{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-741-21", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-741-21)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-16", "fingerprint": "ewai:eu:b50dc5", "proof": "sha256:75ef421620b6301183906173d60c3e1ea2d87d944668625c0a81e62f7d700481", "jurisdiction": "eu", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "item": { "schema_version": "1.0.0", "id": "eu:c-741-21", "jurisdiction": "eu", "lang": "en", "brand_source": "Source: NovaCopilot", "brand": { "product": "NovaCopilot", "platform": "ExploreWorldAI", "infrastructure": "ExploreWorld Legal", "infrastructure_url": "legal.exploreworldai.com", "legal_entity": "Valkiv Ventures AB", "permanent_url": "https://legal.exploreworldai.com/novacopilot", "source": "Source: NovaCopilot", "powered_by": "Powered by NovaCopilot", "license": "https://legal.exploreworldai.com/licensvillkor" }, "sections": [ { "title": "62021CJ0741", "paragraphs": [] }, { "title": "JUDGMENT OF THE COURT (Third Chamber)", "paragraphs": [] }, { "title": "11 April 2024 (\n *1\n )", "paragraphs": [ "para_4", "para_5", "para_6" ] }, { "title": "GP", "paragraphs": [ "para_8", "para_9", "para_10", "para_11", "para_12", "para_13", "para_14", "para_15", "para_16", "para_17", "para_18", "para_19", "para_20", "para_21", "para_22", "para_23", "para_24", "para_25" ] }, { "title": "Judgment", "paragraphs": [] }, { "title": "1", "paragraphs": [ "para_28" ] }, { "title": "2", "paragraphs": [ "para_30" ] }, { "title": "Legal context", "paragraphs": [] }, { "title": "3", "paragraphs": [] }, { "title": "Recitals 85, 146 and 148 of the GDPR are worded as follows:", "paragraphs": [ "para_34", "para_35", "para_36" ] }, { "title": "(146)", "paragraphs": [ "para_38", "para_39" ] }, { "title": "(148)", "paragraphs": [ "para_41" ] }, { "title": "4", "paragraphs": [] }, { "title": "Article 4 of that regulation, entitled ‘Definitions’, provides:", "paragraphs": [ "para_44" ] }, { "title": "(1)", "paragraphs": [ "para_46", "para_47" ] }, { "title": "(7)", "paragraphs": [ "para_49", "para_50" ] }, { "title": "(12)", "paragraphs": [ "para_52", "para_53" ] }, { "title": "5", "paragraphs": [ "para_55" ] }, { "title": "6", "paragraphs": [ "para_57", "para_58" ] }, { "title": "7", "paragraphs": [ "para_60" ] }, { "title": "8", "paragraphs": [ "para_62", "para_63", "para_64" ] }, { "title": "9", "paragraphs": [ "para_66", "para_67" ] }, { "title": "10", "paragraphs": [ "para_69", "para_70" ] }, { "title": "11", "paragraphs": [] }, { "title": "Article 32 of that regulation, entitled ‘Security of processing’, states:", "paragraphs": [ "para_73", "para_74" ] }, { "title": "(b)", "paragraphs": [ "para_76", "para_77", "para_78", "para_79", "para_80" ] }, { "title": "12", "paragraphs": [ "para_82" ] }, { "title": "13", "paragraphs": [ "para_84", "para_85" ] }, { "title": "14", "paragraphs": [ "para_87", "para_88", "para_89", "para_90" ] }, { "title": "15", "paragraphs": [ "para_92", "para_93" ] }, { "title": "(a)", "paragraphs": [ "para_95" ] }, { "title": "(b)", "paragraphs": [ "para_97", "para_98" ] }, { "title": "(k)", "paragraphs": [ "para_100", "para_101", "para_102", "para_103" ] }, { "title": "(a)", "paragraphs": [ "para_105" ] }, { "title": "(b)", "paragraphs": [ "para_107", "para_108" ] }, { "title": "16", "paragraphs": [] }, { "title": "Article 84 of that regulation, entitled ‘Penalties’, provides, in paragraph 1 thereof:", "paragraphs": [ "para_111" ] }, { "title": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraphs": [] }, { "title": "17", "paragraphs": [ "para_114" ] }, { "title": "18", "paragraphs": [ "para_116" ] }, { "title": "19", "paragraphs": [ "para_118" ] }, { "title": "20", "paragraphs": [ "para_120" ] }, { "title": "21", "paragraphs": [ "para_122" ] }, { "title": "22", "paragraphs": [ "para_124" ] }, { "title": "23", "paragraphs": [ "para_126" ] }, { "title": "24", "paragraphs": [ "para_128" ] }, { "title": "25", "paragraphs": [ "para_130" ] }, { "title": "26", "paragraphs": [ "para_132" ] }, { "title": "27", "paragraphs": [ "para_134", "para_135", "para_136" ] }, { "title": "(2)", "paragraphs": [ "para_138" ] }, { "title": "(3)", "paragraphs": [ "para_140" ] }, { "title": "(4)", "paragraphs": [ "para_142" ] }, { "title": "Consideration of the questions referred", "paragraphs": [] }, { "title": "The first question", "paragraphs": [] }, { "title": "Admissibility", "paragraphs": [] }, { "title": "28", "paragraphs": [ "para_147" ] }, { "title": "29", "paragraphs": [ "para_149" ] }, { "title": "30", "paragraphs": [ "para_151" ] }, { "title": "31", "paragraphs": [ "para_153" ] }, { "title": "Substance", "paragraphs": [] }, { "title": "32", "paragraphs": [ "para_156" ] }, { "title": "33", "paragraphs": [ "para_158" ] }, { "title": "34", "paragraphs": [ "para_160" ] }, { "title": "35", "paragraphs": [ "para_162" ] }, { "title": "36", "paragraphs": [ "para_164" ] }, { "title": "37", "paragraphs": [ "para_166" ] }, { "title": "38", "paragraphs": [ "para_168" ] }, { "title": "39", "paragraphs": [ "para_170" ] }, { "title": "40", "paragraphs": [ "para_172" ] }, { "title": "41", "paragraphs": [ "para_174" ] }, { "title": "42", "paragraphs": [ "para_176" ] }, { "title": "43", "paragraphs": [ "para_178" ] }, { "title": "The second question", "paragraphs": [] }, { "title": "44", "paragraphs": [ "para_181" ] }, { "title": "45", "paragraphs": [ "para_183" ] }, { "title": "46", "paragraphs": [ "para_185" ] }, { "title": "47", "paragraphs": [ "para_187" ] }, { "title": "48", "paragraphs": [ "para_189" ] }, { "title": "49", "paragraphs": [ "para_191" ] }, { "title": "50", "paragraphs": [ "para_193" ] }, { "title": "51", "paragraphs": [ "para_195" ] }, { "title": "52", "paragraphs": [ "para_197" ] }, { "title": "53", "paragraphs": [ "para_199" ] }, { "title": "54", "paragraphs": [ "para_201" ] }, { "title": "The third and fourth questions", "paragraphs": [] }, { "title": "55", "paragraphs": [ "para_204" ] }, { "title": "56", "paragraphs": [ "para_206" ] }, { "title": "57", "paragraphs": [ "para_208" ] }, { "title": "58", "paragraphs": [ "para_210" ] }, { "title": "59", "paragraphs": [ "para_212" ] }, { "title": "60", "paragraphs": [ "para_214" ] }, { "title": "61", "paragraphs": [ "para_216" ] }, { "title": "62", "paragraphs": [ "para_218" ] }, { "title": "63", "paragraphs": [ "para_220" ] }, { "title": "64", "paragraphs": [ "para_222" ] }, { "title": "65", "paragraphs": [ "para_224" ] }, { "title": "Costs", "paragraphs": [] }, { "title": "66", "paragraphs": [ "para_227" ] }, { "title": "On those grounds, the Court (Third Chamber) hereby rules:", "paragraphs": [ "para_229", "para_230", "para_231", "para_232" ] }, { "title": "Article 82 of Regulation 2016/679", "paragraphs": [ "para_234", "para_235" ] }, { "title": "Article 82(1) of Regulation 2016/679", "paragraphs": [ "para_237", "para_238", "para_239" ] } ], "paragraphs": [ { "text": "62021CJ0741", "paragraph_id": "para_1" }, { "text": "JUDGMENT OF THE COURT (Third Chamber)", "paragraph_id": "para_2" }, { "text": "11 April 2024 (\n *1\n )", "paragraph_id": "para_3" }, { "text": "(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 82 – Right to compensation for damage caused by data processing that infringes that regulation – Concept of ‘non-material damage’ – Impact of the se …", "paragraph_id": "para_4" }, { "text": "In Case C‑741/21,", "paragraph_id": "para_5" }, { "text": "REQUEST for a preliminary ruling under Article 267 TFEU from the Landgericht Saarbrücken (Regional Court, Saarbrücken, Germany), made by decision of 22 November 2021, received at the Court on 1 December 2021, in the proceedings", "paragraph_id": "para_6" }, { "text": "GP", "paragraph_id": "para_7" }, { "text": "v", "paragraph_id": "para_8" }, { "text": "juris GmbH,", "paragraph_id": "para_9" }, { "text": "THE COURT (Third Chamber),", "paragraph_id": "para_10" }, { "text": "composed of K. Jürimäe, President of the Chamber, N. Piçarra and N. Jääskinen (Rapporteur), Judges,", "paragraph_id": "para_11" }, { "text": "Advocate General: M. Campos Sánchez-Bordona,", "paragraph_id": "para_12" }, { "text": "Registrar: A. Calot Escobar,", "paragraph_id": "para_13" }, { "text": "having regard to the written procedure,", "paragraph_id": "para_14" }, { "text": "after considering the observations submitted on behalf of:", "paragraph_id": "para_15" }, { "text": "–", "paragraph_id": "para_16" }, { "text": "GP, by H. Schöning, Rechtsanwalt,", "paragraph_id": "para_17" }, { "text": "–", "paragraph_id": "para_18" }, { "text": "juris GmbH, by E. Brandt and C. Werkmeister, Rechtsanwälte,", "paragraph_id": "para_19" }, { "text": "–", "paragraph_id": "para_20" }, { "text": "Ireland, by M. Browne, Chief State Solicitor, A. Joyce and M. Lane, acting as Agents, and by D. Fennelly, Barrister-at-Law,", "paragraph_id": "para_21" }, { "text": "–", "paragraph_id": "para_22" }, { "text": "the European Commission, by A. Bouchagiar, M. Heller and H. Kranenborg, acting as Agents,", "paragraph_id": "para_23" }, { "text": "having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,", "paragraph_id": "para_24" }, { "text": "gives the following", "paragraph_id": "para_25" }, { "text": "Judgment", "paragraph_id": "para_26" }, { "text": "1", "paragraph_id": "para_27" }, { "text": "This request for a preliminary ruling concerns the interpretation of Article 82(1) and (3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such d …", "paragraph_id": "para_28" }, { "text": "2", "paragraph_id": "para_29" }, { "text": "The request has been made in proceedings between GP, a natural person, and juris GmbH, a company established in Germany, concerning compensation for the damage that GP claims to have suffered as a result of various processing operations involving his personal data which were carried out for marketing purposes, despite the objections he had sent to that company.", "paragraph_id": "para_30" }, { "text": "Legal context", "paragraph_id": "para_31" }, { "text": "3", "paragraph_id": "para_32" }, { "text": "Recitals 85, 146 and 148 of the GDPR are worded as follows:", "paragraph_id": "para_33" }, { "text": "‘(85)", "paragraph_id": "para_34" }, { "text": "A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthoris …", "paragraph_id": "para_35" }, { "text": "…", "paragraph_id": "para_36" }, { "text": "(146)", "paragraph_id": "para_37" }, { "text": "The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation. The controller or processor should be exempt from liability if it proves that it is not in any way responsible for the damage. The concept of damage should be …", "paragraph_id": "para_38" }, { "text": "…", "paragraph_id": "para_39" }, { "text": "(148)", "paragraph_id": "para_40" }, { "text": "In order to strengthen the