Judgment;Summary — ECLI:EU:C:2023:1022
Date: 2023-12-21
Language of the case: German
Court formation: Third Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Summary C-667/21 – 1 
Case C-667/21 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
8 November 2021 
Referring court: 
Bundesarbeitsgericht (Germany) 
Date of the decision to refer: 
26 August 2021 
Applicant, appellant in first appeal and appellant on a point of law: 
ZQ 
Defendant, respondent in first appeal and respondent in the appeal on a point 
of law: 
Medizinischer Dienst der Krankenversicherung Nordrhein, a body 
governed by public law 
  
Subject matter of the main proceedings 
Regulation (EU) 2016/679 (General Data Protection Regulation) – Data 
concerning health – Processing of such data concerning health by the employer – 
Dual role of the employer – Compensation 
Subject matter and legal basis of the request 
Interpretation of EU law, Article 267 TFEU 
Questions referred for a preliminary ruling 
1. Is Article 9(2)(h) of Regulation (EU) 2016/679 (General Data Protection 
Regulation; ‘the GDPR’) to be interpreted as prohibiting a medical service 
of a health insurance fund from processing its employee’s data concerning 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-667/21 
 
2  
health which are a prerequisite for the assessment of that employee’s 
working capacity? 
2. If the Court answers Question 1 in the negative, with the consequence that 
an exception to the prohibition on the processing of data concerning health 
laid down in Article 9(1) of the GDPR is possible under Article 9(2)(h) of 
the GDPR: in a case such as the present one, are there further data protection 
requirements, beyond the conditions set out in Article 9(3) of the GDPR, 
that must be complied with, and, if so, which ones? 
3. If the Court answers Question 1 in the negative, with the consequence that 
an exception to the prohibition on the processing of data concerning health 
laid down in Article 9(1) of the GDPR is possible under Article 9(2)(h) of 
the GDPR: does the permissibility or lawfulness of the processing of data 
concerning health depend on the fulfilment of at least one of the conditions 
set out in Article 6(1) of the GDPR? 
4. Does Article 82(1) of the GDPR have a specific or general preventive 
character, and must that be taken into account in the assessment of the 
amount of non-material damage to be compensated at the expense of the 
controller or processor on the basis of Article 82(1) of the GDPR? 
5. Is the degree of fault on the part of the controller or processor a decisive 
factor in the assessment of the amount of non-material damage to be 
compensated on the basis of Article 82(1) of the GDPR? In particular, can 
non-existent or minor fault on the part of the controller or processor be taken 
into account in their favour? 
Provisions of European Union law relied on 
GDPR, in particular Article 9(1), (2)(b) and (h), and (3), Article 6(1) and 
Article 82(1). 
Provisions of national law relied on 
Sozialgesetzbuch (Social Security Code; ‘the SGB’) Fünftes Buch (Book V) (‘the 
SGB V’), in particular Paragraph 275 et seq. 
Bürgerliches Gesetzbuch (Civil Code; ‘the BGB’), in particular the first sentence 
of Paragraph 276(1) 
Succinct presentation of the facts and procedure in the main proceedings 
1 The request for a preliminary ruling is made in the context of a legal dispute 
between the applicant and his employer, a medical service of a health insurance 
fund (‘the MDK’). The parties are in dispute as to whether the defendant is 
KRANKENVERSICHERUNG NORDRHEIN 
 
3 
obliged to pay the applicant compensation for material and non-material damage 
due to an infringement of data protection provisions in the context of their 
employment relationship. 
2 According to the first sentence of Paragraph 278(1) of the SGB V, a medical 
service of the health insurance funds is established as a body governed by public 
law in every federal state in Germany. Its tasks are assigned to it by law. They 
include, inter alia, the preparation of expert reports in order to remove doubts as to 
insured persons’ incapacity for work. According to Paragraph 275(1), first 
sentence, point 3(b), of the SGB V, in the case of an insured person’s incapacity 
for work, as attested by a medical certificate, the health insurance funds are 
obliged, in certain cases or if it is necessary due to the nature, severity, duration or 
frequency of the illness or the course of the illness, to obtain an expert report from 
the MDK in order to remove doubts as to his or her incapacity for work. 
