id":"para_14"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_15"},{"text":"–","paragraph_id":"para_16"},{"text":"ZQ, by E. Daun, Rechtsanwalt,","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts, by M. Wehner, Rechtsanwalt,","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"Ireland, by M. Browne, Chief State Solicitor, A. Joyce and M. Lane, acting as Agents, and by D. Fennelly, Barrister-at-Law,","paragraph_id":"para_21"},{"text":"–","paragraph_id":"para_22"},{"text":"the Italian Government, by G. Palmieri, acting as Agent, and by M. Russo, avvocato dello Stato,","paragraph_id":"para_23"},{"text":"–","paragraph_id":"para_24"},{"text":"the European Commission, by A. Bouchagiar, M. Heller and H. Kranenborg, acting as Agents,","paragraph_id":"para_25"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 25 May 2023,","paragraph_id":"para_26"},{"text":"gives the following","paragraph_id":"para_27"},{"text":"Judgment","paragraph_id":"para_28"},{"text":"1","paragraph_id":"para_29"},{"text":"This request for a preliminary ruling concerns the interpretation of Article 9(1), (2)(h) and (3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of …","paragraph_id":"para_30"},{"text":"2","paragraph_id":"para_31"},{"text":"The request has been made in proceedings between ZQ and his employer, the Medizinischer Dienst der Krankenversicherung Nordrhein (medical service of the health insurance fund for North Rhine-Westphalia, Germany; ‘MDK Nordrhein’), concerning compensation for damage which the former party claims to have suffered as a result of the processing of data concerning his health which, it is claimed, was carried out unlawfully by the latter party.","paragraph_id":"para_32"},{"text":"Legal context","paragraph_id":"para_33"},{"text":"European Union law","paragraph_id":"para_34"},{"text":"3","paragraph_id":"para_35"},{"text":"Recitals 4 to 8, 10, 35, 51 to 53, 75 and 146 of the GDPR are worded as follows:","paragraph_id":"para_36"},{"text":"‘(4)","paragraph_id":"para_37"},{"text":"The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionali …","paragraph_id":"para_38"},{"text":"(5)","paragraph_id":"para_39"},{"text":"The economic and social integration resulting from the functioning of the internal market has led to a substantial increase in cross-border flows of personal data. The exchange of personal data between public and private actors, including natural persons, associations and undertakings across the Uni …","paragraph_id":"para_40"},{"text":"(6)","paragraph_id":"para_41"},{"text":"Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of the collection and sharing of personal data has increased significantly. Technology allows both private companies and public authorities to make use of personal data on an …","paragraph_id":"para_42"},{"text":"(7)","paragraph_id":"para_43"},{"text":"Those developments require a strong and more coherent data protection framework in the Union, backed by strong enforcement, given the importance of creating the trust that will allow the digital economy to develop across the internal market. Natural persons should have control of their own personal data. Legal and practical certainty for natural persons, economic operators and public authorities should be enhanced.","paragraph_id":"para_44"},{"text":"(8)","paragraph_id":"para_45"},{"text":"Where this Regulation provides for specifications or restrictions of its rules by Member State law, Member States may, as far as necessary for coherence and for making the national provisions comprehensible to the persons to whom they apply, incorporate elements of this Regulation into their national law.","paragraph_id":"para_46"},{"text":"…","paragraph_id":"para_47"},{"text":"(10)","paragraph_id":"para_48"},{"text":"In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the [European] Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in …","paragraph_id":"para_49"},{"text":"…","paragraph_id":"para_50"},{"text":"(35)","paragraph_id":"para_51"},{"text":"Personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject. …","paragraph_id":"para_52"},{"text":"…","paragraph_id":"para_53"},{"text":"(51)","paragraph_id":"para_54"},{"text":"Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. … In addition to the specific requirements for such proc …","paragraph_id":"para_55"},{"text":"(52)","paragraph_id":"para_56"},{"text":"Derogating from the prohibition on processing special categories of personal data should also be allowed when provided for in Union or Member State law and subject to suitable safeguards, so as to protect personal data and other fundamental rights, where it is in the public interest to do so, in par …","paragraph_id":"para_57"},{"text":"(53)","paragraph_id":"para_58"},{"text":"Special categories of personal data which merit higher protection should be processed for health-related purposes only where necessary to achieve those purposes for the benefit of natural persons and society as a whole, in particular in the context of the management of health or social care services …","paragraph_id":"para_59"},{"text":"…","paragraph_id":"para_60"},{"text":"(75)","paragraph_id":"para_61"},{"text":"The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial …","paragraph_id":"para_62"},{"text":"…","paragraph_id":"para_63"},{"text":"(146)","paragraph_id":"para_64"},{"text":"The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation. The controller or processor should be exempt from liability if it proves that it is not in any way responsible for the damage. The concept of damage should be …","paragraph_id":"para_65"},{"text":"4","paragraph_id":"para_66"},{"text":"Under Chapter I of that regulation, headed ‘General provisions’, Article 2 thereof, itself headed ‘Material scope’, provides in paragraph 1 thereof:","paragraph_id":"para_67"},{"text":"‘This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.’","paragraph_id":"para_68"},{"text":"5","paragraph_id":"para_69"},{"text":"Article 4 of that regulation, headed ‘Definitions’, provides:","paragraph_id":"para_70"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_71"},{"text":"(1)","paragraph_id":"para_72"},{"text":"“personal data” means any information relating to an identified or identifiable natural person (“data subject”); …","paragraph_id":"para_73"},{"text":"(2)","paragraph_id":"para_74"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means …","paragraph_id":"para_75"},{"text":"…","paragraph_id":"para_76"},{"text":"(7)","paragraph_id":"para_77"},{"text":"“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; …","paragraph_id":"para_78"},{"text":"…","paragraph_id":"para_79"},{"text":"(15)","paragraph_id":"para_80"},{"text":"“data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;","paragraph_id":"para_81"},{"text":"…’","paragraph_id":"para_82"},{"text":"6","paragraph_id":"para_83"},{"text":"Chapter II of the GDPR, on the ‘Principles’ laid down therein, comprises Articles 5 to 11 of that regulation.","paragraph_id":"para_84"},{"text":"7","paragraph_id":"para_85"},{"text":"Article 5 of that regulation, headed ‘Principles relating to processing of personal data’, provides:","paragraph_id":"para_86"},{"text":"‘1.   