Judgment;Abstract — ECLI:EU:C:2025:655
Date: 2025-09-04
Language of the case: German
Court formation: Fourth Chamber
Procedure: Reference for a preliminary ruling
Origin: Germany

summary, in assessing the amount of non-material damage resulting from unlawful processing that is to be compensated because it has already occurred, the fact that, in addition to the right to compensation, the data subject is also entitled to seek an order to desist, in future, from any further unlawful processing similar to that already carried out, is not a mitigating circumstance. V. Conclusion 89. In the light of the foregoing considerations, I propose that questions 1, 2, 3 and 6 referred by the Bundesgerichtshof (Federal Court of Justice, Germany) should be answered in the following terms: ‘Articles 5(1)(a), 6(1), 79(1) and 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that: – In accordance with Articles 5(1)(a) and 6(1), together with Article 79(1), of Regulation 2016/679, a data subject whose personal data have been unlawfully disclosed by the controller has the right to bring an action for an order that the controller desist, in future, from any further unlawful onward transfers of those data, similar to the transfers already carried out. – It is for national law, in compliance with the principles of equivalence and effectiveness, to lay down rules governing the conditions for bringing an action for an order to desist against the controller for processing of the personal data. For those purposes, there is nothing to prevent the requirement of proof of the risk of recurrence or, where appropriate, the establishment of a (rebuttable) presumption of that risk, resulting from the existence of a previous infringement of Regulation 2016/679. – Under Article 82(1) of Regulation 2016/679, in assessing the amount of non-material damage which is to be compensated, the fact that, in addition to the right to compensation, the data subject is also entitled to require that the controller desist, in future, from any other unlawful processing similar to that already carried out is not a mitigating circumstance.’ 1 Original language: Spanish. 2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’). 3 On the subject of Article 82(1) of the GDPR, see the recent judgments of 20 June 2024, Scalable Capital (C‑182/22 and C‑189/22, EU:C:2024:531); of 4 October 2024, Agentsia po vpisvaniyata (C‑200/23, EU:C:2024:827; ‘judgment in Agentsia po vpisvaniyata’); and of 4 October 2024, Patērētāju tiesību aizsardzības centrs (C‑507/23, EU:C:2024:854; ‘judgment in Patērētāju tiesību aizsardzības centrs’). 4 Judgments of 28 April 2022, Meta Platforms Ireland (C‑319/20, EU:C:2022:322); (‘judgment in Meta Platforms Ireland’), and of 4 October 2024, Lindenapotheke (C‑21/23, EU:C:2024:846). Those cases concerned actions for the cessation of a practice considered to be unfair because it did not comply with the legal requirements for obtaining valid consent from the data subject, in accordance with the GDPR. In both cases, the protection of personal data by means of actions for a prohibitory injunction was sought under provisions aimed at protecting consumers or at countering unfair commercial practices: the infringement of the GDPR constituted the factual situation to which those provisions were applicable. The questions referred to the Court concerned the legal standing of the applicants in the respective proceedings. 5 Civil Code (‘the BGB’). 6 Paragraph 10 of the order for reference explains that, in this case, the provision applies by analogy to the infringement of absolute rights within the meaning of Paragraph 823(1) of the BGB or the infringement of a provision of the kind referred to in Paragraph 823(2) of the BGB. 7 In support of his claim for damages, IP submits that the non-material damage suffered does not lie in the abstract loss of control over the disclosed data, but rather the fact that at least one other person, who knows IP and potential and former employers of IP, now has knowledge of confidential facts. IP fears that that person, who works in the same sector as him, may have disclosed the data contained in the message or may have been able to gain an advantage, through that knowledge, as a competitor for possible positions available in the employment market. In addition, he feels that the rejection of his salary expectations is a humiliation which he did not wish to reveal to third parties, especially potential competitors. 8 See point 22 below. 9 See the references cited at paragraphs 21 and 29 of the order for reference. 