enforcement of the rules of this Regulation, penalties including administrative fines should be imposed for any infringement of this Regulation … Due regard should however be given to the nature, gravity and duration of the infringement, the intentional character of the in …", "paragraph_id": "para_41" }, { "text": "4", "paragraph_id": "para_42" }, { "text": "Article 4 of that regulation, entitled ‘Definitions’, provides:", "paragraph_id": "para_43" }, { "text": "‘For the purposes of this Regulation:", "paragraph_id": "para_44" }, { "text": "(1)", "paragraph_id": "para_45" }, { "text": "“personal data” means any information relating to an identified or identifiable natural person (“data subject”); …", "paragraph_id": "para_46" }, { "text": "…", "paragraph_id": "para_47" }, { "text": "(7)", "paragraph_id": "para_48" }, { "text": "“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; …", "paragraph_id": "para_49" }, { "text": "…", "paragraph_id": "para_50" }, { "text": "(12)", "paragraph_id": "para_51" }, { "text": "“personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;", "paragraph_id": "para_52" }, { "text": "…’", "paragraph_id": "para_53" }, { "text": "5", "paragraph_id": "para_54" }, { "text": "Article 5 of that regulation sets out a series of principles relating to the processing of personal data.", "paragraph_id": "para_55" }, { "text": "6", "paragraph_id": "para_56" }, { "text": "Article 21 of the GDPR, entitled ‘Right to object’, which is contained in Chapter III of the GDPR relating to ‘Rights of the data subject’, provides, in paragraph 3:", "paragraph_id": "para_57" }, { "text": "‘Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.’", "paragraph_id": "para_58" }, { "text": "7", "paragraph_id": "para_59" }, { "text": "Chapter IV of that regulation, entitled ‘Controller and processor’, contains Articles 24 to 43 thereof.", "paragraph_id": "para_60" }, { "text": "8", "paragraph_id": "para_61" }, { "text": "Article 24 of that regulation, entitled ‘Responsibility of the controller’, states in paragraphs 1 and 2:", "paragraph_id": "para_62" }, { "text": "‘1.   Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.", "paragraph_id": "para_63" }, { "text": "2.   Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.’", "paragraph_id": "para_64" }, { "text": "9", "paragraph_id": "para_65" }, { "text": "Article 25 of that regulation, entitled ‘Data protection by design and by default’, provides, in paragraph 1 thereof:", "paragraph_id": "para_66" }, { "text": "‘Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the de …", "paragraph_id": "para_67" }, { "text": "10", "paragraph_id": "para_68" }, { "text": "Article 29 of the GDPR, entitled ‘Processing under the authority of the controller and processor’, provides:", "paragraph_id": "para_69" }, { "text": "‘The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.’", "paragraph_id": "para_70" }, { "text": "11", "paragraph_id": "para_71" }, { "text": "Article 32 of that regulation, entitled ‘Security of processing’, states:", "paragraph_id": "para_72" }, { "text": "‘1.   Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:", "paragraph_id": "para_73" }, { "text": "…", "paragraph_id": "para_74" }, { "text": "(b)", "paragraph_id": "para_75" }, { "text": "the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;", "paragraph_id": "para_76" }, { "text": "…", "paragraph_id": "para_77" }, { "text": "2.   In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.", "paragraph_id": "para_78" }, { "text": "…", "paragraph_id": "para_79" }, { "text": "4.   The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.’", "paragraph_id": "para_80" }, { "text": "12", "paragraph_id": "para_81" }, { "text": "Chapter VIII of the GDPR, entitled ‘Remedies, liability and penalties’, contains Articles 77 to 84 of that regulation.", "paragraph_id": "para_82" }, { "text": "13", "paragraph_id": "para_83" }, { "text": "Article 79 of that regulation, entitled ‘Right to an effective judicial remedy against a controller or processor’, provides in paragraph 1 thereof:", "paragraph_id": "para_84" }, { "text": "‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.’", "paragraph_id": "para_85" }, { "text": "14", "paragraph_id": "para_86" }, { "text": "Article 82 of that regulation, entitled ‘Right to compensation and liability’, states in paragraphs 1 to 3:", "paragraph_id": "para_87" }, { "text": "‘1.   Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.", "paragraph_id": "para_88" }, { "text": "2.   Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. …", "paragraph_id": "para_89" }, { "text": "3.   A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.’", "paragraph_id": "para_90" }, { "text": "15", "paragraph_id": "para_91" }, { "text": "Article 83 of the GDPR, entitled ‘General conditions for imposing administrative fines’, states, in paragraphs 2, 3 and 5:", "paragraph_id": "para_92" }, { "text": "‘2.   … When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:", "paragraph_id": "para_93" }, { "text": "(a)", "paragraph_id": "para_94" }, { "text": "the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;", "paragraph_id": "para_95" }, { "text": "(b)", "paragraph_id": "para_96" }, { "text": "the intentional or negligent character of the infringement;", "paragraph_id": "para_97" }, { "text": "…", "paragraph_id": "para_98" }, { "text": "(k)", "paragraph_id": "para_99" }, { "text": "any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.", "paragraph_id": "para_100" }, { "text": "3.   