Furthermore, according to Paragraph 275(1a), third sentence, of the SGB V, the 
employer can also request that the health insurance fund obtain such an expert 
report from the medical service if an employee has been on sick leave for a 
relatively long period of time and the employer has doubts as to that employee’s 
incapacity for work. 
3 In 2018, the defendant MDK carried out its tasks at eight sites, with 
approximately 1 000 employees. The applicant has worked for the defendant as an 
employee since 1991, most recently as a system administrator and help desk 
employee in the IT department at site A. That department is also responsible for 
other sites of the defendant. 
4 In its capacity as a medical service for the statutory health insurance funds, the 
defendant prepares expert reports in order to remove doubts as to insured persons’ 
incapacity for work even in cases involving its own employees. Such cases are 
referred to as ‘special cases’ and are subject to special rules. Incoming cases 
relating to the defendant’s own employees are marked as ‘special cases’ and are 
processed exclusively by the employees of the dedicated ‘special case’ 
organisational unit. To that end, a virtual organisational unit for special cases, to 
which only employees of the ‘special case’ organisational unit have access, was 
set up in the computer system used internally by the MDK. 
5 Once an assignment has been completed, the assignment and the expert report, 
including the rest of the electronic medical documents, are filed in the electronic 
archive of the defendant MDK. In that archive, the data pertaining to the 
assignment are stored together with the master data and separately from the expert 
report data in two different databases. The data can be attributed to individual 
persons only via a special ‘key’. Access authorisation is technically verified 
within the system. However, after archiving, a number of employees of the ‘IT 
department’ of the ‘special case’ organisational unit are also able to access all the 
expert reports that have been prepared on the basis of an expert report assignment 
relating to the defendant MDK’s own employees. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-667/21 
 
4  
6 If a physical examination of an employee of the defendant MDK is required for an 
expert report, it is stipulated that that examination be carried out by another 
medical service. Even in such a case, the employees of the ‘special case’ unit add 
the expert report to the assignment in the electronic archives. 
7 In the event that, in its capacity as employer, the defendant itself has doubts as to 
the incapacity for work of one of its employees, it is free, as provided for by law 
in respect of all employers, to request that the health insurance fund obtain from 
the medical service an expert report relating to that employee. In such a case, the 
MDK’s internal rules do not preclude the defendant MDK from processing and 
archiving the case. However, if a physical examination is required, it is carried out 
by another service. 
8 If employees of the MDK claim benefits that require an expert report, they are to 
contribute, for example by using special envelopes, to the expert report 
assignment being recognised as a ‘special case’ and allocated to the ‘special case’ 
organisational unit for processing. If it subsequently transpires that an employee’s 
social data are stored in the area of the internal data processing system that is not 
separately restricted and are therefore accessible to ‘unauthorised employees’, that 
is to say, employees outside the ‘special case’ organisational unit, those data are 
subsequently blocked, if so requested by the employee concerned. 
9 The applicant had been continuously incapacitated for work since 22 November 
2017. After the maintenance of full pay by the defendant had come to an end (as 
prescribed by law), that is to say, since 24 May 2018, the applicant received 
sickness benefits from his health insurance fund. On 6 June 2018, the applicant’s 
health insurance fund gave the defendant MDK the assignment of preparing an 
expert report in order to remove doubts as to the applicant’s incapacity for work. 
The defendant MDK accepted the expert report assignment. An administrator 
allocated the assignment to the ‘Special Case Organisational Unit’. A doctor 
employed by the defendant MDK, who belonged to the ‘Special Case 
Organisational Unit’, prepared an expert report on 22 June 2018. It contained a 
diagnosis of the applicant’s illness. In order to prepare that expert report, the 
doctor had, inter alia, telephoned the applicant’s attending doctor and obtained 
information from him. The expert report of 22 June 2018 was filed in the 
defendant MDK’s electronic archives. It contained, inter alia, the diagnosis 
‘Severe depressive episode without psychotic symptoms’. 
10 It was through his attending doctor that the applicant learned of the call made by 
the defendant MDK’s doctor for the purpose of preparing an expert report. On 
1 August 2018, the applicant telephoned a colleague in the defendant’s IT 
department and asked her whether an expert report was stored in relation to him. 