10 Judgment of 21 December 2023, Krankenversicherung Nordrhein (C‑667/21, EU:C:2023:1022, paragraph 37). 11 The Commission’s written observations, paragraph 11 et seq., albeit without explicit reference to Article 5 of the GDPR. 12 Pursuant to Article 1(2) thereof, the GDPR ‘protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.’ Therefore, the GDPR is capable of creating obligations which are directly related to natural persons, and not only in the public or general interest. 13 The imperative wording is also found in at least the following language versions: ‘los datos personales serán’ (Spanish version); ‘personal data shall be’ (English version); ‘les données à caractère personnel doivent être’ (French version); ‘Personenbezogene Daten müssen’ (German version). 14 Pursuant to Article 5(2) of the GDPR, ‘the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’ In order to demonstrate compliance, the controller must ensure that the processing is lawful. See judgment of 4 May 2023, Bundesrepublik Deutschland (Court electronic mailbox) (C‑60/22, EU:C:2023:373, paragraphs 53 and 54). 15 Article 83(5)(a) of the GDPR. 16 For a comparison of the obligations imposed by Articles 26 and 30 of the GDPR with those laid down by Articles 5 and 6 thereof, see judgment of 4 May 2023, Bundesrepublik Deutschland (Court electronic mailbox) (C‑60/22, EU:C:2023:373, paragraph 59) et seq. 17 Judgment of 4 May 2023, Bundesrepublik Deutschland (Court electronic mailbox) (C‑60/22, EU:C:2023:373, paragraph 57): ‘any processing of personal data must comply with the principles relating to the processing of data which are set out in Article 5(1) of that regulation and satisfy the conditions governing lawfulness of the processing which are listed in Article 6 of that regulation’. See also judgment of 1 October 2015, Bara and Others (C‑201/14, EU:C:2015:638), in relation to the legislation preceding the GDPR, that is, Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31). The lawful processing of data was referred to in Article 6 of Directive 95/46 among the ‘principles relating to data quality’, while the bases for lawfulness were laid down in Article 7, as ‘criteria for making data processing legitimate’. 18 Judgment of 21 December 2023, Krankenversicherung Nordrhein (C‑667/21, EU:C:2023:1022, paragraph 77), and other references. 19 Loc. cit. 20 According to Directive 95/46 , the situation was different with regard to other more detailed specifications, in the form of rights of the data subject, of the principles governing the processing of personal data. A number of the rights linked to those principles were already laid down in Directive 95/46, and the GDPR defined them in more detail, as recital 9 of the GDPR explains. Others were not referred to in that directive and their inclusion in the regulation met with resistance, especially as a result of the need to weigh them against other rights: that occurred, inter alia, in the case of the right to erasure of personal data, in its manifestation as the ‘right to be forgotten’. 21 Article 12(2) of the GDPR. 22 The Court has drawn other consequences from those stipulations, which are not provided for in the wording of the GDPR: see judgments, Meta Platforms Ireland, and of 4 October 2024, Lindenapotheke (C‑21/23, EU:C:2024:846), in relation to standing to bring proceedings before the civil courts under Chapter VIII of the GDPR. 23 Article 79(1) of the GDPR emphasises that the right to judicial protection is granted ‘without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority …’ See also judgments, Meta Platforms Ireland, paragraph 54, and of 12 January 2023, Nemzeti Adatvédelmi és Információszabadság Hatóság (C‑132/21, EU:C:2023:2, paragraphs 34, 35 and 42). 24 As an additional argument, it should be recalled that, under Article 80(2) of the GDPR, Member States have the option to provide that certain bodies may exercise the rights referred to in Article 79 of the GDPR without a mandate from data subjects. Frequently, action taken by those bodies fulfils a preventive function. The view that Article 79(1) does not include such protection would render that provision (and Article 80(2) of the GDPR) virtually meaningless. 