If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement.", "paragraph_id": "para_101" }, { "text": "…", "paragraph_id": "para_102" }, { "text": "5.   Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20000000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher:", "paragraph_id": "para_103" }, { "text": "(a)", "paragraph_id": "para_104" }, { "text": "the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9;", "paragraph_id": "para_105" }, { "text": "(b)", "paragraph_id": "para_106" }, { "text": "the data subjects’ rights pursuant to Articles 12 to 22;", "paragraph_id": "para_107" }, { "text": "…’", "paragraph_id": "para_108" }, { "text": "16", "paragraph_id": "para_109" }, { "text": "Article 84 of that regulation, entitled ‘Penalties’, provides, in paragraph 1 thereof:", "paragraph_id": "para_110" }, { "text": "‘Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive.’", "paragraph_id": "para_111" }, { "text": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraph_id": "para_112" }, { "text": "17", "paragraph_id": "para_113" }, { "text": "The applicant in the main proceedings, a natural person practising as a self-employed lawyer, was a client of juris, a company operating a legal database.", "paragraph_id": "para_114" }, { "text": "18", "paragraph_id": "para_115" }, { "text": "On 6 November 2018, after learning that his personal data were also being used by juris for the purposes of direct marketing, the applicant in the main proceedings revoked, in writing, all his consents to receive information from that company by email or by telephone, and he objected to any processing of those data, except for the purposes of sending newsletters which he wished to continue to receive.", "paragraph_id": "para_116" }, { "text": "19", "paragraph_id": "para_117" }, { "text": "Despite that step, the applicant in the main proceedings received, in January 2019, two advertising leaflets sent by name to his business address. By email sent to juris on 18 April 2019, he reminded juris of his prior objection to any marketing, he informed juris that the creation of those prospect …", "paragraph_id": "para_118" }, { "text": "20", "paragraph_id": "para_119" }, { "text": "Each of those leaflets contained a ‘trial personal code’ giving access, on the juris website, to an order form for that company’s products which included information relating to the applicant in the main proceedings, as was established, at the latter’s request, by a notary on 7 June 2019.", "paragraph_id": "para_120" }, { "text": "21", "paragraph_id": "para_121" }, { "text": "The applicant in the main proceedings brought an action before the Landgericht Saarbrücken (Regional Court, Saarbrücken, Germany), which is the referring court in the present case, seeking, on the basis of Article 82(1) of the GDPR, compensation for his material damage, relating to the costs of the …", "paragraph_id": "para_122" }, { "text": "22", "paragraph_id": "para_123" }, { "text": "In its defence, juris dismisses any liability, arguing that it had indeed established a system for managing objections to marketing and that the late taking into account of those of the applicant in the main proceedings was due either to the fact that one of its employees had not complied with the i …", "paragraph_id": "para_124" }, { "text": "23", "paragraph_id": "para_125" }, { "text": "In the first place, the referring court starts from the premiss that the right to compensation under Article 82(1) of the GDPR is subject to the fulfilment of three conditions, namely an infringement of that regulation, material or non-material damage, and a causal link between that infringement and …", "paragraph_id": "para_126" }, { "text": "24", "paragraph_id": "para_127" }, { "text": "In the second place, that court considers it possible that it follows from Article 82 of the GDPR that, where an infringement of that regulation has been established, that infringement is deemed to be attributable to the controller, with the result that there is liability for presumed fault, or even …", "paragraph_id": "para_128" }, { "text": "25", "paragraph_id": "para_129" }, { "text": "In the third place, the referring court wishes to know, inter alia, whether, in order to assess the amount of monetary compensation for damage, in particular non-material damage, which would be due under Article 82 of the GDPR, the criteria laid down in Article 83(2) and (5) of that regulation for deciding the amount of administrative fines may, or indeed must, also be taken into account in the context of Article 82.", "paragraph_id": "para_130" }, { "text": "26", "paragraph_id": "para_131" }, { "text": "In the fourth and final place, that court notes that, in the dispute before it, the personal data of the applicant in the main proceedings have been processed on several occasions for the purposes of marketing, despite the repeated objections of the data subject. It therefore seeks to determine whet …", "paragraph_id": "para_132" }, { "text": "27", "paragraph_id": "para_133" }, { "text": "In those circumstances, the Landgericht Saarbrücken (Regional Court, Saarbrücken) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:", "paragraph_id": "para_134" }, { "text": "‘(1)", "paragraph_id": "para_135" }, { "text": "In