After searching the archives, the colleague answered that question in the 
affirmative. At the applicant’s request, the colleague photographed the expert 
report and sent the photographs to the applicant, who later submitted a printout for 
the court files in the legal proceedings. 
KRANKENVERSICHERUNG NORDRHEIN 
 
5 
11 By letter of 15 August 2018, the applicant unsuccessfully sought compensation 
from the defendant in the amount of EUR 20 000.00. By his action brought before 
the local Arbeitsgericht (Labour Court) on 17 October 2018, he pursued his claim 
and, in the further course of the proceedings, also sought compensation for 
material damage in the amount of his lost earnings. 
12 In the course of the judicial proceedings, the defendant MDK terminated its 
employment relationships with both the abovementioned doctor and the applicant. 
The essential arguments of the parties in the main proceedings 
13 The applicant takes the view that, in the light of the employment relationship 
existing between him and the defendant, the latter was not permitted to perform 
the functions of a medical service in his case. He submits that the preparation of 
an expert report to order to remove doubts as to an employee’s incapacity for 
work usually involves the processing of data concerning health – including the 
specific diagnosis – which must not be processed within the framework of the 
employment relationship. Therefore, the defendant was not permitted to accept the 
expert report assignment from the outset, let alone process it and store the expert 
report. The impermissible data processing seriously infringed his personality 
rights. His colleagues processed the expert report and thereby obtained knowledge 
of his data concerning health, including the diagnosis of his attending doctor, 
contrary to the provisions of data protection law. They could also continue to view 
those data as a result of the archiving of the expert report. Since such data must 
not, in principle, be processed within the framework of the employment 
relationship, the employer and the MDK should not be the same. The expert report 
assignment should have therefore been processed by one of the other MDKs. 
14 Moreover, the defendant took insufficient data protection precautions when 
storing the expert report. According to the applicant, the defendant also owes him 
compensation for material damage; the defendant is required to compensate him 
for the financial loss that he suffered as a result of the fact that, instead of his 
salary, he received a lower sickness benefit. Without the data protection breaches, 
he would have been able to resume his work at the defendant MDK as of 
December 2018; in any event, he would have had sufficient mental resilience in 
late summer 2018 for the gradual reintegration offered to him by the defendant 
(which is intended to enable employees who have been unfit to work to gradually 
get used to their previous workload again). 
15 The defendant takes the view that it has not infringed any provisions of data 
protection law. It submits that it was permitted also in the applicant’s case, despite 
being his employer, to perform the task of preparing expert reports regarding 
incapacity for work, as assigned to it by law in its capacity as a medical service. In 
addition, the actual processing was always carried out in accordance with the 
provisions of data protection law. The doctor assigned to the case was permitted 
also in the applicant’s case to contact the applicant’s attending doctor by 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-667/21 
 
6  
telephone. Moreover, she only collected data that was required for the expert 
report. The applicant’s data concerning health disclosed to the defendant through 
the request of the health insurance fund and by the attending doctor was always 
sufficiently protected. Only a small group of employees, who, as a matter of 
principle, do not work at the same site as the employee concerned, were entitled to 
access the data at all. There was also no data protection issue in so far as the 
applicant’s direct colleagues from the IT department were authorised to access the 
data. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
16 The referring court proceeds on the assumption that, in the case in the main 
proceedings, ‘personal data’ (Article 4, point (1), of the GDPR) of the applicant 
were ‘processed’ (Article 4, point (2), of the GDPR) in the context of the expert 
report prepared by the defendant in its capacity as a medical service, and those 
data are ‘data concerning health’ (recital 35 of the GDPR, Article 4, point (15), of 
the GDPR). The processing at issue in the present case also falls within the 
material scope of the GDPR, as defined in Article 2(1) thereof. 
17 Furthermore, it must be assumed that the defendant is a ‘controller’ within the 
meaning of Article 4, point (7), of the GDPR, because, in determining whether to 
carry out the expert report assignment concerning the applicant itself and how to 
process the applicant’s data concerning health, it itself determined the purposes 
and means of the processing of personal data. 
