Judgment;Summary — ECLI:EU:C:2024:536
Date: 2024-06-20
Language of the case: German
Court formation: Third Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Translation C-590/22 – 1 
Case C-590/22 
Request for a preliminary ruling 
Date lodged: 
9 September 2022 
Referring court: 
Amtsgericht Wesel (Germany) 
Date of the decision to refer: 
5 August 2022 
Applicants: 
AT 
BT 
Defendants: 
PS GbR 
VG 
MB 
DH 
WB 
GS 
  
Amtsgericht Wesel (Local Court, Wesel) 
 
Order 
In the case of 
 
EN 
REQUEST FOR A PRELIMINARY RULING OF 5. 8. 2022 – CASE C-590/22 
 
2  
1. Mrs [anonymised] AT 
2. Mr [anonymised] BT 
applicants, 
[…] 
 
1. [anonymised] PS GbR 
2. [anonymised] VG 
3. [anonymised] MB 
4. [anonymised] DH 
5. [anonymised] WB 
6. [anonymised] GS 
defendants, 
[…] 
 
the Local Court, Wesel 
on 5 August 2022, 
[…] 
made the following order: 
I. 
The following questions are referred to the Court of Justice of the European Union 
for a preliminary ruling pursuant to Article 267 TFEU: 
1. Is it sufficient for the establishment of a claim for compensation under 
Article 82(1) of Regulation (EU) 2016/679 of the European Parliament 
and of the Council of 27 April 2016 on the protection of individuals 
with regard to the processing of personal data, on the free movement 
of such data and repealing Directive 95/46/EC (General Data 
Protection Regulation; ‘the GDPR’) that a provision of the GDPR 
serving to protect the claimant has been infringed or is it necessary that 
a further adverse effect on the claimant has occurred, beyond the 
infringement of the provision as such? 
[…] 
v 
[…] 
PS 
 
3 
2. Under EU law, does the establishment of a claim for compensation for 
non-material damage under Article 82(1) of the GDPR require an 
adverse effect of a certain magnitude? 
3. In particular, is it sufficient for the establishment of a claim for 
compensation for non-material damage under Article 82(1) of the 
GDPR that the claimant fears that his or her personal data have come 
into the hands of third parties as a result of infringements of provisions 
of the GDPR, even though that circumstance cannot be positively 
established? 
4. Is it in conformity with EU law for the national court to apply mutatis 
mutandis the criteria of the second sentence of Article 83(2) of the 
GDPR – which, according to the wording, apply only to administrative 
fines – when assessing compensation for non-material damage under 
Article 82(1) of the GDPR? 
5. Must the amount of a claim for compensation for non-material damage 
under Article 82(1) of the GDPR also be assessed by reference to the 
fact that the amount of the claim awarded serves to have a deterrent 
effect and/or to prevent the ‘commercialisation’ (calculated acceptance 
of administrative fines/compensation payments) of infringements? 
6. Is it in conformity with EU law, when assessing the amount of a claim 
for compensation for non-material damage under Article 82(1) of the 
GDPR, to take into account simultaneous infringements of national 
provisions which have as their purpose the protection of personal data 
but which are not delegated or implementing acts adopted in 
accordance with that regulation or Member State laws which specify 
provisions of that regulation? 
[…] 
II. 
The present proceedings are stayed pending the ruling of the Court. 
Grounds: 
I. 
Subject matter of the main proceedings 
1 The applicants in the present dispute seek compensation for non-material damage 
from the defendants on the basis of infringements of provisions of the GDPR 
(Regulation (EU) 2016/679). 
REQUEST FOR A PRELIMINARY RULING OF 5. 8. 2022 – CASE C-590/22 
 