Personal data shall be:","paragraph_id":"para_87"},{"text":"(a)","paragraph_id":"para_88"},{"text":"processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);","paragraph_id":"para_89"},{"text":"…","paragraph_id":"para_90"},{"text":"(f)","paragraph_id":"para_91"},{"text":"processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).","paragraph_id":"para_92"},{"text":"2.   The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’","paragraph_id":"para_93"},{"text":"8","paragraph_id":"para_94"},{"text":"Article 6 of that regulation, headed ‘Lawfulness of processing’, provides in paragraph 1 thereof:","paragraph_id":"para_95"},{"text":"‘Processing shall be lawful only if and to the extent that at least one of the following applies:","paragraph_id":"para_96"},{"text":"(a)","paragraph_id":"para_97"},{"text":"the data subject has given consent to the processing of his or her personal data for one or more specific purposes;","paragraph_id":"para_98"},{"text":"(b)","paragraph_id":"para_99"},{"text":"processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;","paragraph_id":"para_100"},{"text":"(c)","paragraph_id":"para_101"},{"text":"processing is necessary for compliance with a legal obligation to which the controller is subject;","paragraph_id":"para_102"},{"text":"(d)","paragraph_id":"para_103"},{"text":"processing is necessary in order to protect the vital interests of the data subject or of another natural person;","paragraph_id":"para_104"},{"text":"(e)","paragraph_id":"para_105"},{"text":"processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;","paragraph_id":"para_106"},{"text":"(f)","paragraph_id":"para_107"},{"text":"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.","paragraph_id":"para_108"},{"text":"Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.’","paragraph_id":"para_109"},{"text":"9","paragraph_id":"para_110"},{"text":"Article 9 of that regulation, entitled ‘Processing of special categories of personal data’, is worded as follows:","paragraph_id":"para_111"},{"text":"‘1.   Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.","paragraph_id":"para_112"},{"text":"2.   Paragraph 1 shall not apply if one of the following applies:","paragraph_id":"para_113"},{"text":"…","paragraph_id":"para_114"},{"text":"(b)","paragraph_id":"para_115"},{"text":"processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;","paragraph_id":"para_116"},{"text":"…","paragraph_id":"para_117"},{"text":"(h)","paragraph_id":"para_118"},{"text":"processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;","paragraph_id":"para_119"},{"text":"…","paragraph_id":"para_120"},{"text":"3.   Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.","paragraph_id":"para_121"},{"text":"4.   Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health.’","paragraph_id":"para_122"},{"text":"10","paragraph_id":"para_123"},{"text":"Chapter IV of the GDPR, entitled ‘Controller and processor’, contains Articles 24 to 43 of that regulation.","paragraph_id":"para_124"},{"text":"11","paragraph_id":"para_125"},{"text":"In Section 1 of that chapter, entitled ‘General obligations’, Article 24 of that regulation, entitled ‘Responsibility of the controller’, provides in paragraph 1 thereof:","paragraph_id":"para_126"},{"text":"‘Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.’","paragraph_id":"para_127"},{"text":"12","paragraph_id":"para_128"},{"text":"Contained in Section 2 of that chapter, which is headed ‘Security of personal data’, Article 32 of that regulation, itself headed ‘Security of processing’, provides in paragraph 1 thereof:","paragraph_id":"para_129"},{"text":"‘Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:","paragraph_id":"para_130"},{"text":"(a)","paragraph_id":"para_131"},{"text":"the pseudonymisation and encryption of personal data;","paragraph_id":"para_132"},{"text":"(b)","paragraph_id":"para_133"},{"text":"the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;","paragraph_id":"para_134"},{"text":"…’","paragraph_id":"para_135"},{"text":"13","paragraph_id":"para_136"},{"text":"Chapter VIII of the GDPR, entitled ‘Remedies, liability and penalties’, contains Articles 77 to 84 of that regulation.","paragraph_id":"para_137"},{"text":"14","paragraph_id":"para_138"},{"text":"Under Article 82 of that regulation, entitled ‘Right to compensation and liability’:","paragraph_id":"para_139"},{"text":"‘1.   Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.","paragraph_id":"para_140"},{"text":"2.   Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. …","paragraph_id":"para_141"},{"text":"3.   A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.","paragraph_id":"para_142"},{"text":"…’","paragraph_id":"para_143"},{"text":"15","paragraph_id":"para_144"},{"text":"Article 83 of that regulation, entitled ‘General conditions for imposing administrative fines’, provides:","paragraph_id":"para_145"},{"text":"‘1.   Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.","paragraph_id":"para_146"},{"text":"2.   … When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:","paragraph_id":"para_147"},{"text":"(a)","paragraph_id":"para_148"},{"text":"the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;","paragraph_id":"para_149"},{"text":"(b)","paragraph_id":"para_150"},{"text":"the intentional or negligent character of the infringement;","paragraph_id":"para_151"},{"text":"…","paragraph_id":"para_152"},{"text":"(d)","paragraph_id":"para_153"},{"text":"the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;","paragraph_id":"para_154"},{"text":"…","paragraph_id":"para_155"},{"text":"(k)","paragraph_id":"para_156"},{"text":"any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.","paragraph_id":"para_157"},{"text":"3.   