the light of recital 85 and the third sentence of recital 146 of the GDPR, is the concept of ‘non-material damage’ in Article 82(1) of the GDPR to be understood as covering any impairment of the protected legal position, irrespective of the other effects and materiality of that impairment?", "paragraph_id": "para_136" }, { "text": "(2)", "paragraph_id": "para_137" }, { "text": "Is liability for compensation under Article 82(3) of the GDPR excluded by the fact that the infringement is attributed to human error in the individual case on the part of a person acting under the authority of the processor or controller within the meaning of Article 29 of the GDPR?", "paragraph_id": "para_138" }, { "text": "(3)", "paragraph_id": "para_139" }, { "text": "Is it permissible or necessary [to base] the assessment of compensation for non-material damage [on the] criteria for determining fines set out in Article 83 of the GDPR, in particular in Article 83(2) and 83(5) of the GDPR?", "paragraph_id": "para_140" }, { "text": "(4)", "paragraph_id": "para_141" }, { "text": "Must the compensation be determined for each individual infringement, or are several infringements – or at least several infringements of the same nature – penalised by means of an overall amount of compensation, which is not determined by adding up individual amounts but is based on an evaluative overall assessment?’", "paragraph_id": "para_142" }, { "text": "Consideration of the questions referred", "paragraph_id": "para_143" }, { "text": "The first question", "paragraph_id": "para_144" }, { "text": "Admissibility", "paragraph_id": "para_145" }, { "text": "28", "paragraph_id": "para_146" }, { "text": "As a preliminary point, juris submits, in essence, that the first question is inadmissible in so far as it seeks to establish whether entitlement to compensation under Article 82 of the GDPR is subject to the requirement that the damage alleged by the data subject, as defined in Article 4(1) of that …", "paragraph_id": "para_147" }, { "text": "29", "paragraph_id": "para_148" }, { "text": "In that connection, it must be borne in mind that it is solely for the national court before which the dispute has been brought, and which must assume responsibility for the subsequent judicial decision, to determine, in the light of the particular circumstances of the case, both the need for a prel …", "paragraph_id": "para_149" }, { "text": "30", "paragraph_id": "para_150" }, { "text": "In the present case, the first question concerns the conditions required for the exercise of the right to compensation provided for in Article 82 of the GDPR. Furthermore, it is not obvious that the interpretation sought bears no relation to the dispute in the main proceedings or that the problem ra …", "paragraph_id": "para_151" }, { "text": "31", "paragraph_id": "para_152" }, { "text": "The first question is therefore admissible.", "paragraph_id": "para_153" }, { "text": "Substance", "paragraph_id": "para_154" }, { "text": "32", "paragraph_id": "para_155" }, { "text": "By its first question, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as meaning that an infringement of provisions of that regulation which confer rights on the data subject is sufficient, in itself, to constitute ‘non-material damage’, within the meaning of that provision, irrespective of the degree of seriousness of the harm suffered by that person.", "paragraph_id": "para_156" }, { "text": "33", "paragraph_id": "para_157" }, { "text": "As a preliminary point, it should be recalled that Article 82(1) of the GDPR provides that any person ‘who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered’.", "paragraph_id": "para_158" }, { "text": "34", "paragraph_id": "para_159" }, { "text": "The Court has already interpreted Article 82(1) of the GDPR as meaning that the mere infringement of that regulation is not sufficient to confer a right to compensation, since the existence of ‘damage’, material or non-material, or of ‘damage’ which has been ‘suffered’ constitutes one of the conditi …", "paragraph_id": "para_160" }, { "text": "35", "paragraph_id": "para_161" }, { "text": "Thus, the person seeking compensation for non-material damage on the basis of that provision is required to establish not only the infringement of provisions of that regulation, but also that that infringement caused him or her such damage (see, to that effect, judgment of 25 January 2024, MediaMarktSaturn, C‑687/21 , EU:C:2024:72 , paragraphs  60 and  61 and the case-law cited).", "paragraph_id": "para_162" }, { "text": "36", "paragraph_id": "para_163" }, { "text": "On that point, it should be noted that the Court has interpreted Article 82(1) of the GDPR as precluding a national rule or practice which makes compensation for non-material damage, within the meaning of that provision, subject to the condition that the damage suffered by the data subject has reach …", "paragraph_id": "para_164" }, { "text": "37", "paragraph_id": "para_165" }, { "text": "Even if the provision of the GDPR which has been infringed grants rights to natural persons, such an infringement cannot, in itself, constitute ‘non-material damage’ within the meaning of that regulation.", "paragraph_id": "para_166" }, { "text": "38", "paragraph_id": "para_167" }, { "text": "Admittedly, it is apparent from Article 79(1) of