25 Judgment of 20 June 2024, Scalable Capital (C‑182/22 and C‑189/22, EU:C:2024:531, paragraph 23); judgment in Agentsia po vpisvaniyata, paragraph 153; and judgment in Patērētāju tiesību aizsardzības centrs, paragraph 40 et seq. The Court has held that the right of any person to seek compensation for damage under Article 82 of the GDPR ‘reinforces the operational nature of the protection rules laid down by that regulation and is likely to discourage the reoccurrence of unlawful conduct’: judgments of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data) (C‑300/21, EU:C:2023:370, paragraph 40); of 11 April 2024, juris (C‑741/21, EU:C:2024:288, paragraph 59); and of 20 June 2024, Scalable Capital (C‑182/22 and C‑189/22, EU:C:2024:531, paragraph 22). However, the Court has stated that the purpose of the provision is not to discourage future unlawful processing. 26 Quirin’s written observations, paragraph 1, in fine. 27 Emphasis added. That was Article 76(5) of the Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), COM(2012) 11 final, which reproduced Article 18(1) of Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce) (OJ 2000 L 178, p. 1). The Parliament did not suggest amendments in that regard. 28 Quirin’s written observations, paragraph 1, in fine. 29 Alternative explanation put forward, and rejected, by Quirin, loc. ult. cit. 30 Article 75 governed the legal standing of the data subject, international jurisdiction, the concurrence of judicial and administrative proceedings in the context of the consistency mechanism and the enforcement of judgments of other Member States. For its part, Article 76 referred to the legal standing of entities which aim to protect data subjects’ rights and interests concerning the protection of their personal data; communication between courts of different Member States; the concurrence of proceedings in two or more Member States; and the aim of protection measures. 31 However, that term did not appear in the proposal, which merely referred to the rapid adoption of measures. 32 As stated in the referring court’s question. 33 As stated in paragraph 21 of the order for reference. 34 Sometimes it is not possible to exercise, or at least not to do so in full, the right to erasure of data or the right to restriction of processing: see Article 17(3) (processing that is necessary for certain purposes) and Article 23 of the GDPR. In a similar vein is Article 18(2) of the GDPR, which refers to the processing of data in the interests of persons other than the data subject or the public interest. Logically, it is not possible to obtain a ban on processing permitted by those rules or an order to desist from such processing. 35 The retention by the controller of personal data which that controller has a duty to erase is exceptional: see Article 17(3) and recital 65 of the GDPR. As a rule, the obligation to erase certain data also entails the destruction of those data. 36 In a ‘mixed’ situation, in which lawful and unlawful processing of the same data is being carried out, the retention of the lawfully processed data may be advantageous not only to the controller but also to the data subject. For example, in the instant case, it is reasonable to assume that the (lawful) processing of IP’s personal data is acceptable to him because otherwise he would be unable to take part in Quirin’s staff selection process. 37 Inter alia, where personal data have been unlawfully processed: Article 17(1)(d) of the GDPR. 38 See, in that connection, Articles 18 (right to restriction of processing) and 21 (right to object). 39 See footnote 35 above. The Commission’s proposal, in relation to Article 17(1) of the GDPR, granted the data subject the right ‘to obtain from the controller the erasure of personal data relating to them’ and ‘the abstention from further dissemination of such data …’ That phrase was considered ‘meaningless’ by a number of Member States’ delegations, with whom the President of the Council also agreed, given that, once data have been erased, their dissemination is no longer possible: see the note from the Presidency of the Council to the Data Protection Working Party, document 16529/12, of 4 December 2012, footnote 245. Paragraph 8 of Article 17, which stated that ‘where the erasure is carried out, the controller shall not otherwise process such personal data’, was also considered to be superfluous: ibidem, footnote 270. 40 Temporarily: see the points below of this Opinion. 41 Article 18(2) of the GDPR. Where processing is restricted under Article 18(1) of the GDPR, and until such time as the restriction is lifted, any processing of the personal data concerned other than its storage is exceptional and is dependent on fulfilment of one of the grounds laid down in Article 18(2). 