If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement.","paragraph_id":"para_158"},{"text":"…’","paragraph_id":"para_159"},{"text":"16","paragraph_id":"para_160"},{"text":"Article 84 of that regulation, entitled ‘Penalties’, provides, in paragraph 1 thereof:","paragraph_id":"para_161"},{"text":"‘Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive.’","paragraph_id":"para_162"},{"text":"German law","paragraph_id":"para_163"},{"text":"17","paragraph_id":"para_164"},{"text":"Under Paragraph 275(1) of the Sozialgesetzbuch, Fünftes Buch (Book V of the Social Code), in the version applicable to the dispute in the main proceedings, statutory health insurance funds are required to ask a Medizinischer Dienst (medical service) which assists those funds, in particular, to prepare an expert report in order to dispel doubts as to an insured person’s incapacity for work, in the cases determined by law or where the insured person’s illness so requires.","paragraph_id":"para_165"},{"text":"18","paragraph_id":"para_166"},{"text":"Paragraph 278(1) of that code provides that such a medical service is to be established in every federal state in the form of a body governed by public law.","paragraph_id":"para_167"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_168"},{"text":"19","paragraph_id":"para_169"},{"text":"MDK Nordrhein is a body governed by public law which, as a medical service for health insurance funds, has the statutory task, inter alia, of drawing up expert medical reports to remove doubts as to the incapacity for work of persons insured with the statutory health insurance funds under its responsibility, including where such reports concern its own employees.","paragraph_id":"para_170"},{"text":"20","paragraph_id":"para_171"},{"text":"In such a case, only the members of the ‘special case organisational unit’ are authorised to process that employee’s ‘social’ data, using a locked area of MDK Nordrhein’s IT system, and to access the electronic archives once an assignment has been completed. An internal operating manual relating to those cases provides, inter alia, that a limited number of authorised staff, including certain members of the IT department, have access to those data.","paragraph_id":"para_172"},{"text":"21","paragraph_id":"para_173"},{"text":"The applicant in the main proceedings worked in the IT department of MDK Nordrhein before being declared unfit for work on medical grounds. At the end of the six-month period during which that body, as an employer, continued to pay him, the statutory health insurance fund to which he was affiliated began to pay him sickness benefits.","paragraph_id":"para_174"},{"text":"22","paragraph_id":"para_175"},{"text":"That fund then asked MDK Nordrhein to prepare an expert report on the incapacity for work of the applicant in the main proceedings. A doctor working in the ‘special case organisational unit’ of MDK Nordrhein prepared the expert report, inter alia, by obtaining information from the doctor treating th …","paragraph_id":"para_176"},{"text":"23","paragraph_id":"para_177"},{"text":"Taking the view that data concerning his health data had thus been unlawfully processed by his employer, the applicant in the main proceedings asked the employer to pay him compensation in the amount of EUR 20000, which MDK Nordrhein refused.","paragraph_id":"para_178"},{"text":"24","paragraph_id":"para_179"},{"text":"Subsequently, the applicant in the main proceedings brought an action before the Arbeitsgericht Düsseldorf (Labour Court, Düsseldorf, Germany) seeking, on the basis of Article 82(1) of the GDPR and provisions of German law, an order that MDK Nordrhein pay compensation for the damage which he claims …","paragraph_id":"para_180"},{"text":"25","paragraph_id":"para_181"},{"text":"In its defence, MDK Nordrhein argued principally that the collection and storage of data concerning the health of the applicant in the main proceedings had been carried out in accordance with the provisions relating to the protection of such data.","paragraph_id":"para_182"},{"text":"26","paragraph_id":"para_183"},{"text":"After his action at first instance was dismissed, the applicant in the main proceedings brought an appeal before the Landesarbeitsgericht Düsseldorf (Higher Labour Court, Düsseldorf, Germany), which also dismissed his action. He then brought an appeal on a point of law before the Bundesarbeitsgericht (Federal Labour Court, Germany), which is the referring court in the present case.","paragraph_id":"para_184"},{"text":"27","paragraph_id":"para_185"},{"text":"The referring court starts from the premiss that, in the dispute in the main proceedings, the expert report prepared by MDK Nordrhein, in its capacity as a medical service, constitutes ‘processing’ of ‘personal data’ and, more specifically, ‘data concerning health’ within the meaning of Article 4(1) …","paragraph_id":"para_186"},{"text":"28","paragraph_id":"para_187"},{"text":"Its questions concern, in the first place, the interpretation of several provisions of Article 9 of the GDPR, which relates to the processing of special categories of personal data, in particular in view of the fact that the processing at issue in the main proceedings was carried out by a body which is also the employer of the data subject, as defined in Article 4(1) of that regulation.","paragraph_id":"para_188"},{"text":"29","paragraph_id":"para_189"},{"text":"First of all, the referring court doubts whether the processing of the data concerning health at issue in the main proceedings can fall under one of the exceptions provided for in Article 9(2) of the GDPR. According to that court, only the exceptions set out in Article 9(2)(b) and (h) of the GDPR ar …","paragraph_id":"para_190"},{"text":"30","paragraph_id":"para_191"},{"text":"Next, in the event that the processing of data concerning health is authorised in such circumstances under Article 9(2)(h) of the GDPR, the referring court asks about the rules relating to the protection of data concerning health which must be complied with in that context. In its view, that regulat …","paragraph_id":"para_192"},{"text":"31","paragraph_id":"para_193"},{"text":"Lastly, still in the same situation, that court wishes to ascertain whether at least one of the conditions set out in Article 6(1) of the GDPR must, in addition, be satisfied in order for such processing to be lawful. In its view, that should be the case and, in the context of the dispute in the mai …","paragraph_id":"para_194"},{"text":"32","paragraph_id":"para_195"},{"text":"In the second place, in the event that an infringement of the GDPR is established in the present case, the referring court raises the question of the possible compensation due to the applicant in the main proceedings under Article 82 of that regulation.","paragraph_id":"para_196"},{"text":"33","paragraph_id":"para_197"},{"text":"First, it wishes to know whether the rule laid down in Article 82(1) of the GDPR is dissuasive or punitive in nature, in addition to its compensatory function, and, where appropriate, whether that character should be taken into account when determining the amount of damages awarded for non-material damage, in particular having regard to the principles of effectiveness, proportionality and equivalence enshrined in other areas of EU law.","paragraph_id":"para_198"},{"text":"34","paragraph_id":"para_199"},{"text":"Secondly, that