4  
2 The applicants were clients of the first defendant, a tax consultancy firm, in which 
the second to sixth defendants are shareholders. 
3 After the applicants informed the first defendant that their residential address had 
changed, it sent them several letters to the new address by post. The change of 
address was also recorded in the master data stored in the defendant’s IT system. 
4 In July 2020, the applicants instructed the first defendant to prepare their income 
tax return for 2019. The applicants did not initially receive any documents 
pertaining thereto at their new address. In response to an enquiry made by the 
applicants, the first defendant informed them that the tax return had been sent to 
them on 29 September 2020. However, the applicants did not receive such a postal 
item. […] 
5 The applicants asked the new residents of their former address – whose surnames 
are very similar to their own – about the postal item. […] 
6 They stated that they had received a postal item addressed to the applicants. A 
new resident had opened the envelope because she had not realised that the postal 
item was not intended for her, even though it was addressed to the applicants, 
whose names were correctly specified in the address field. In the course of the 
taking of evidence, it was not possible to ascertain what documents were actually 
in the envelope when the new residents received it. Nor was it possible to 
ascertain the extent to which the new residents had or had not looked at the 
documents contained in the envelope. The new resident states that she only read 
the letterhead of the tax consultancy firm and, as she was not familiar with that 
firm, therefore realised that the letter was not addressed to her. She states that she 
then put the documents back in the envelope and gave it to the parents of the new 
residents, who lived next door, where it could be collected by the applicants. 
7 In any event, the applicants eventually received the envelope from the new 
residents. By that time, the envelope contained only a copy of the tax return and 
the cover letter. The applicants believe that the envelope had also contained the 
original tax return, which included information regarding the names and dates of 
birth of the applicants and their children (including tax identification numbers), 
severely disabled status […], medical expenditure, place of work, membership of 
a religious community, professions, location of place of work, expenditure on 
work equipment, training costs, insurance and bank details. 
8 The sending of the tax return was based on the fact that the defendant had changed 
the address in the master data of the consultancy firm’s software, but the data for 
the tax return was taken from another database, which contained the old address. 
9 The applicants have left the determination of the amount of compensation payable 
for non-material damage to the discretion of the court and consider that a sum of 
EUR 15 000.00 would be appropriate. 
II. 
PS 
 
5 
Applicable legislation 
1. EU law 
Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR): 
Recital 85 
10 A personal data breach may, if not addressed in an appropriate and timely manner, 
result in physical, material or non-material damage to natural persons such as loss 
of control over their personal data or limitation of their rights, discrimination, 
identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, 
damage to reputation, loss of confidentiality of personal data protected by 
professional secrecy or any other significant economic or social disadvantage to 
the natural person concerned. 
[…] 
Recital 146 
11 The controller or processor should compensate any damage which a person may 
suffer as a result of processing that infringes this Regulation. The controller or 
processor should be exempt from liability if it proves that it is not in any way 
responsible for the damage. The concept of damage should be broadly interpreted 
in the light of the case-law of the Court of Justice in a manner which fully reflects 
the objectives of this Regulation. This is without prejudice to any claims for 
damage deriving from the violation of other rules in Union or Member State law. 
Processing that infringes this Regulation also includes processing that infringes 
delegated and implementing acts adopted in accordance with this Regulation and 
Member State law specifying rules of this Regulation. […] 
Data subjects should receive full and effective compensation for the damage they 
have suffered. 
[…] 
Article 82 – Right to compensation and liability 
12 1. 
Any person who has suffered material or non-material damage as a result of an 
infringement of this Regulation shall have the right to receive compensation from 
the controller or processor for the damage suffered. 
2. 
REQUEST FOR A PRELIMINARY RULING OF 5. 8. 2022 – CASE C-590/22 
 