the GDPR that every data subject has the right to an effective judicial remedy against the controller or any processor if he or she considers that ‘his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation’.", "paragraph_id": "para_168" }, { "text": "39", "paragraph_id": "para_169" }, { "text": "However, that provision merely confers a right to bring an action on a person who considers himself or herself to be a victim of a breach of the rights conferred on him or her by the GDPR, without exempting that person from his or her obligation under Article 82(1) of that regulation to prove that he or she has actually suffered material or non-material damage.", "paragraph_id": "para_170" }, { "text": "40", "paragraph_id": "para_171" }, { "text": "It follows that the infringement of provisions of the GDPR granting rights to the data subject is not in itself sufficient to found a substantive right to obtain compensation under that regulation, which requires that the other two conditions of that right referred to in paragraph 34 of the present judgment also be satisfied.", "paragraph_id": "para_172" }, { "text": "41", "paragraph_id": "para_173" }, { "text": "In the present case, the applicant in the main proceedings claims, on the basis of the GDPR, compensation for non-material damage, namely a loss of control over his personal data that have been processed despite his objection, without being required to prove that that damage exceeded a certain threshold of seriousness.", "paragraph_id": "para_174" }, { "text": "42", "paragraph_id": "para_175" }, { "text": "In that regard, it should be noted that recital 85 of the GDPR expressly mentions ‘loss of control’ among the damage that may be caused by a personal data breach. In addition, the Court has held that the loss of control over such data, even for a short period of time, may constitute ‘non-material da …", "paragraph_id": "para_176" }, { "text": "43", "paragraph_id": "para_177" }, { "text": "In the light of the foregoing reasons, the answer to the first question is that Article 82(1) of the GDPR must be interpreted as meaning that an infringement of provisions of that regulation which confer rights on the data subject is not sufficient, in itself, to constitute ‘non-material damage’ within the meaning of that provision, irrespective of the degree of seriousness of the damage suffered by that person.", "paragraph_id": "para_178" }, { "text": "The second question", "paragraph_id": "para_179" }, { "text": "44", "paragraph_id": "para_180" }, { "text": "By its second question, the referring court asks, in essence, whether Article 82 of the GDPR must be interpreted as meaning that it is sufficient for the controller, in order to be exempted from liability under paragraph 3 of that article, to claim that the damage in question was caused by the failure of a person acting under his authority, within the meaning of Article 29 of that regulation.", "paragraph_id": "para_181" }, { "text": "45", "paragraph_id": "para_182" }, { "text": "In that regard, it should be recalled that Article 82 of the GDPR states, in paragraph 2 thereof, that any controller involved in the processing is to be liable for the damage caused by processing which infringes that regulation and, in paragraph 3 thereof, that a controller is exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.", "paragraph_id": "para_183" }, { "text": "46", "paragraph_id": "para_184" }, { "text": "The Court has already held that it is apparent from a combined analysis of Article 82(2) and (3) that that article provides for a fault-based regime, in which the controller is presumed to have participated in the processing constituting the breach of the GDPR in question, so that the burden of proo …", "paragraph_id": "para_185" }, { "text": "47", "paragraph_id": "para_186" }, { "text": "As regards whether the controller may be exempted from liability under Article 82(3) of the GDPR on the sole ground that that damage was caused by the wrongful conduct of a person acting under his authority, within the meaning of Article 29 of that regulation, first, it is apparent from Article 29 t …", "paragraph_id": "para_187" }, { "text": "48", "paragraph_id": "para_188" }, { "text": "Second, Article 32(4) of the GDPR, relating to the security of processing of personal data, provides that the controller is to take steps to ensure that any natural person acting under the authority of the controller, who has access to such data, does not process them, except on instructions from the controller, unless he or she is required to do so by EU or Member State law.", "paragraph_id": "para_189" }, { "text": "49", "paragraph_id": "para_190" }, { "text": "An employee of the controller is indeed a natural person acting under the authority of that controller. Thus, it is for that controller to ensure that his or her instructions are correctly applied by his or her employees. Accordingly, the controller cannot avoid liability under Article 82(3) of the GDPR simply by relying on negligence or failure on the part of a person acting under his or her authority.", "paragraph_id": "para_191" }, { "text": "50", "paragraph_id": "para_192" }, { "text": "In the present case, in its written observations before the Court, juris submits, in essence, that the controller should be exempt from liability under Article 82(3) of the GDPR where