court suggests that the controller may be held liable on the basis of Article 82(1) of the GDPR, without there being any need to establish that it has acted wrongfully. As the referring court has doubts, however, principally in the light of rules of German law, it asks whether it is n …","paragraph_id":"para_200"},{"text":"35","paragraph_id":"para_201"},{"text":"In those circumstances, the Bundesarbeitsgericht (Federal Labour Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_202"},{"text":"‘(1)","paragraph_id":"para_203"},{"text":"Is Article 9(2)(h) of [the GDPR] to be interpreted as prohibiting a medical service of a health insurance fund from processing its employee’s data concerning health which are a prerequisite for the assessment of that employee’s working capacity?","paragraph_id":"para_204"},{"text":"(2)","paragraph_id":"para_205"},{"text":"If the Court answers Question 1 in the negative, with the consequence that an exception to the prohibition on the processing of data concerning health laid down in Article 9(1) of the GDPR is possible under Article 9(2)(h) of the GDPR: in a case such as the present one, are there further data protection requirements, beyond the conditions set out in Article 9(3) of the GDPR, that must be complied with, and, if so, which ones?","paragraph_id":"para_206"},{"text":"(3)","paragraph_id":"para_207"},{"text":"If the Court answers Question 1 in the negative, with the consequence that an exception to the prohibition on the processing of data concerning health laid down in Article 9(1) of the GDPR is possible under Article 9(2)(h) of the GDPR: does the permissibility or lawfulness of the processing of data concerning health depend on the fulfilment of at least one of the conditions set out in Article 6(1) of the GDPR?","paragraph_id":"para_208"},{"text":"(4)","paragraph_id":"para_209"},{"text":"Does Article 82(1) of the GDPR have a specific or general preventive character, and must that be taken into account in the assessment of the amount of non-material damage to be compensated at the expense of the controller or processor on the basis of Article 82(1) of the GDPR?","paragraph_id":"para_210"},{"text":"(5)","paragraph_id":"para_211"},{"text":"Is the degree of fault on the part of the controller or processor a decisive factor in the assessment of the amount of non-material damage to be compensated on the basis of Article 82(1) of the GDPR? In particular, can non-existent or minor fault on the part of the controller or processor be taken into account in their favour?’","paragraph_id":"para_212"},{"text":"The questions referred for a preliminary ruling","paragraph_id":"para_213"},{"text":"The first question","paragraph_id":"para_214"},{"text":"36","paragraph_id":"para_215"},{"text":"By its first question, the referring court asks, in essence, whether, having regard to the prohibition on processing data concerning health laid down in Article 9(1) of the GDPR, Article 9(2)(h) of that regulation must be interpreted as meaning that the exception that it provides for is applicable t …","paragraph_id":"para_216"},{"text":"37","paragraph_id":"para_217"},{"text":"According to settled case-law, the interpretation of a provision of EU law requires account to be taken not only of its wording, but also of the context in which it occurs, as well as the objectives and purpose pursued by the act of which it forms part. The legislative history of a provision of EU law may also reveal elements that are relevant to its interpretation (judgment of 16 March 2023, Towercast, C‑449/21 , EU:C:2023:207 , paragraph  31 and the case-law cited).","paragraph_id":"para_218"},{"text":"38","paragraph_id":"para_219"},{"text":"In the first place, it should be recalled that Article 9 of the GDPR concerns, as its title indicates, the ‘processing of special categories of personal data’, also classified as ‘sensitive’ data in recitals 10 and 51 of that regulation.","paragraph_id":"para_220"},{"text":"39","paragraph_id":"para_221"},{"text":"Recital 51 of the GDPR states that personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms.","paragraph_id":"para_222"},{"text":"40","paragraph_id":"para_223"},{"text":"Thus, Article 9(1) of the GDPR lays down the principle that processing relating to the special categories of personal data listed therein is prohibited. Those categories include ‘data concerning health’, as defined in Article 4(15) of that regulation, read in the light of recital 35 thereof, which are the subject of the present case.","paragraph_id":"para_224"},{"text":"41","paragraph_id":"para_225"},{"text":"The Court has clarified that the purpose of Article 9(1) of that regulation is to ensure enhanced protection as regards processing which, because of the particular sensitivity of the data processed, is liable to constitute a particularly serious interference with the fundamental rights to respect fo …","paragraph_id":"para_226"},{"text":"42","paragraph_id":"para_227"},{"text":"Article 9(2)(a) to (j) of the GDPR provides, however, an exhaustive list of exceptions to the principle that the processing of such sensitive data is prohibited.","paragraph_id":"para_228"},{"text":"43","paragraph_id":"para_229"},{"text":"In particular, Article 9(2)(h) of the GDPR authorises such processing if it is ‘necessary for the purposes of [inter alia] the assessment of the working capacity of the employee … on the basis of Union or Member State law or pursuant to contract with a health professional’. That provision states that any processing based on it is, moreover, specifically ‘subject to the conditions and safeguards referred to in paragraph 3’ of Article 9.","paragraph_id":"para_230"},{"text":"44","paragraph_id":"para_231"},{"text":"It follows from Article 9(2)(h) of the GDPR, read in conjunction with Article 9(3), that the possibility of processing sensitive data, such as data concerning health, is strictly regulated by a series of cumulative conditions. The latter relate, first, to the purposes listed in point (h) – which inc …","paragraph_id":"para_232"},{"text":"45","paragraph_id":"para_233"},{"text":"As the Advocate General points out, in essence, in points 32 and 33 of his Opinion, neither the wording of Article 9(2)(h) of the GDPR nor the legislative history of that provision provides any evidence to suggest that the application of the derogation provided for in that provision is reserved, as …","paragraph_id":"para_234"},{"text":"46","paragraph_id":"para_235"},{"text":"In the light of the referring court’s view that, in essence, a body should not be able to rely on its ‘dual function’ as employer of the data subject and as a medical service in order to circumvent the principle of the prohibition on processing data concerning health, set out in Article 