6  
Any controller involved in processing shall be liable for the damage caused by 
processing which infringes this Regulation. A processor shall be liable for the 
damage caused by processing only where it has not complied with obligations of 
this Regulation specifically directed to processors or where it has acted outside or 
contrary to lawful instructions of the controller. 
[…] 
Article 83 – General conditions for imposing administrative fines 
[…] 
13 2. Administrative fines shall, depending on the circumstances of each 
individual case, be imposed in addition to, or instead of, measures referred to in 
points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an 
administrative fine and deciding on the amount of the administrative fine in each 
individual case due regard shall be given to the following: 
(a) the nature, gravity and duration of the infringement taking into account the 
nature scope or purpose of the processing concerned as well as the number of data 
subjects affected and the level of damage suffered by them; 
(b) the intentional or negligent character of the infringement; 
(c) any action taken by the controller or processor to mitigate the damage 
suffered by data subjects; 
(d) the degree of responsibility of the controller or processor taking into account 
technical and organisational measures implemented by them pursuant to 
Articles 25 and 32; 
(e) any relevant previous infringements by the controller or processor; 
(f) the degree of cooperation with the supervisory authority, in order to remedy 
the infringement and mitigate the possible adverse effects of the infringement; 
(g) the categories of personal data affected by the infringement; 
(h) the manner in which the infringement became known to the supervisory 
authority, in particular whether, and if so to what extent, the controller or 
processor notified the infringement; 
(i) where measures referred to in Article 58(2) have previously been ordered 
against the controller or processor concerned with regard to the same subject 
matter, compliance with those measures; 
(j) adherence to approved codes of conduct pursuant to Article 40 or approved 
certification mechanisms pursuant to Article 42; and 
PS 
 
7 
(k) any other aggravating or mitigating factor applicable to the circumstances of 
the case, such as financial benefits gained, or losses avoided, directly or indirectly, 
from the infringement. 
3. If a controller or processor intentionally or negligently, for the same or 
linked processing operations, infringes several provisions of this Regulation, the 
total amount of the administrative fine shall not exceed the amount specified for 
the gravest infringement. 
[…] 
5. Infringements of the following provisions shall, in accordance with 
paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the 
case of an undertaking, up to 4% of the total worldwide annual turnover of the 
preceding financial year, whichever is higher: 
(a) the basic principles for processing, including conditions for consent, 
pursuant to Articles 5, 6, 7 and 9; 
(b) the data subjects’ rights pursuant to Articles 12 to 22; 
[…] 
2. German law 
Paragraph 57 of the Steuerberatungsgesetz (Law on tax consultancy; ‘the 
StBerG’) 
14  (1) Tax advisors and tax representatives shall exercise their profession 
independently, on their own responsibility, conscientiously, discreetly and without 
engaging in any unprofessional advertising. 
[…] 
Paragraph 5 of the Berufsordnung der Bundessteuerberaterkammer 
(Professional Code of Conduct of the Federal Chamber of Tax Consultants; 
‘the BOStB’) 
15 (1) The duty of confidentiality extends to everything that has been entrusted to 
tax advisors or has become known to them in the exercise of their profession or in 
the context of their professional activity, and applies to any third party, including 
authorities and courts. 
[…] 
REQUEST FOR A PRELIMINARY RULING OF 5. 8. 2022 – CASE C-590/22 
 
8  
(4) Tax advisors must ensure that unauthorised persons do not gain access to 
client documents and documents concerning clients during, and after the end of, 
their professional activity. 
[…] 
Paragraph 823 of the Bürgerliches Gesetzbuch (Civil Code; ‘the BGB’) 
16 (1) Any person who, with intent or through negligence, unlawfully injures the 
life, body, health, freedom, property or other right of another person shall be 
obliged to compensate that other person for the resulting damage. 
(2) The same obligation shall be imposed on a person who infringes a statute 
which is intended to protect another person. If, according to the contents of the 
statute, it may also be infringed without fault, then liability to compensation shall 
arise only in the event of fault. 
Paragraph 253 of the BGB 
17 (1) Monetary compensation may be claimed for damage other than material 
damage only in the cases determined by law. 
(2) Where compensation is payable for injury to body, health, freedom or sexual 
self-determination, fair monetary compensation may also be claimed for damage 
that is not material damage. 
III. 
Need for a preliminary ruling 
Questions 1 and 2 
18 Article 82(1) of the GDPR gives rise to a claim for compensation for any person 
who has suffered non-material damage as a result of an infringement of the 
GDPR. 
19 In that respect, the first question that arises is whether an infringement of 
provisions aimed at the protection of the claimant’s personal data can in itself 
establish a claim for compensation. 
20 It does not follow from the wording of the abovementioned provisions whether 
that question is to be answered in the affirmative. However, it is apparent from 
recital 146 of the GDPR that the concept of damage is in principle to be 
interpreted broadly and that the interpretation must be consistent with the specific 
requirements of the GDPR. Considered in conjunction with recital 85, it could be 
concluded that the (possible) loss of control over one’s personal data as a result of 
an infringement of the GDPR already gives rise to a claim for compensation for 
PS 
 