42 The term equivalent to ‘almacenamiento’ is used in a number of language versions of the GDPR, such as the English (‘storage’) and the German (‘Speicherung’). For its part, Article 12(b) of Directive 95/46 used the word ‘blocking’, as does Article 15(1)(c) of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1). All those terms evoke the concept of ‘freezing’ of personal data. 43 Particularly clear in the grounds laid down under (b) and (c). 44 Storage does not only entail keeping data but also technical operations such as marking data (which, pursuant to Article 4(3) of the GDPR, is the definition of ‘restriction of processing’) or the operations described in recital 67 of the GDPR, which enable the data concerned to be recognised, isolated and protected against any processing. 45 ‘… for a period enabling the controller to verify the accuracy of the personal data’. 46 For as long as the data subject requires the data ‘for the establishment, exercise or defence of legal claims’. 47 ‘pending the verification whether the legitimate grounds of the controller override those of the data subject’. 48 The uncertainties expressed in that regard meant that, during the negotiations in the Council, that point of the Commission’s proposal, which the Parliament did not question, was initially placed in brackets (see the note from the Presidency of the Council to the Data Protection Working Party, document 16529/12, of 4 December 2012, footnote 275) and then simply removed. Its subsequent reappearance for consideration by the delegations is explained (debatably, in my view) because the possibility to which it refers increases the data subject’s protection ‘without entailing [an] additional administrative burden on controllers’: note from the Presidency of the Council to the delegations in preparation for the trilogue, document 11696/15, of 4 September 2015, p. 9, in which the delegations are also asked ‘to show flexibility on this point’. 49 There was a similar provision to Article 18(1)(b) of the GDPR in Directive 95/46, and also in Article 15(1)(c) of Regulation No 45/2001. The same wording is found in Article 20(1)(b) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39). Those provisions have not been interpreted by the Court and, in my view, give rise to the same uncertainties as the GDPR, from which it follows that they do not assist with the interpretation of that regulation. 50 Recital 39 and Article 5(1)(e) of the GDPR. See, also, judgment of 20 October 2022, Digi (C‑77/21, EU:C:2022:805, paragraph 53): ‘the principle of “storage limitation” requires the controller to be able to demonstrate, in accordance with the principle of accountability …, that personal data are kept only for as long as is necessary for the purposes for which they were collected or for which they have been further processed’. 51 In my view, the purpose of assisting the data subject to establish the unlawful processing would be acceptable: Article 18(1)(b) and (c) have similar aims but a different starting point (unlawful processing under (b) and lawful processing under (c)). 52 Judgment of 12 January 2023, Nemzeti Adatvédelmi és Információszabadság Hatóság (C‑132/21, EU:C:2023:2, paragraph 45 et seq.). 53 Paragraph 24 of the order for reference. Judgment of 22 February 2022 (VI ZR 1175/20, ECLI:DE:BGH:2022:220222UVIZR1175.20.0). 54 Judgment of the Bundesgerichtshof (Federal Court of Justice) of 22 February 2022 (VI ZR 1175/20, ECLI:DE:BGH:2022:220222UVIZR1175.20.0), paragraphs 44 and 51. 55 Judgment of 20 June 2024, PS (Incorrect address) (C‑590/22, EU:C:2024:536, paragraph 31). 56 Judgment of 20 June 2024, PS (Incorrect address) (C‑590/22, EU:C:2024:536, paragraph 32), and judgment in Agentsia po vpisvaniyata, paragraph 144. 57 Judgment of 14 December 2023, Natsionalna agentsia za prihodite (C‑340/21, EU:C:2023:986, paragraphs 79 and 80). 58 Judgment in Patērētāju tiesību aizsardzības centrs, paragraphs 36 and 37. 59 Judgment in Agentsia po vpisvaniyata, paragraph 150. 60 See footnote 25 above. The amount of financial compensation must reflect the damage actually suffered by the data subject, without exceeding that amount or being set at a lower level either: judgments of 20 June 2024, PS (Incorrect address) (C‑590/22, EU:C:2024:536, paragraph 41), and Patērētāju tiesību aizsardzības centrs (paragraphs 43 and 44). The severity and possible intentional nature of the infringement of the GDPR must be disregarded (judgment in Patērētāju tiesību aizsardzības centrs, paragraph 42), as must the controller’s attitude and motivation (ibidem, paragraph 44), or the fact that several infringements have been committed by the controller in relation to the same data subject (judgment of 11 April 2024, juris C‑741/21, EU:C:2024:288, paragraph 64).