9(1) of the GDPR, it must be stated that it is crucial to take into consideration the capacity in which the processing of those data is carried out.","paragraph_id":"para_236"},{"text":"47","paragraph_id":"para_237"},{"text":"Although Article 9(1) prohibits, as a matter of principle, the processing of data concerning health, Article 9(2) provides, in points (a) to (j), ten derogations which are independent of each other and which must therefore be assessed independently. It follows that the fact that the conditions for t …","paragraph_id":"para_238"},{"text":"48","paragraph_id":"para_239"},{"text":"It follows from the foregoing that Article 9(2)(h) of the GDPR, read in conjunction with Article 9(3), in no way excludes the applicability of the exception set out in that point (h) to situations in which a medical examination body processes data concerning the health of one of its employees in its capacity as a medical service and not in its capacity as an employer, in order to assess the working capacity of that employee.","paragraph_id":"para_240"},{"text":"49","paragraph_id":"para_241"},{"text":"In the second place, such an interpretation is supported by taking into consideration the system of which Article 9(2)(h) of the GDPR forms part and the objectives pursued by that regulation and that provision.","paragraph_id":"para_242"},{"text":"50","paragraph_id":"para_243"},{"text":"First, admittedly, in so far as it provides for an exception to the principle that the processing of special categories of personal data is prohibited, Article 9(2) of the GDPR must be interpreted strictly (judgment of 4 July 2023, Meta Platforms and Others(General terms of use of a social network), C‑252/21 , EU:C:2023:537 , paragraph  76 ).","paragraph_id":"para_244"},{"text":"51","paragraph_id":"para_245"},{"text":"However, compliance with the principle of prohibition set out in Article 9(1) of the GDPR cannot have the effect of reducing the scope of another provision of that regulation in a manner which would run counter to the clear wording of that provision. The suggested interpretation, according to which …","paragraph_id":"para_246"},{"text":"52","paragraph_id":"para_247"},{"text":"In that regard, it is irrelevant that in the present case, in the event that the MDK Nordrhein is prohibited from performing its task as a medical service where one of its own employees is involved, a different medical examination body is in a position to do so. It is important to point out that tha …","paragraph_id":"para_248"},{"text":"53","paragraph_id":"para_249"},{"text":"Secondly, the interpretation set out in paragraph 48 of this judgment is consistent with the objectives of the GDPR and those of Article 9 of that regulation.","paragraph_id":"para_250"},{"text":"54","paragraph_id":"para_251"},{"text":"Thus, recital 4 of the GDPR states that the right to the protection of personal data is not an absolute right, since it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality (see, to that effect …","paragraph_id":"para_252"},{"text":"55","paragraph_id":"para_253"},{"text":"Those considerations apply even where the data concerned fall within the special categories referred to in Article 9 of that regulation (see, to that effect, judgment of 24 September 2019, GC and Others(De-referencing of sensitive data), C‑136/17 , EU:C:2019:773 , paragraphs  57 and  66 to  68 ), such as data concerning health.","paragraph_id":"para_254"},{"text":"56","paragraph_id":"para_255"},{"text":"More specifically, it is apparent from recital 52 of the GDPR that ‘derogating from the prohibition on processing special categories of personal data’ should be allowed ‘where it is in the public interest to do so, in particular … in the field of employment law [and] social protection law’, and ‘for …","paragraph_id":"para_256"},{"text":"57","paragraph_id":"para_257"},{"text":"It is from that overall perspective and having regard to the various legitimate interests involved that the EU legislature provided, in Article 9(2)(h) of the GDPR, for the possibility of derogating from the principle of the prohibition on processing data concerning health, set out in Article 9(1) t …","paragraph_id":"para_258"},{"text":"58","paragraph_id":"para_259"},{"text":"In the light of the foregoing reasons, and without prejudice to the answers which will be given to the second and third questions, the answer to the first question is that Article 9(2)(h) of the GDPR must be interpreted as meaning that the exception provided for in that provision is applicable to si …","paragraph_id":"para_260"},{"text":"The second question","paragraph_id":"para_261"},{"text":"59","paragraph_id":"para_262"},{"text":"According to the referring court, it is apparent from recitals 35, 51, 53 and 75 of the GDPR that it is not sufficient to satisfy the requirements of Article 9(3) thereof in a situation such as that at issue in the main proceedings where the controller is also the employer of the person whose workin …","paragraph_id":"para_263"},{"text":"60","paragraph_id":"para_264"},{"text":"In those circumstances, by its second question, the referring court seeks, in essence, to ascertain whether the provisions of the GDPR must be interpreted as meaning that the controller of data concerning health, based on Article 9(2)(h) of that regulation, is required to ensure that no colleague of the data subject can access data relating to his or her state of health.","paragraph_id":"para_265"},{"text":"61","paragraph_id":"para_266"},{"text":"It should be recalled that, under Article 9(3) of the GDPR, processing of data for the purposes listed in Article 9(1) and (2)(h) respectively – in the present case, data concerning the health of a worker for the purposes of assessing the working capacity of that employee – may take place only if th …","paragraph_id":"para_267"},{"text":"62","paragraph_id":"para_268"},{"text":"By adopting Article 9(3) of that regulation, which refers specifically to Article 9(2)(h) of that article, the EU legislature defined the specific protection measures it intended to impose on controllers of such processing, which consist in such processing being reserved to persons subject to an obl …","paragraph_id":"para_269"},{"text":"63","paragraph_id":"para_270"},{"text":"It follows, as the Advocate General points out in essence in point 43 of his Opinion, that Article 9(3) of the GDPR cannot serve as a legal basis for a measure guaranteeing that no colleague of the data subject may have access to data relating to the data subject’s state of health.","paragraph_id":"para_271"},{"text":"64","paragraph_id":"para_272"},{"text":"It is, however, necessary to assess whether the requirement to ensure that none of the data subject’s colleagues have access to data relating