Judgment — ECLI:EU:C:2024:288
Date: 2024-04-11
Language of the case: German
Court formation: Third Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Anonymised version 
Translation C-741/21 – 1 
Case C-741/21 
Request for a preliminary ruling 
Date lodged: 
1 December 2021 
Referring court: 
Landgericht Saarbrücken (Germany) 
Date of the decision to refer: 
22 November 2021 
Applicant: 
GP 
Defendant: 
juris GmbH 
  
[…] 
LANDGERICHT SAARBRÜCKEN (Regional Court, Saarbrücken) 
5th Civil Chamber 
ORDER 
In the case of 
GP, […] Duisburg, 
applicant 
[…] 
v 
EN 
REQUEST FOR A PRELIMINARY RULING OF 22. 11. 2021 – CASE C-741/21 
 
2  
Anonymised version 
juris GmbH Juristisches Informationssystem für die Bundesrepublik Deutschland, 
[…] Saarbrücken, 
defendant 
[…] 
the 5th Civil Chamber of the Landgericht Saarbrücken, 
[…] [formation of the court] 
has made the following order: 
I. 
The following questions on the interpretation of Chapter VIII, in particular of 
Article 82, of Regulation (EU) 2016/679 of the European Parliament and of the 
Council of 27 April 2016 on the protection of natural persons with regard to the 
processing of personal data and on the free movement of such data, and repealing 
Directive 95/46/EC (General Data Protection Regulation; ‘the GDPR’), are 
referred to the Court of Justice of the European Union (‘the Court’) for a 
preliminary ruling under Article 267 TFEU: 
1. In the light of recital 85 and the third sentence of recital 146 of the 
GDPR, is the concept of ‘non-material damage’ in Article 82(1) of the 
GDPR to be understood as covering any impairment of the protected 
legal position, irrespective of the other effects and materiality of that 
impairment? 
2. Is liability for compensation under Article 82(3) of the GDPR 
excluded by the fact that the infringement is attributed to human error 
in the individual case on the part of a person acting under the authority 
of the processor or controller within the meaning of Article 29 of the 
GDPR? 
3. Is it permissible or necessary to base the assessment of compensation 
for non-material damage on the criteria for determining fines set out in 
Article 83 of the GDPR, in particular in Article 83(2) and 83(5) of the 
GDPR? 
4. Must the compensation be determined for each individual 
infringement, or are several infringements – or at least several 
infringements of the same nature – penalised by means of an overall 
amount of compensation, which is not determined by adding up 
individual amounts but is based on an evaluative overall assessment? 
II. 
JURIS 
 
3 
Anonymised version 
[…] [stay of the proceedings until a ruling has been given by the Court of Justice 
of the European Union] 
Grounds 
A. Subject matter of the main proceedings 
1 The applicant, who is a self-employed lawyer in Germany, was a client of the 
defendant, which operates a legal database. After the defendant, in response to a 
request for information made by the applicant, had informed the applicant that his 
data had also been used for direct marketing purposes, the applicant, by letter of 
6 November 2018, withdrew the consent given to the defendant to be informed 
about search services, content and events by email and/or telephone, as well as 
any other consent that he may have given. Furthermore, he objected to any 
processing of his personal data for marketing purposes (with the exception of the 
processing necessary to send him the newsletters […] [names of the newsletters] 
that he still wished to receive). 
2 In January 2019, the applicant received two marketing letters from the defendant 
by post, each dated 18 January 2019, at his law firm’s address but addressed to 
him personally. In response, the applicant notified the defendant by letter of 
18 April 2019, attaching his previous objection of 6 November 2018 to the use of 
personal data for marketing purposes, that his data had been unlawfully processed 
by the generation of the marketing letters, and asserted a claim for compensation 
under Article 82(1) of the GDPR. On 3 May 2019, the defendant sent the 
applicant another marketing letter, in response to which the applicant once again 
declared his objection by letter of 15 May 2019, served on the defendant by a 
bailiff. 
3 Each of the abovementioned marketing letters had a ‘personal test code’, 
designated as such by the defendant, and consisting of an individual ten-digit 
character string, printed on them, accompanied by a request inviting the addressee 
to enter that code on the defendant’s website, which was also specified. On 7 June 
2019, the applicant instructed a notary to access the website specified in the 
marketing letter of 3 May 2019 and enter the personal test code, as a result of 
which an online order form for products of the defendant appeared, together with 
personal details of the applicant. 
4 The applicant takes the view that the defendant unlawfully processed personal 
data concerning him and thereby breached his fundamental right under Article 8 
of the Charter of Fundamental Rights of the European Union (‘the Charter’) in 
such a way that he lost control over his personal data. According to the applicant, 
the defendant therefore owes him both compensation for material damage (costs 
for the bailiff and the notary) and compensation for non-material damage pursuant 
to Article 82(1) of the GDPR, without it being necessary for additional 
requirements (effects or materiality of the impairment of his rights) to be met in 
that respect. 
REQUEST FOR A PRELIMINARY RULING OF 22. 11. 2021 – CASE C-741/21 
 