18 By its first question, the referring court seeks to ascertain whether Article 9(2)(h) 
of the GDPR is to be interpreted as prohibiting an MDK from processing its 
employee’s data concerning health which are a prerequisite for the assessment of 
that employee’s working capacity. 
19 Since the data processed by the defendant are data concerning health within the 
meaning of Article 9(1) of the GDPR, it is first necessary to examine whether the 
data processing carried out in the context of the preparation and storage of the 
expert report is already prohibited under Article 9(1) of the GDPR. That would be 
the case if none of the exceptions listed in Article 9(2) of the GDPR were to 
apply. In that respect, on the basis of the circumstances of the case in the main 
proceedings, only Article 9(2)(b) and (h) of the GDPR can enter into 
consideration in the present case as exceptions to the general prohibition on 
processing laid down in Article 9(1) of the GDPR. 
20 However, the referring court takes the view that the defendant – in its capacity as 
the applicant’s employer – cannot rely on Article 9(2)(b) of the GDPR. In the case 
in the main proceedings, the processing of the applicant’s data concerning health – 
which took place in connection with the preparation of the expert report in order 
to remove doubts as to the applicant’s incapacity for work – was not necessary for 
the defendant, in its capacity as employer, for the purposes of exercising its rights 
referred to in that provision and carrying out its obligations in that regard. The 
KRANKENVERSICHERUNG NORDRHEIN 
 
7 
referring court takes the view that, in cases where the ‘controller’ is an employer 
and the ‘data subject’ is an employee, the rights and obligations in the field of 
employment and social security and social protection law must be those to which 
the controller and the data subject are entitled or subject in their capacity as parties 
to an employment contract. The rights and obligations within the meaning of 
Article 9(2)(b) of the GDPR must therefore result directly from the employment 
relationship binding that employer and that employee. Accordingly, the 
defendant’s processing of the applicant’s data concerning health was not 
necessary from the point of view of any of the aspects referred to in 
Article 9(2)(b) of the GDPR. 
21 First, the defendant did not itself have doubts as to the applicant’s incapacity for 
work, as attested by a medical certificate; from its point of view, the question did 
not arise as to whether it was obliged to maintain the applicant’s pay in the event 
of illness. Rather, the defendant took action at the instigation of the applicant’s 
health insurance fund after the period of maintenance of full pay had ended, 
because the latter had doubts as to the applicant’s incapacity for work. Second, in 
the event of an employee’s incapacity for work, as attested by a medical 
certificate, national law precludes, for reasons of data protection, an employer 
from becoming aware of more than the fact that the employee is incapacitated for 
work and the expected duration of that incapacity. The employer is not permitted 
to become aware of further data concerning health – in particular the 
diagnosis/diagnoses of the illness. This applies irrespective of whether a health 
insurance fund has given a medical service the assignment of preparing an expert 
report in order to remove doubts as to an employee’s incapacity for work or 
whether the employer itself has doubts about his or her employee’s incapacity for 
work and therefore requests that the health insurance fund obtain an expert report 
from the medical service. 
22 While the referring court takes the view that the exception under Article 9(2)(b) of 
the GDPR therefore does not apply, it has doubts as to whether the defendant can 
rely on Article 9(2)(h) of the GDPR. The processing of the applicant’s data 
concerning health in connection with the preparation of the expert report might 
have been necessary for the assessment of his working capacity within the 
meaning of Article 9(2)(h) of the GDPR. 
23 However, there are serious doubts as to whether the defendant can rely on that 
provision at all in a situation such as that in the present case. This is because the 
applicability of Article 9(2)(h) of the GDPR in the case in the main proceedings 
would lead to the defendant – who, in the view taken by the referring court, 
cannot rely, in its capacity as the applicant’s employer, on Article 9(2)(b) of the 
GDPR for the purpose of processing the applicant’s data concerning health 
obtained in the context of the preparation of the expert report – being permitted to 
process data to a greater extent, contrary to that provision, by virtue of its dual 
function as the applicant’s employer and as the MDK. Moreover, everything 
suggests that the processing of a data subject’s data concerning health, which is 
regulated in Article 9(2)(h) of the GDPR, is to be carried out by a neutral body 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-667/21 
 
8  
and not by the employer. It must therefore be assumed that, in cases involving an 
MDK’s own employees, it must not be tasked by the health insurance fund with 
preparing an expert report in order to remove doubts as to those employees’ 
incapacity for work, and it must not accept such a task. Moreover, if the defendant 
were not permitted to perform an MDK’s tasks itself in cases concerning its own 
employees, this would not have serious consequences in practice. As already 
practised by the defendant MDK in the case of physical examinations, the expert 
report assignment of the health insurance fund can be entrusted in its entirety to 
another medical service without any problems. 