to his or her state of health may be imposed on the controller of data concerning health, based on Article 9(2)(h) of the GDPR, on the basis of another provision of that regulation.","paragraph_id":"para_273"},{"text":"65","paragraph_id":"para_274"},{"text":"In that regard, it must be stated that the only possibility for Member States to add such a requirement to those set out in Article 9(2) and (3) of that regulation lies in the power conferred on them by Article 9(4) to ‘maintain or introduce further conditions, including limitations, with regard to the processing of … data concerning health’.","paragraph_id":"para_275"},{"text":"66","paragraph_id":"para_276"},{"text":"However, any such additional conditions do not derive from the provisions of the GDPR as such but, where applicable, from rules of national law governing processing of that type, in respect of which the regulation expressly leaves a margin of discretion to the Member States (see, to that effect, judgment of 30 March 2023, Hauptpersonalrat der Lehrerinnen und Lehrer, C‑34/21 , EU:C:2023:270 , paragraphs  51 and  78 ).","paragraph_id":"para_277"},{"text":"67","paragraph_id":"para_278"},{"text":"It should also be pointed out that a Member State which intends to avail itself of the option provided for in Article 9(4) of that regulation must, in accordance with the principle of proportionality, ensure that the practical consequences, in particular of an organisational, economic and medical na …","paragraph_id":"para_279"},{"text":"68","paragraph_id":"para_280"},{"text":"Lastly, it must be pointed out that, under Article 32(1)(a) and (b) of the GDPR, which gives specific expression to the principles of integrity and confidentiality set out in Article 5(1)(f) of that regulation, any controller of personal data is required to implement appropriate technical and organi …","paragraph_id":"para_281"},{"text":"69","paragraph_id":"para_282"},{"text":"However, it will be for the referring court to assess whether all the technical and organisational measures implemented, in the present case, by MDK Nordrhein comply with the requirements of Article 32(1)(a) and (b) of the GDPR.","paragraph_id":"para_283"},{"text":"70","paragraph_id":"para_284"},{"text":"The answer to the second question must therefore be that Article 9(3) of the GDPR must be interpreted as meaning that the controller of data concerning health, based on Article 9(2)(h) of that regulation, is not required, under those provisions, to ensure that no colleague of the data subject can ac …","paragraph_id":"para_285"},{"text":"The third question","paragraph_id":"para_286"},{"text":"71","paragraph_id":"para_287"},{"text":"By its third question, the referring court asks, in essence, whether Article 9(2)(h) and Article 6(1) of the GDPR must be interpreted as meaning that the processing of data concerning health based on the first provision must, in order to be lawful, not only comply with the requirements arising from that provision, but must also satisfy at least one of the conditions of lawfulness set out in Article 6(1) of that regulation.","paragraph_id":"para_288"},{"text":"72","paragraph_id":"para_289"},{"text":"In that regard, it should be recalled that Articles 5, 6 and 9 of the GDPR are in Chapter II of that regulation, entitled ‘Principles’, and concern principles relating to processing of personal data, conditions for the lawfulness of processing and processing of special categories of personal data, respectively.","paragraph_id":"para_290"},{"text":"73","paragraph_id":"para_291"},{"text":"In addition, it should be noted that recital 51 of the GDPR expressly states that, ‘in addition to the specific requirements’ for the processing of ‘particularly sensitive’ data, which are set out in Article 9(2) and (3) of that regulation, without prejudice to any measures adopted by a Member State …","paragraph_id":"para_292"},{"text":"74","paragraph_id":"para_293"},{"text":"Therefore, in accordance with the first subparagraph of Article 6(1) of the GDPR, processing of ‘particularly sensitive’ data, such as data concerning health, is lawful only if at least one of the conditions set out in points (a) to (f) of the first subparagraph of Article 6(1) is satisfied.","paragraph_id":"para_294"},{"text":"75","paragraph_id":"para_295"},{"text":"The first subparagraph of Article 6(1) of that regulation sets out an exhaustive and restrictive list of the cases in which the processing of personal data can be regarded as lawful. Thus, in order to be capable of being regarded as such, processing must fall within one of the cases provided for in that provision (judgment of 4 July 2023, Meta Platforms and Others(General terms of use of a social network), C‑252/21 , EU:C:2023:537 , paragraph  90 and the case-law cited).","paragraph_id":"para_296"},{"text":"76","paragraph_id":"para_297"},{"text":"Therefore, the Court has repeatedly held that any processing of personal data must comply with the principles relating to the processing of data which are set out in Article 5(1) of the GDPR and satisfy the conditions governing lawfulness of the processing which are listed in Article 6 of that regulation (judgment of 4 May 2023, Bundesrepublik Deutschland (Court electronic mailbox), C‑60/22 , EU:C:2023:373 , paragraph  57 and the case-law cited).","paragraph_id":"para_298"},{"text":"77","paragraph_id":"para_299"},{"text":"Furthermore, it has already been held that, in so far as Articles 7 to 11 of the GDPR, which appear, like Articles 5 and 6 thereof, in Chapter II of that regulation, are intended to clarify the scope of the data controller’s obligations under Article 5(1)(a) and Article 6(1) of that regulation, the …","paragraph_id":"para_300"},{"text":"78","paragraph_id":"para_301"},{"text":"It follows, in particular, that in so far as the purpose of Article 9(2)(h) of the GDPR is to clarify the scope of the data controller’s obligations under Article 5(1)(a) and Article 6(1) of that regulation, the processing of data concerning health which is based on the first provision must, in orde …","paragraph_id":"para_302"},{"text":"79","paragraph_id":"para_303"},{"text":"In the light of the foregoing, the answer to the third question is that Article 9(2)(h) and Article 6(1) of the GDPR must be interpreted as meaning that the processing of data concerning health based on the first provision must, in order to be lawful, not only comply with the requirements arising from that provision, but must also satisfy at least one of the conditions of lawfulness set out in Article 6(1) of that regulation.","paragraph_id":"para_304"},{"text":"The fourth question","paragraph_id":"para_305"},{"text":"80","paragraph_id":"para_306"},{"text":"By its fourth question, the referring court wishes to