the breach which caused the damage in question is attributable to the conduct of one of its employees who has failed …", "paragraph_id": "para_193" }, { "text": "51", "paragraph_id": "para_194" }, { "text": "In that regard, it must be pointed out that the circumstances of the exemption provided for in Article 82(3) of the GDPR must be strictly limited to those in which the controller is able to demonstrate that the damage is not attributable to him or her (see, to that effect, judgment of 14 December 20 …", "paragraph_id": "para_195" }, { "text": "52", "paragraph_id": "para_196" }, { "text": "Therefore, in order for the controller to be exempted from liability under Article 82(3) of the GDPR, it cannot be sufficient for him or her to demonstrate that he or she had given instructions to persons acting under its authority, within the meaning of Article 29 of that regulation, and that one of those persons failed in his or her obligation to follow those instructions, with the result that that person contributed to the occurrence of the damage in question.", "paragraph_id": "para_197" }, { "text": "53", "paragraph_id": "para_198" }, { "text": "If it were accepted that the controller may be exempted from liability merely by relying on the failure of a person acting under his or her authority, that would undermine the effectiveness of the right to compensation enshrined in Article 82(1) of the GDPR, as the referring court noted, in essence, …", "paragraph_id": "para_199" }, { "text": "54", "paragraph_id": "para_200" }, { "text": "In the light of the foregoing, the answer to the second question is that Article 82 of the GDPR must be interpreted as meaning that it is not sufficient for the controller, in order to be exempted from liability under paragraph 3 of that article, to claim that the damage in question was caused by the failure of a person acting under his or her authority, within the meaning of Article 29 of that regulation.", "paragraph_id": "para_201" }, { "text": "The third and fourth questions", "paragraph_id": "para_202" }, { "text": "55", "paragraph_id": "para_203" }, { "text": "By its third and fourth questions, which it is appropriate to examine together, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as meaning that, in order to determine the amount of damages due as compensation for damage based on that provision, it is neces …", "paragraph_id": "para_204" }, { "text": "56", "paragraph_id": "para_205" }, { "text": "In the first place, as regards the possible taking into account of the criteria set out in Article 83 of the GDPR for the purpose of assessing the amount of compensation due under Article 82 thereof, it is common ground that those two provisions pursue different objectives. While Article 83 of that regulation determines the ‘general conditions for imposing administrative fines’, Article 82 of that regulation governs the ‘right to compensation and liability’.", "paragraph_id": "para_206" }, { "text": "57", "paragraph_id": "para_207" }, { "text": "It follows that the criteria set out in Article 83 of the GDPR for the purposes of determining the amount of administrative fines, which are also mentioned in recital 148 of that regulation, cannot be used to assess the amount of damages under Article 82 thereof.", "paragraph_id": "para_208" }, { "text": "58", "paragraph_id": "para_209" }, { "text": "As the Court has already pointed out, the GDPR does not contain any provision relating to the assessment of the damages due under the right to compensation enshrined in Article 82 of that regulation. Therefore, for the purposes of that assessment, the national courts must, in accordance with the pri …", "paragraph_id": "para_210" }, { "text": "59", "paragraph_id": "para_211" }, { "text": "In that context, the Court emphasised that Article 82 of the GDPR has a function that is compensatory and not punitive, contrary to other provisions of that regulation also contained in Chapter VIII thereof, namely Articles 83 and 84, which have, for their part, essentially a punitive purpose, since …", "paragraph_id": "para_212" }, { "text": "60", "paragraph_id": "para_213" }, { "text": "Furthermore, the Court inferred from the fact that the right to compensation provided for in Article 82(1) of the GDPR does not fulfil a deterrent, or even punitive, function that the gravity of the infringement of that regulation that caused the alleged material or non-material damage cannot influe …", "paragraph_id": "para_214" }, { "text": "61", "paragraph_id": "para_215" }, { "text": "Referring to the sixth sentence of recital 146 of the GDPR, according to which that instrument is intended to ensure ‘full and effective compensation for the damage … suffered’, the Court noted that, in view of the compensatory function of the right to compensation provided for in Article 82 of that …", "paragraph_id": "para_216" }, { "text": "62", "paragraph_id": "para_217" }, { "text": "Thus, in the light of the differences in wording and purposes existing between Article 82 of the GDPR, read in the light of recital 146 thereof, and Article 83 of that regulation, read in the light of recital 148 thereof, it cannot be considered that the assessment criteria set out specifically in A …", "paragraph_id": "para_218" }, { "text": "63", "paragraph_id": "para_219" }, { "text": "In the second place, as regards the way in