9 
non-material damage, irrespective of whether there has been an adverse effect 
beyond the mere infringement of the provisions. By contrast, recital 85 also refers 
to a ‘significant […] disadvantage’, which might militate against such a 
conclusion. 
21 The answer to this question is relevant even where there has been a further 
adverse effect. This is because, as regards the amount of compensation payable for 
non-material damage, the GDPR does not provide for a concrete delimitation, 
with the result that the latter must ultimately be carried out by the courts. In that 
respect, the determination of a specific amount to be paid depends on the gravity 
of the infringement and the adverse effect caused thereby. However, the filling out 
of those concepts necessarily always takes place in relation to other possible 
infringements. In that respect, the question as to whether a mere infringement of 
provisions of the GDPR is already sufficient to establish a claim for compensation 
for non-material damage is also relevant for situations in which a more extensive 
adverse effect is established, since, if such infringement is sufficient, this would 
notionally shift the lower limit upwards. 
22 Entitlement to compensation for non-material damage in cases where it is not 
possible to establish a significant adverse effect going beyond the infringement of 
a statutory provision has hitherto not been recognised in German law. 
23 The national case-law handed down at the highest judicial level has proceeded on 
the assumption that entitlement to monetary compensation exists in the event of 
violations of the general personality right where the interference in question is 
serious and cannot be satisfactorily compensated in any other way. Whether the 
violation of the personality right is so serious that it is necessary to pay monetary 
compensation can be assessed only on the basis of all the circumstances of the 
individual case. In that respect, account must be taken of the significance and 
extent of the interference, the reasoning and motivation of the person who carried 
out the act in question, and the degree of his or her culpability (see, for example, 
Bundesgerichtshof [Federal Court of Justice], judgment of 14 November 2017 – 
VI ZR 534/15; ECLI:DE:BGH:2017:141117UVIZR534.15.0). 
24 It appears doubtful, on the basis not only – but also – of the abovementioned 
recitals, whether that national application of the law is also suitable for the 
interpretation of Article 82 of the GDPR. 
Question 3 
25 If the concept of damage is to be interpreted broadly in the above sense, the 
(objectively justified) concern that personal data has fallen into unauthorised 
hands could also constitute non-material damage for which compensation is 
payable. That question is particularly relevant to the present legal dispute because 
it was not possible to ascertain the extent to which the new residents had gained 
knowledge of the contents of the postal item addressed to the applicants. This is 
because it seems at least possible that the new residents did in fact gain knowledge 
REQUEST FOR A PRELIMINARY RULING OF 5. 8. 2022 – CASE C-590/22 
 