ascertain, in essence, whether Article 82(1) of the GDPR must be interpreted as meaning that the right to compensation provided for in that provision fulfils not only a compensatory function but also a dissuasive or punitive function and, if so, whether that function may be taken into account when determining the amount of damages awarded as compensation for non-material damage on the basis of that provision.","paragraph_id":"para_307"},{"text":"81","paragraph_id":"para_308"},{"text":"It should be recalled that Article 82(1) of the GDPR states that ‘any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered’.","paragraph_id":"para_309"},{"text":"82","paragraph_id":"para_310"},{"text":"The Court has interpreted that provision as meaning that a mere infringement of the GDPR is not sufficient to confer a right to compensation, after pointing out, inter alia, that the existence of ‘damage’ which has been ‘suffered’ constitutes one of the conditions for the right to compensation laid …","paragraph_id":"para_311"},{"text":"83","paragraph_id":"para_312"},{"text":"In addition, the Court has held that, since the GDPR does not contain any provision intended to define the rules on the assessment of the damages payable under the right to compensation enshrined in Article 82 of that regulation, national courts must, to that end, apply, in accordance with the princ …","paragraph_id":"para_313"},{"text":"84","paragraph_id":"para_314"},{"text":"In that context and having regard to the sixth sentence of recital 146 of the GDPR, in accordance with which that instrument is intended to ensure ‘full and effective compensation for the damage they have suffered’, the Court has noted that, in view of the compensatory function of the right to compe …","paragraph_id":"para_315"},{"text":"85","paragraph_id":"para_316"},{"text":"In that regard, it must be pointed out that Article 82 of the GDPR has a compensatory rather than a punitive function, unlike other provisions of that regulation which are also in Chapter VIII thereof, namely Articles 83 and 84, which have essentially a punitive purpose since they permit the imposit …","paragraph_id":"para_317"},{"text":"86","paragraph_id":"para_318"},{"text":"Since the right to compensation provided for in Article 82(1) of the GDPR does not have a dissuasive or even a punitive function, as envisaged by the referring court, the seriousness of the infringement of that regulation which caused the damage in question cannot influence the amount of damages awa …","paragraph_id":"para_319"},{"text":"87","paragraph_id":"para_320"},{"text":"Consequently, the answer to the fourth question is that Article 82(1) of the GDPR must be interpreted as meaning that the right to compensation provided for in that provision fulfils a compensatory function, in that financial compensation based on that provision must allow the damage actually suffered as a result of the infringement of that regulation to be compensated in its entirety, and not a dissuasive or punitive function.","paragraph_id":"para_321"},{"text":"The fifth question","paragraph_id":"para_322"},{"text":"88","paragraph_id":"para_323"},{"text":"It is apparent from the information provided by the referring court, in response to a request for clarification addressed to it in accordance with Article 101 of the Rules of Procedure of the Court of Justice, that the fifth question seeks to determine, first, whether the existence and/or proof of a …","paragraph_id":"para_324"},{"text":"89","paragraph_id":"para_325"},{"text":"In the light of that response from the referring court, the fifth question must be understood as seeking, in essence, to ascertain, first, whether Article 82 of the GDPR must be interpreted as meaning that the establishment of liability on the part of the controller is subject to the existence of a …","paragraph_id":"para_326"},{"text":"90","paragraph_id":"para_327"},{"text":"As regards the first part of that question, it should be noted that, as recalled in paragraph 82 of this judgment, Article 82(1) of the GDPR makes the right to compensation contingent on the presence of three factors, namely the existence of an infringement of that regulation, the existence of damage suffered and the existence of a causal link between that infringement and that damage.","paragraph_id":"para_328"},{"text":"91","paragraph_id":"para_329"},{"text":"Article 82(2) of the GDPR provides that any controller involved in processing is to be liable for the damage caused by processing which infringes that regulation. The wording of that provision in some of its language versions, in particular the German version, which is the language of the present case, does not make it possible to determine with certainty whether the infringement in question must be attributable to the controller in order for it to be held liable.","paragraph_id":"para_330"},{"text":"92","paragraph_id":"para_331"},{"text":"In that regard, it is apparent from an analysis of the different language versions of the first sentence of Article 82(2) of the GDPR that the controller is presumed to have participated in the processing that constitutes the infringement of that regulation referred to. While the German, French and …","paragraph_id":"para_332"},{"text":"93","paragraph_id":"para_333"},{"text":"Article 82(3) of the GDPR specifies, from that perspective, that a controller is exempt from liability under Article 82(2) of that regulation if it proves that it is not in any way responsible for the event giving rise to the damage.","paragraph_id":"para_334"},{"text":"94","paragraph_id":"para_335"},{"text":"It therefore follows from a combined analysis of those various provisions of Article 82 of the GDPR that that article provides for fault-based liability in which the burden of proof rests not on the person who has suffered damage, but on the controller.","paragraph_id":"para_336"},{"text":"95","paragraph_id":"para_337"},{"text":"Such an interpretation is borne out by the context of Article 82 and by the objectives pursued by the EU legislature through the GDPR.","paragraph_id":"para_338"},{"text":"96","paragraph_id":"para_339"},{"text":"In that regard, first, it is apparent from the wording of Articles 24 and 32 of the GDPR that those provisions merely require the controller to adopt technical and organisational measures intended to avoid, in so far as it is at all possible, any personal data breach. The appropriateness of such mea …","paragraph_id":"para_340"},{"text":"97","paragraph_id":"para_341"},{"text":"Such an obligation would be called into question if the controller were then required to compensate for any damage caused by processing carried out in breach of the GDPR.","paragraph_id":"para_342"},{"text":"98","paragraph_id":"para_343"},{"text":"Secondly, with