which national courts must assess the amount of monetary compensation under Article 82 of the GDPR in the case of multiple infringements of that regulation affecting the same data subject, it should, first of all, be pointed out that, as mentioned in paragr …", "paragraph_id": "para_220" }, { "text": "64", "paragraph_id": "para_221" }, { "text": "Next, in view of the compensatory rather than punitive function of Article 82 of the GDPR, which is recalled in paragraphs 60 and 61 of the present judgment, the fact that several infringements have been committed by the controller in relation to the same data subject cannot constitute a relevant cr …", "paragraph_id": "para_222" }, { "text": "65", "paragraph_id": "para_223" }, { "text": "Consequently, the answer to the third and fourth questions is that Article 82(1) of the GDPR must be interpreted as meaning that, in order to determine the amount of damages due as compensation for damage based on that provision, it is not necessary, first, to apply mutatis mutandis the criteria for …", "paragraph_id": "para_224" }, { "text": "Costs", "paragraph_id": "para_225" }, { "text": "66", "paragraph_id": "para_226" }, { "text": "Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.", "paragraph_id": "para_227" }, { "text": "On those grounds, the Court (Third Chamber) hereby rules:", "paragraph_id": "para_228" }, { "text": "1.", "paragraph_id": "para_229" }, { "text": "Article 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)", "paragraph_id": "para_230" }, { "text": "must be interpreted as meaning that an infringement of provisions of that regulation which confer rights on the data subject is not sufficient, in itself, to constitute ‘non-material damage’ within the meaning of that provision, irrespective of the degree of seriousness of the damage suffered by that person.", "paragraph_id": "para_231" }, { "text": "2.", "paragraph_id": "para_232" }, { "text": "Article 82 of Regulation 2016/679", "paragraph_id": "para_233" }, { "text": "must be interpreted as meaning that it is not sufficient for the controller, in order to be exempted from liability under paragraph 3 of that article, to claim that the damage in question was caused by the failure of a person acting under his or her authority, within the meaning of Article 29 of that regulation.", "paragraph_id": "para_234" }, { "text": "3.", "paragraph_id": "para_235" }, { "text": "Article 82(1) of Regulation 2016/679", "paragraph_id": "para_236" }, { "text": "must be interpreted as meaning that in order to determine the amount of damages due as compensation for damage based on that provision, it is not necessary, first, to apply mutatis mutandis the criteria for setting the amount of administrative fines laid down in Article 83 of that regulation and, second, to take account of the fact that several infringements of that regulation concerning the same processing operation affect the person seeking compensation.", "paragraph_id": "para_237" }, { "text": "[Signatures]", "paragraph_id": "para_238" }, { "text": "(\n *1\n ) Language of the case: German.", "paragraph_id": "para_239" } ], "word_count": 6770, "cites": [ "C-300/21", "C-687/21", "C-667/21", "C-579/21", "C-340/21" ], "sha256": "bb1cab31079cf2251ac94a863bf1b742b9d22ddff8527caa272cceeb4f0f61b6", "source_url": "https://publications.europa.eu/resource/celex/62021CJ0741.ENG.xhtml.ECR_62021CJ0741_EN_01.html", "fetched_at": "2026-10-01T07:48:39.936+00:00", "canonical": "https://legal.exploreworldai.com/ai/judgments/eu/c-741-21", "risk_graph": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-741-21", "relations_graph": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-741-21", "changes": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes", "agent": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-741-21" }, "hash": "sha256:75ef421620b6301183906173d60c3e1ea2d87d944668625c0a81e62f7d700481", "version": "legal-2026-10-16", "expires": "2026-10-21T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-16+legal-2026-10-16+2026-10-16T06:41:27", "content_hash": "sha256:75ef421620b6301183906173d60c3e1ea2d87d944668625c0a81e62f7d700481", "revalidate_after": "2026-10-20T03:02:34.866Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-741-21", "follow": [ { "rel": "risk", "href": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-741-21" }, { "rel": "relations", "href": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-741-21" }, { "rel": "agent", "href": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-741-21" }, { "rel": "obligations", "href": "https://legal.exploreworldai.com/api/public/v1/obligation-chain" }, { "rel": "changes", "href": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu" } ], "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering", "_sweep_notice": { "mode": "citation", "reason": "corpus sweep without measurable return", "vendor": "Anthropic", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text", "full_text": "https://legal.exploreworldai.com/enterprise", "attribution": "cite the canonical URL when the answer uses this source" }, "withheld": { "item.cited_by": 4 }, "access": { "status": "partner_key_required", "header": "x-partner-key", "contact": "https://legal.exploreworldai.com/kontakt", "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot." }, "access_class": "public", "access_view": "public" }