Judgment;Summary — ECLI:EU:C:2024:72
Date: 2024-01-25
Language of the case: German
Court formation: Third Chamber
Subject matter: Data protection
Procedure: Reference for a preliminary ruling;Reference for a preliminary ruling - inadmissible
Origin: Germany

Anonymised version 
Translation C-687/21 – 1 
Case C-687/21 
Request for a preliminary ruling 
Date lodged: 
16 November 2021 
Referring court: 
Amtsgericht Hagen (Germany) 
Date of the decision to refer: 
11 October 2021 
Applicant: 
BL 
Defendant: 
Saturn Electro-Handelsgesellschaft mbH Hagen 
  
[…] 
Amtsgericht Hagen (Local Court, Hagen) 
Order 
In the case between 
BL, […] 44319 Dortmund, 
Applicant, 
[…] 
and 
Saturn Electro-Handelsgesellschaft mbH Hagen, […] Hagen, 
EN 
REQUEST FOR A PRELIMINARY RULING OF 11. 10. 2021 – CASE C-687/21 
 
2  
Anonymised version 
Defendant, 
[…] 
The following questions are referred to the Court of Justice of the European 
Union for a preliminary ruling: 
1. As no automatic legal effects are specified, is the compensation rule 
enacted in Article 82 of the General Data Protection Regulation invalid in 
the case of non-material damage? 
2. Is it necessary, for the purposes of the right to compensation, to 
establish the occurrence of non-material damage, to be demonstrated by the 
claimant, in addition to the unauthorised disclosure of the protected data to 
an unauthorised third party? 
3. Does the accidental disclosure of the personal data of the data subject 
(name, address, occupation, income, employer) to a third party in a paper 
document (printout), as the result of a mistake by employees of the 
processing undertaking, suffice in order to establish infringement of the 
General Data Protection Regulation? 
4. Where the undertaking accidentally discloses, through its employees, 
data entered in an automated data processing system to an unauthorised third 
party in the form of a printout, does that accidental disclosure to a third party 
qualify as unlawful further processing (Article 2(1), Article 5(1)(f), 
Article 6(1) and Article 24 of the General Data Protection Regulation)? 
5. Is non-material damage within the meaning of Article 82 of the 
General Data Protection Regulation incurred even where the third party who 
received the document containing the personal data did not read the data 
before returning the document containing the information, or does the 
discomfort of the person whose personal data were unlawfully disclosed 
suffice for the purpose of establishing non-material damage within the 
meaning of Article 82 of the General Data Protection Regulation, given that 
every unauthorised disclosure of personal data entails the risk, which cannot 
be eliminated, that the data might nevertheless have been passed on to any 
number of people or even misused? 
6. Where accidental disclosure to third parties is preventable through 
better supervision of the undertaking’s helpers and/or better data security 
arrangements, for example by handling collections separately from contract 
documentation (especially financing documentation) under separate 
collection notes or by sending the documentation internally to the collection 
counter without giving the customer the printed documents and collection 
note, how serious should the infringement be considered to be 
(Article 32(1)(b) and (2) and Article 4, point 7, of the General Data 
Protection Regulation)? 
SATURN ELECTRO 
 
3 
Anonymised version 
7. Is compensation for non-material damage to be regarded as the award 
of a penalty similar to a contract penalty? 
Reasons: 
The court has to adjudicate the following facts: 
The applicant in the main proceedings visited the defendant company in 
order to order a household appliance. The purchase was to be financed by a 
third party. 
For that purpose, an employee of the undertaking prepared the appropriate 
purchase and credit agreement, which was then entered into the defendant’s 
automated data processing system. 
Aside from the customer’s surname and forename, the documents also 
contained the customer’s address, place of residence and employer, as well 
as the income paid to the customer by his employer and his bank details. 
The negotiation and effects of the contract were documented and the 
documents were printed, signed by both parties and handed to the customer. 
The customer took the documents, which were bundled (stapled) together, to 
the collection counter to which he had been directed, where other employees 
of the defendant company were responsible for handing out goods. 
Two helpers were involved in handing out goods. The collections manager 
was busy serving another customer and was not physically present at the 
collection counter. 
Another customer (the third party) jumped the queue, which the employees 
did not notice, and was given both the household appliance ordered by the 
applicant and the associated contract documents, which the applicant had 
handed over to them, including the personal details listed above. 
The third party left with the household appliance and the documents. The 
error was subsequently discovered by the manager, who managed to retrieve 
the household appliance and the documents within half an hour. The 
documents were returned to the applicant about 30 minutes after they had 
been handed over to the third party. 
The defendant offered to compensate for the error by delivering the 
household appliance to the applicant’s home free of charge, but the applicant 
rejected that offer as inadequate. 
The applicant is now seeking damages from the defendant company for pain 
and suffering, including on the basis of the General Data Protection 
REQUEST FOR A PRELIMINARY RULING OF 11. 10. 2021 – CASE C-687/21 
 
4  
Anonymised version 
Regulation. The defendant contends that the General Data Protection 
Regulation was not infringed and that no damage was incurred. 
It further argues that any infringement of the General Data Protection 
Regulation presupposes a degree of severity, which is missing here. Data 
misuse, that is the use of the applicant’s personal data by the third party, has 
not been alleged and there is as yet no evidence of any such misuse. 
The court holds that, if Article 82 of the General Data Protection Regulation 
is to be effective in respect of the right to compensation for the non-material 
damage addressed therein, a right might exist if it is automatically triggered 
when the paper document containing the applicant’s personal data is handed 
over to the unauthorised third party. 
In order to resolve doubts as to whether the court’s interpretation is correct, 
the order for reference should also be understood as seeking clarification as 
to whether the fact that paper documents containing the data entered in the 
automated data processing system were handed over to an unauthorised third 
party as the result of negligence of itself establishes infringement of the 
General Data Protection Regulation, which the defendant vehemently 
denies, although it bears the burden of proving its innocence. 
It is also necessary to determine, through interpretation of Article 82 of the 
General Data Protection Regulation, the extent to which contributory 
negligence may preclude, in whole or in part, the right to compensation. The 
recitals of the General Data Protection Regulation do not provide any more 
detailed information on the above questions of interpretation. 
[…]