4  
Anonymised version 
5 The defendant denies liability on its part, referring to the fact that it had 
implemented a process for processing objections to the use of personal data for 
marketing purposes and that the late consideration of the applicant’s objection in 
that regard was due to the fact that an individual employee had acted contrary to 
instructions and that, after the letters had already been commissioned, the 
objection could have been complied with only with a disproportionate amount of 
effort and/or expenditure. 
The defendant takes the view that a breach of the obligation under Article 21(3) of 
the GDPR does not, in itself, constitute damage within the meaning of 
Article 82(1) of the GDPR. 
B. Relevant provisions 
I. EU law 
Regulation 2016/679 – General Data Protection Regulation (GDPR) 
6 Article 82 Right to compensation and liability 
1. Any person who has suffered material or non-material damage as a result of 
an infringement of this Regulation shall have the right to receive compensation 
from the controller or processor for the damage suffered. 
2. Any controller involved in processing shall be liable for the damage caused 
by processing which infringes this Regulation. A processor shall be liable for the 
damage caused by processing only where it has not complied with obligations of 
this Regulation specifically directed to processors or where it has acted outside or 
contrary to lawful instructions of the controller. 
3. A controller or processor shall be exempt from liability under paragraph 2 if 
it proves that it is not in any way responsible for the event giving rise to the 
damage. 
…  
7 Article 83 General conditions for imposing administrative fines 
…  
2. Administrative fines shall, depending on the circumstances of each 
individual case, be imposed in addition to, or instead of, measures referred to in 
points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an 
administrative fine and deciding on the amount of the administrative fine in each 
individual case due regard shall be given to the following: 
JURIS 
 
5 
Anonymised version 
(a) the nature, gravity and duration of the infringement taking into account the 
nature scope or purpose of the processing concerned as well as the number 
of data subjects affected and the level of damage suffered by them; 
(b) the intentional or negligent character of the infringement; 
(c) any action taken by the controller or processor to mitigate the damage 
suffered by data subjects; 
(d) the degree of responsibility of the controller or processor taking into account 
technical and organisational measures implemented by them pursuant to 
Articles 25 and 32; 
(e) any relevant previous infringements by the controller or processor; 
(f) the degree of cooperation with the supervisory authority, in order to remedy 
the infringement and mitigate the possible adverse effects of the 
infringement; 
(g) the categories of personal data affected by the infringement; 
(h) the manner in which the infringement became known to the supervisory 
authority, in particular whether, and if so to what extent, the controller or 
processor notified the infringement; 
(i) where measures referred to in Article 58(2) have previously been ordered 
against the controller or processor concerned with regard to the same subject 
matter, compliance with those measures; 
(j) adherence to approved codes of conduct pursuant to Article 40 or approved 
certification mechanisms pursuant to Article 42; and 
(k) any other aggravating or mitigating factor applicable to the circumstances of 
the case, such as financial benefits gained, or losses avoided, directly or 
indirectly, from the infringement. 
3. If a controller or processor intentionally or negligently, for the same or 
linked processing operations, infringes several provisions of this Regulation, the 
total amount of the administrative fine shall not exceed the amount specified for 
the gravest infringement. 
…  
5. Infringements of the following provisions shall, in accordance with 
paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the 
case of an undertaking, up to 4% of the total worldwide annual turnover of the 
preceding financial year, whichever is higher: 
REQUEST FOR A PRELIMINARY RULING OF 22. 11. 2021 – CASE C-741/21 
 