regard to the objectives of the GDPR, it is clear from recitals 4 to 8 of that regulation that it seeks to strike a balance between the interests of controllers of personal data and the rights of data subjects whose personal data are processed. The aim is to enable the development of …","paragraph_id":"para_344"},{"text":"99","paragraph_id":"para_345"},{"text":"First, as the Advocate General observes, in essence, in point 93 of his Opinion, it would not be consistent with the objective of such a high level of protection to opt for an interpretation according to which data subjects who have suffered damage as a result of an infringement of the GDPR should, …","paragraph_id":"para_346"},{"text":"100","paragraph_id":"para_347"},{"text":"Secondly, no-fault liability would not ensure the attainment of the objective of legal certainty pursued by the legislature, as is apparent from recital 7 of the GDPR.","paragraph_id":"para_348"},{"text":"101","paragraph_id":"para_349"},{"text":"As regards the second part of the fifth question, relating to the determination of the amount of any damages payable under Article 82 of the GDPR, it should be recalled that, as has been pointed out in paragraph 83 of this judgment, for the purposes of assessing those damages, national courts must a …","paragraph_id":"para_350"},{"text":"102","paragraph_id":"para_351"},{"text":"It must be stated that, in the light of its compensatory function, Article 82 of the GDPR does not require the degree of seriousness of the infringement of that regulation, which the controller is presumed to have committed, to be taken into account when determining the amount of damages awarded as …","paragraph_id":"para_352"},{"text":"103","paragraph_id":"para_353"},{"text":"Consequently, the answer to the fifth question is that Article 82 of the GDPR must be interpreted as meaning that, first, the establishment of liability on the part of the controller is subject to the existence of a fault committed by the controller, which is presumed unless the controller proves th …","paragraph_id":"para_354"},{"text":"Costs","paragraph_id":"para_355"},{"text":"104","paragraph_id":"para_356"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_357"},{"text":"On those grounds, the Court (Third Chamber) hereby rules:","paragraph_id":"para_358"},{"text":"1.","paragraph_id":"para_359"},{"text":"Article 9(2)(h) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)","paragraph_id":"para_360"},{"text":"must be interpreted as meaning that the exception provided for in that provision is applicable to situations in which a medical examination body processes data concerning the health of one of its employees acting not in its capacity as employer, but as a medical service, in order to assess the worki …","paragraph_id":"para_361"},{"text":"2.","paragraph_id":"para_362"},{"text":"Article 9(3) of Regulation 2016/679","paragraph_id":"para_363"},{"text":"must be interpreted as meaning that the controller of data concerning health, based on Article 9(2)(h) of that regulation, is not required, under those provisions, to ensure that no colleague of the data subject can access data relating to his or her state of health. However, such an obligation may …","paragraph_id":"para_364"},{"text":"3.","paragraph_id":"para_365"},{"text":"Article 9(2)(h) and Article 6(1) of Regulation 2016/679","paragraph_id":"para_366"},{"text":"must be interpreted as meaning that the processing of data concerning health based on the first provision must, in order to be lawful, not only comply with the requirements arising from that provision, but must also satisfy at least one of the conditions of lawfulness set out in Article 6(1) of that regulation.","paragraph_id":"para_367"},{"text":"4.","paragraph_id":"para_368"},{"text":"Article 82(1) of Regulation 2016/679","paragraph_id":"para_369"},{"text":"must be interpreted as meaning that the right to compensation provided for in that provision fulfils a compensatory function, in that financial compensation based on that provision must allow the damage actually suffered as a result of the infringement of that regulation to be compensated in its entirety, and not a dissuasive or punitive function.","paragraph_id":"para_370"},{"text":"5.","paragraph_id":"para_371"},{"text":"Article 82 of Regulation 2016/679","paragraph_id":"para_372"},{"text":"must be interpreted as meaning that first, the establishment of liability on the part of the controller is subject to the existence of a fault committed by the controller, which is presumed unless the controller proves that the event giving rise to the damage is in no way attributable to it and, sec …","paragraph_id":"para_373"},{"text":"[Signatures]","paragraph_id":"para_374"},{"text":"(\n *1\n ) Language of the case: German.","paragraph_id":"para_375"}],"word_count":11357,"cites":["C-449/21","C-204/21","C-252/21","C-579/21","C-597/19","C-136/17","C-34/21","C-60/22","C-300/21","C-340/21"],"sha256":"9ad778a3457824030906e0c85d84127b1777fde5e5df06c48af5de79fb5b20cb","source_url":"https://publications.europa.eu/resource/celex/62021CJ0667.ENG.xhtml.ECR_62021CJ0667_EN_01.html","fetched_at":"2026-09-30T13:39:41.367+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-667-21","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-667-21","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-667-21","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-667-21","verification":{"stored_sha256":"9ad778a3457824030906e0c85d84127b1777fde5e5df06c48af5de79fb5b20cb","recomputed_sha256":"9ad778a3457824030906e0c85d84127b1777fde5e5df06c48af5de79fb5b20cb","intact":true,"checked_at":"2026-10-11T20:49:27.236Z"}},"hash":"sha256:85e4d21cfd9f571b7dade7fcc6dc1106670def2375503f78518cd803db122fd5","version":"legal-2026-10-11","expires":"2026-10-12T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-11+legal-2026-10-11+2026-10-11T20:37:51","content_hash":"sha256:85e4d21cfd9f571b7dade7fcc6dc1106670def2375503f78518cd803db122fd5","revalidate_after":"2026-10-11T21:49:27.843Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-667-21","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-667-21"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-667-21"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-667-21"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":3},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-667-21","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-084dd8c8869f5b83b21850dae330d0bf","response_hash":"sha256:85e4d21cfd9f571b7dade7fcc6dc1106670def2375503f78518cd803db122fd5"}},"freshness":{"freshness_class":"live","as_of":"2026-11-02T23:06:05.654Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-667-21&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":24494}}