24 Question 2: Question 2 arises only if the Court answers Question 1 in the 
negative. If, in circumstances such as those in the present case, Article 9(2)(h) of 
the GDPR does not prohibit an MDK from processing its employee’s data 
concerning health which are a prerequisite for the assessment of the employee’s 
working capacity, it would be necessary to clarify which data protection 
requirements must be imposed in respect of the data processing. 
25 The referring court proceeds on the assumption that it would not be sufficient to 
comply only with the requirements set out in Article 9(3) of the GDPR. Rather, it 
would be necessary to ensure that all employees with whom there is or may be 
professional contact are excluded from the data processing required for such an 
expert report. In the case of an employer with several sites – as is the case here – 
and where those sites are strictly separated – which, according to the facts of the 
case, is not the case here – it would be conceivable for at least two independent 
‘special case organisational units’ to be set up, so that the unit to which an 
employee whose incapacity for work is being assessed does not belong can be 
used. 
26 In a case such as the present one, this would also require separate IT departments, 
which is also not the case in the dispute in the main proceedings. The referring 
court takes the view that a situation such as that in the present case, where 
colleagues in the IT department in which the applicant also works may ultimately 
have access – authorised or unauthorised – to his data concerning health, and 
where, in addition, it cannot be ruled out that the applicant, as an employee in a 
cross-site IT department, will subsequently have to cooperate professionally with 
the doctor who prepared the expert report regarding his incapacity for work, is 
unacceptable for data protection reasons. Under the GDPR, data pertaining to the 
health status of a data subject which reveal information relating to the past, current 
or future physical or mental health status of the data subject (recital 35 of the 
GDPR) merit specific protection as the context of their processing could create 
significant risks to the fundamental rights and freedoms (recital 51 of the GDPR) 
and the achievement of the purpose of the processing is subject to specific 
requirements of necessity (recital 53 of the GDPR). A breach of the protection of 
personal data concerning health in a situation such as that in the present case may 
result, inter alia, in material or non-material damage to natural persons, such as 
loss of control over their own personal data, discrimination and damage to 
reputation (recital 75 of the GDPR). 
KRANKENVERSICHERUNG NORDRHEIN 
 
9 
27 Therefore, in a situation such as that in the present case, protective measures that 
merely oblige the colleagues involved in the data processing to maintain silence 
are not sufficient. This is because such measures are aimed solely at preventing 
the disclosure of data. However, they cannot address the risk that the relationship 
between the colleagues concerned will be negatively affected by the knowledge of 
sensitive data concerning health which were not voluntarily disclosed. Depending 
on the nature of the illness, risks include damage to the name, standing or 
reputation of the person who was the subject of the expert report, and/or his or her 
exposure – or perceived exposure – to embarrassing situations. In particular, in the 
case in the main proceedings, it should be borne in mind that it is not uncommon 
for depression to be regarded as a ‘taboo subject’ in society and the world of 
work, and that this can lead to others making assumptions about performance. 
Furthermore, the mere circumstance of a review for the purposes of an expert 
report prepared due to doubts as to incapacity for work constitutes sensitive 
information in itself, as some may associate this with the possibility of feigning 
incapacity for work. 
28 The referring court takes the view that it is therefore necessary to ensure, by 
means of technical and organisational measures, that no person employed by a 
medical service has access to the data concerning health, at issue in the present 
case, of their colleagues. This also means that the mere circumstance of an 
upcoming review of incapacity for work must not become known to any person 
employed by the medical service concerned. The defendant MDK would have 
therefore been obliged to ensure that assignments from the health insurance fund 
concerning its own employees were not accepted from the outset. Furthermore, 
data processing systems for sensitive data concerning health must be protected 
against both internal and external attacks of any kind in accordance with the 
highest standards in order to ensure appropriate security of the personal data (see 
Article 5(1)(f) of the GDPR). 