6  
Anonymised version 
(a) the basic principles for processing, including conditions for consent, 
pursuant to Articles 5, 6, 7 and 9; 
(b) the data subjects’ rights pursuant to Articles 12 to 22; 
…  
8 Recital 85 
A personal data breach may, if not addressed in an appropriate and timely manner, 
result in physical, material or non-material damage to natural persons such as loss 
of control over their personal data or limitation of their rights, discrimination, 
identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, 
damage to reputation, loss of confidentiality of personal data protected by 
professional secrecy or any other significant economic or social disadvantage to 
the natural person concerned. …  
9 Recital 146 
The controller or processor should compensate any damage which a person may 
suffer as a result of processing that infringes this Regulation. The controller or 
processor should be exempt from liability if it proves that it is not in any way 
responsible for the damage. The concept of damage should be broadly interpreted 
in the light of the case-law of the Court of Justice in a manner which fully reflects 
the objectives of this Regulation. This is without prejudice to any claims for 
damage deriving from the violation of other rules in Union or Member State 
law. …  
Data subjects should receive full and effective compensation for the damage they 
have suffered. …  
II. German law 
Bürgerliches Gesetzbuch (German Civil Code; ‘the BGB’) 
10 Paragraph 823 Liability for compensation 
(1) A person who, intentionally or negligently, unlawfully injures the life, body, 
health, freedom, property or other right of another person is liable to pay 
compensation to the other party for the damage arising from this. 
(2) The same duty is imposed on a person who commits a breach of a statute 
that is intended to protect another person. If, according to the contents of the 
statute, it may also be breached without fault, then liability to compensation shall 
exist only in the event of fault. 
11 Paragraph 253 Non-material damage 
JURIS 
 
7 
Anonymised version 
(1) For damage other than material damage, monetary compensation may be 
claimed only in the cases determined by law. 
(2) Where compensation is payable for injury to body, health, freedom or sexual 
self-determination, equitable monetary compensation may also be claimed for the 
damage which is not material in nature. 
C. Uncertainty as to interpretation 
I. Question 1 
12 Article 82(1) of the GDPR specifies an infringement of the regulation, material or 
non-material damage and a causal link between the infringement and the damage 
as being the conditions governing the right to receive compensation. 
The applicant bases his claim solely on the fact that his data were processed 
without his objection having been taken into consideration, thereby infringing his 
right to have control over his personal data, which is guaranteed by Article 8 of 
the Charter and given concrete expression by the GDPR. 
13 Against that background, the question which first arises is whether an 
infringement of the GDPR can already give rise to damage without further legal 
positions being impaired. This might be the case if the infringed provision of the 
GDPR confers a subjective right on the data subject. Accordingly, if an 
infringement of the regulation – such as a mere unlawful processing of data under 
Article 6(1) or the failure to comply with an objection under Article 21(3) – and 
the occurrence of damage could coincide, there would be no need for further 
findings as to whether another legal position has been affected. 
14 Furthermore, it needs to be clarified whether any impairment of the protected 
legal position is sufficient to establish a right to compensation. 
Under German law, claims for compensation for non-material damage as a result 
of data protection breaches were already possible before the GDPR entered into 
force. This is because data protection breaches can constitute an infringement of 
general personality rights, which can give rise to claims for compensation under 
Paragraph 823(1) of the BGB, Paragraph 253 of the BGB and Article 8 of the 
ECHR. However, in accordance with settled case-law, an infringement of general 
personality rights leads to a right to monetary compensation only in the case of a 
serious encroachment, and if that encroachment cannot be satisfactorily 
compensated in another way (Bundesgerichtshof (Federal Court of Justice; ‘the 
BGH’), judgment of 14 November 2017, VI ZR 534/15; BGH, judgment of 
17 December 2013, VI ZR 211/12); constitutional objections to that approach are 
not apparent (Bundesverfassungsgericht (Federal Constitutional Court; ‘the 
BVerfG’), decision of 2 April 2017, 1 BvR 2194/15). 
REQUEST FOR A PRELIMINARY RULING OF 22. 11. 2021 – CASE C-741/21 
 