10  
of the contents of the postal item to an extent greater than what they stated in their 
testimonies. Moreover, the new residents did not keep the postal item themselves, 
but left the opened envelope with their parents (in-law) for collection. 
26 If the concern, justified on the basis of objective factors, that personal data could 
have fallen into the hands of third parties were sufficient in itself to establish a 
claim for compensation for non-material damage, the applicants would have to be 
awarded such compensation. At the same time, this would bring about a change in 
the relative gravity of other infringements, thereby affecting the assessment of the 
specific amount of compensation (see above). 
Question 4 
27 As regards compensation for non-material damage, the GDPR does not contain a 
provision comparable to Article 83 of the GDPR, which applies to the imposition 
of administrative fines, and provides that the amount of compensation payable can 
be determined in a uniform manner. 
28 In that respect, it would seem logical for the criteria in that provision also to be 
taken as the basis for the assessment of compensation for non-material damage – 
in so far as those criteria are transferable. 
29 At the same time, the fact that the legislature expressly limited the rules in 
Article 83 of the GDPR to the imposition of administrative fines might militate 
against that provision being taken as the basis. This might preclude the scope of 
application from being extended to compensation for non-material damage, albeit 
that overlaps would inevitably arise in some areas (gravity of the infringement, 
significance of the effects). 
30 Last but not least, the question as to the application of Article 83(5) of the GDPR 
mutatis mutandis is of considerable importance, as this would establish upper 
limits for its scope of application (mutatis mutandis). 
Question 5 
31 Recital 146 states that the concept of damage should be broadly interpreted in a 
manner which fully reflects the objectives of the regulation and ensures full and 
effective compensation of the data subject who suffered the damage. 
32 In particular, the reference to effectiveness could militate in favour of the 
assessment of claims for compensation for non-material damage also being 
intended to have a deterrent function. 
33 If this were not the case and the amounts of compensation payable were set at a 
comparatively low level, the controller could weigh up the costs of a GDPR-
compliant course of action and the amounts of compensation to be paid, if any. 
PS 
 
11 
34 However, the fact that the imposition of administrative fines by the competent 
authorities constitutes a sufficient deterrent which does not require further 
deterrence via the assessment of compensation for non-material damage might 
militate against the assumption that Article 82 of the GDPR is intended to have a 
deterrent effect. 
Question 6 
35 The first defendant in the main proceedings is a tax consultancy firm, while the 
other defendants are its shareholders and are tax advisers themselves. 
36 By virtue of their profession, they are subject to special duties of confidentiality 
which arise from Paragraph 57 of the StBerG and Paragraph 5 of the BOStB, with 
the result that infringements of the provisions of the GDPR which involve or lead 
to the disclosure of data to unauthorised persons also usually entail breaches of the 
abovementioned duties of confidentiality. 
37 The applicants take the view that the simultaneous infringement of the 
abovementioned professional law should be taken into account in the assessment 
of the compensation for non-material damage payable under Article 82 of the 
GDPR. 
38 There are doubts in that respect, because recital 146 is concerned with 
infringements of national law and in that respect refers exclusively to delegated 
and implementing acts adopted in accordance with that regulation and Member 
State law specifying rules of that regulation. Paragraph 57 of the StBerG and 
Paragraph 5 of the BOStB are not such rules; rather, those provisions were already 
in force when the GDPR was adopted. 
Request for a preliminary ruling 
39 The legal issues raised in the questions referred for a preliminary ruling have 
hitherto not been clarified in the case-law of the Court and cannot be sufficiently 
clarified by reference to the wording of the GDPR itself. 
40 In particular, the national case-law and legal literature show that some consider 
that the view hitherto held in relation to national law, that the award of 
compensation for non-material damage is to be handled restrictively, both 
substantively and in terms of amount, should also be applied to Article 82 of the 
GDPR. The Landgericht Duisburg (Regional Court, Duisburg), which is superior 
to the Local Court in the present case, also appears to have proceeded along those 
lines. Despite the fact that the applicants indicated the value in dispute 
(EUR 15 000.00), that court referred the dispute to the Local Court owing to a 
lack of substantive jurisdiction (the Regional Court would have jurisdiction once 
the value threshold of EUR 5 000.00 was exceeded, the Local Court for values 
below that threshold). In that regard, the Regional Court considered that the 
REQUEST FOR A PRELIMINARY RULING OF 5. 8. 2022 – CASE C-590/22 
 
12  
applicants’ estimate was far-fetched and exaggerated, and that a maximum 
amount of EUR 2 000.00 in compensation for non-material damage was 
conceivable. 
41 In so far as the Oberster Gerichtshof (Supreme Court, Austria) and the 
Landgericht Saarbrücken (Regional Court, Saarbrücken) have already referred 
questions for a preliminary ruling to the Court of Justice of the European Union 
by orders of 15 April 2021 and 22 November 2021, respectively, in Cases 
C-741/21 and C-300/21, the questions in those cases correspond only partly to the 
questions asked in the present case. It might be conceivable to join the present 
case to those cases. 
[…]