29 Question 3: This question also arises only if the Court answers Question 1 in the 
negative. If, in circumstances such as those in the present case, Article 9(2)(h) of 
the GDPR does not prohibit an MDK from processing its employee’s data 
concerning health which are a prerequisite for the assessment of the employee’s 
working capacity, it would also be necessary to clarify whether the permissibility 
or lawfulness of the processing of data concerning health also depends on 
fulfilment of at least one of the conditions set out in Article 6(1) of the GDPR. 
30 If there is no exception under Article 9(2) of the GDPR to the prohibition of the 
processing of the applicant’s data concerning health laid down in Article 9(1) of 
the GDPR, the referring court proceeds on the assumption that the data processing 
is prohibited and also cannot be ‘allowed’ under Article 6(1) of the GDPR. 
However, it has not yet been clarified whether, in the event that the condition for 
an exception under Article 9(2) of the GDPR is met, the permissibility or 
lawfulness of the processing of data concerning health depends, in addition, on 
fulfilment of at least one of the conditions set out in Article 6(1) of the GDPR. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-667/21 
 
10  
31 With regard to the present case, it is noted that the applicant, as a data subject, has 
not given his consent to the processing of his data concerning health 
(Article 6(1)(a) of the GDPR) and that, moreover, the processing of the 
applicant’s data concerning health at issue is not necessary for the performance of 
the employment contract of the parties to the main proceedings (Article 6(1)(b) of 
the GDPR). Of the other conditions exhaustively listed in Article 6(1) of the 
GDPR, two do not enter into consideration from the outset, namely those set out 
in Article 6(1)(d) and (f) of the GDPR. 
32 Article 6(1)(c) or (e) of the GDPR might enter into consideration. However, there 
is good reason to believe that the data processing carried out by the defendant 
lacks necessity in both cases. This is because the objective of removing doubts as 
to an employee’s incapacity for work by means of an expert report can be 
achieved just as effectively by way of the intervention of another medical service. 
This would have the advantage that it would not be an employee’s own employer 
which processes his or her sensitive data concerning health with the involvement 
of his or her colleagues. Since the desired objective can therefore also be achieved 
by another means that better ensures the protection of sensitive data concerning 
health, the processing of the applicant’s data concerning health carried out by the 
defendant MDK would go beyond what is necessary. In addition, the principle of 
data minimisation (Article 5(1)(c) of the GDPR) could be affected. 
33 Questions 4 and 5 (preliminary remarks): If, on the basis of the Court’s answers to 
the first three questions, it were to emerge that there had been an infringement or 
even several infringements of the GDPR within the meaning of Article 82(1) of 
the GDPR in the case in the main proceedings, it would have to be assumed that 
the applicant would, in principle, have a right to receive compensation from the 
defendant for the damage suffered in accordance with Article 82(1) of the GDPR. 
34 In connection with the interpretation of that provision, the referring court refers to 
the request for a preliminary ruling made by the Oberster Gerichtshof (Supreme 
Court, Austria) (C-300/21) and to the fact that the questions asked by the referring 
court are related to those asked by the Supreme Court (Austria). 
35 The referring court proceeds on the assumption that Article 82(1) of the GDPR 
provides for a right to compensation only for persons who themselves have 
suffered an infringement of their (subjective) rights as a result of the infringement 
of one or more provisions of the GDPR in the processing of ‘their’ personal data 
(see recital 2 of the GDPR) and that the legal right to compensation for non-
material damage pursuant to Article 82(1) of the GDPR does not additionally 
require that the person whose rights have been infringed demonstrate (further) 
non-material damage suffered by him or her. Therefore, from the point of view of 
the referring court, that person does not have to demonstrate ‘a consequence of the 
infringement of at least some weight’ (see, in that regard, the third question 
referred in the request for a preliminary ruling in Case C-300/21). The referring 
court takes the view that the infringement of the GDPR in itself already leads to 
non-material damage for which compensation can be sought. 