8  
Anonymised version 
15 It appears to be unclear whether such restrictions also apply to the right to 
compensation for non-material damage provided for in Article 82(1) of the GDPR. 
In view of the third and sixth sentences of recital 146, it might be assumed that the 
concept of damage within the meaning of Article 82(1) of the GDPR is to be 
interpreted broadly, especially since recital 85 expressly mentions loss of control 
over personal data as an example of damage. 
On the other hand, recital 85 refers to ‘significant economic or social 
disadvantage’, which might suggest that minor damage is to be excluded from 
compensation in any event. 
II. Question 2 
16 According to the wording of Article 82(1) of the GDPR, the right to compensation 
is not linked to fault on the part of the controller or processor, with the result that 
it can probably be assumed – in the light also of Article 82(3) of the GDPR, 
according to which a controller or processor is exempt from liability if it proves 
that it is not in any way responsible for the event giving rise to the damage – that 
there is a presumption of fault. 
17 It is not clear from the provision what specific requirements are to be imposed on 
that proof; in particular, it remains open whether ‘responsible’ is to be understood 
in the sense of intent or negligence, and what meaning is to be ascribed to the 
wording ‘in any way’. 
18 Against that background, the question as to whether the liability of the controller 
is already precluded by the fact that it invokes an error on the part of an 
employee – in casu, the failure to record in the system an objection to the use of 
personal data for marketing purposes, contrary to express instructions – gains 
greater significance. However, such an interpretation of Article 82(3) of the 
GDPR could lead to a not insignificant limitation of the right under Article 82(1) 
of the GDPR if a controller could avoid liability by sweepingly referring to an 
error made by an employee in the course of his or her activities. The constituent 
element ‘in any way’ might be understood as a corrective to that possibility, but 
does not indicate which requirements must be met in that regard. 
III. Question 3 
19 This question seeks to ascertain the criteria according to which the extent of the 
compensation owed can be determined, in particular whether uniform criteria are 
prescribed by the GDPR or whether the extent of the compensation depends on 
the respective national provisions. 
20 Although Article 83 of the GDPR concerns the imposition of fines, the criteria for 
determining such fines set out in that provision also seem appropriate and 
JURIS 
 
9 
Anonymised version 
effective for the assessment of monetary compensation for non-material damage. 
The uniform application of those criteria in all Member States would also take 
into account the requirement of effective compensation (recital 146). The question 
referred is of particular importance here because, in the case of an undertaking, 
Article 83(5) of the GDPR stipulates annual turnover as a basis for assessment for 
certain infringements (of, inter alia, Articles 6 and 21 of the GDPR). 
IV. Question 4 
21 In the main proceedings, data processing for direct marketing purposes took place 
on several occasions, despite the fact that an objection to such processing had 
previously been declared on several occasions. 
22 Against that background, the question arises as to whether each individual 
infringement of the GDPR is to be handled and penalised in isolation, or 
whether – at least in the case of several infringements of the same nature – an 
overall amount of compensation is to be determined. This raises the question as to 
whether, for the overall amount of compensation to be calculated, individual 
amounts must be fixed for each infringement, which are then included in a total 
amount – but not by adding up the individual amounts – or whether an overall 
amount of compensation must be determined on the basis of an evaluative overall 
assessment. 
V. Request for a preliminary ruling 
23 The right to compensation under Article 82(1) of the GDPR has not yet been 
definitively clarified in the case-law of the Court of Justice of the European 
Union, nor can the individual requirements be determined directly from the 
GDPR; in particular, a characteristic of lack of materiality cannot be derived 
directly from the GDPR, with the result that it appears to be necessary to make a 
request for a preliminary ruling in order to obtain clarification concerning the 
questions set out above (see BVerfG, decision of 14 January 2021, 1 BvR 
2853/19). 
24 The Austrian Oberster Gerichtshof (Supreme Court) has already made a request 
for a preliminary ruling by the Court concerning Article 82 of the GDPR by 
decision of 15 April 2021 […] [file reference]. This does not preclude the present 
request, especially since the questions referred deal with the same subject matter 
only in part. 
[…] [Signature]