KRANKENVERSICHERUNG NORDRHEIN 
 
11 
36 Irrespective of that, the referring court takes the view that the resolution of the 
present dispute does not depend on the Court’s answer to the third question 
referred in the request for a preliminary ruling in Case C-300/21, because, even if 
the Court were to conclude that a right to compensation for non-material damage 
under Article 82(1) of the GDPR presupposes ‘the existence of a consequence of 
the infringement of at least some weight that goes beyond the upset caused by that 
infringement’, that is to say, if a certain threshold of severity had to be exceeded, 
this would not preclude a right to compensation on the part of the applicant, since 
the threshold for a severe infringement is (greatly) exceeded in the present case. 
37 Questions 4 and 5 in detail: By its fourth question referred, the referring court 
seeks to ascertain whether Article 82(1) of the GDPR has a preventive character in 
addition to its compensatory function, and whether that must be taken into account 
in the assessment of the amount of non-material damage to be compensated at the 
expense of the controller or processor on the basis of Article 82(1) of the GDPR. 
38 According to recital 146 of the GDPR, data subjects should receive full and 
effective compensation for the damage they have suffered. In that respect, the 
referring court proceeds on the assumption that all circumstances of the individual 
case must be taken into account when the court assesses the compensation for 
non-material damage – possibly including, in the present case, the subsequent 
termination of the employment relationship by the defendant – and that actual and 
effective legal protection of the rights derived from the GDPR is to be ensured. 
Therefore, it might be of decisive importance that – as in other areas of EU law – 
the amount of compensation for non-material damage is commensurate to the 
seriousness of the infringement of the GDPR for which liability for such 
compensation is imposed, whereby, presumably, a genuinely dissuasive effect is 
to be ensured, but, at the same time, the general principle of proportionality must 
be respected. 
39 In addition to the abovementioned principle of effectiveness, the principle of 
equivalence might also have to be taken into account when determining the 
amount of compensation for non-material damage. Article 82 of the GDPR makes 
no reference to the law of the Member States and must be given an autonomous 
and uniform interpretation throughout the European Union. Nevertheless, in view 
of the different amounts of compensation in the Member States in comparable 
cases, aspects of equivalence might have to be taken into account when 
determining the amount of compensation for non-material damage. 
40 By its fifth question referred, the referring court seeks to ascertain whether the 
degree of fault on the part of the controller (or processor) is a decisive factor in the 
assessment of the amount of non-material damage to be compensated on the basis 
of Article 82(1) of the GDPR? In that connection, the question arises, in 
particular, as to whether non-existent or minor fault on the part of the controller 
(or processor) can be taken into account in their favour. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-667/21 
 
12  
41 The referring court raises that question in particular against the background of 
German civil law. The first sentence of Paragraph 276(1) of the BGB provides 
that, as a general rule, the obligor is liable for intent and negligence, unless 
provision is made for stricter or milder liability. If a similar rule were to apply to 
Article 82(1) of the GDPR, liability would have to be based on something 
additional to mere infringement of the GDPR, namely the degree of individual 
culpability due to intent or negligence. However, the referring court proceeds on 
the assumption that the liability of the controller (or processor) under Article 82(1) 
of the GDPR is strict, that is to say, the liability of the author of an infringement is 
not at all dependent on the existence or proof of fault. Thus, the infringement of 
the GDPR as such might already be sufficient for a right under Article 82(1) of the 
GDPR. 
42 It would appear that nothing to the contrary is to be inferred from Article 82(3) of 
the GDPR. The referring court takes the view that the provision contained therein, 
in accordance with which the party concerned is to be exempt from liability if it 
proves it is not responsible for the event giving rise to the damage, does not 
concern fault, but only the question of ‘involvement’ (in the sense of ‘involved’ or 
‘not involved’) – for example in data processing contexts which are difficult to 
understand from the outside and involve several potential participants – or the 
question of ‘authorship’, in the sense of causality. The latter can be assumed, for 
example, if the event giving rise to liability is based on unauthorised access by a 
third party which was successful despite the fact that all the necessary security 
measures had been taken.