Judgment;Summary — ECLI:EU:C:2024:1051
Date: 2024-12-19
Language of the case: German
Court formation: Eighth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Summary C-65/23 – 1 
Case C-65/23 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
8 February 2023 
Referring court: 
Bundesarbeitsgericht (Germany) 
Date of the decision to refer: 
22 September 2022  
Applicant, appellant in first appeal and appellant on a point of law: 
MK 
Defendant, respondent in first appeal and respondent in the appeal on a point 
of law: 
K GmbH 
  
Subject matter of the main proceedings 
Regulation (EU) 2016/679 – Protection of natural persons with regard to the 
processing of personal data – Data processing in the context of employment – 
Right to compensation – Conditions – Lawfulness of data processing – Necessity 
of data processing – Margin of appreciation of the parties to a works agreement – 
Judicial review – Damage – Assessment of the amount of non-material damage 
for which compensation is to be awarded 
Subject matter and legal basis of the reference 
Interpretation of EU law, Article 267 TFEU 
Questions referred for a preliminary ruling 
1. Is a national legal provision that has been adopted pursuant to Article 88(1) 
of Regulation (EU) 2016/679 – such as Paragraph 26(4) of the 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-65/23 
 
2  
Bundesdatenschutzgesetz (German Federal Law on data protection, ‘the 
BDSG’) – and which provides that the processing of personal data, including 
special categories of personal data, of employees for the purposes of the 
employment relationship is permissible on the basis of collective agreements 
subject to compliance with Article 88(2) of Regulation 2016/679, to be 
interpreted as meaning that the other requirements of Regulation 2016/679 – 
such as Article 5, Article 6(1) and Article 9(1) and (2) of Regulation 
2016/679 – must always also be complied with? 
2. If the answer to Question 1 is in the affirmative: 
May a national legal provision adopted pursuant to Article 88(1) of 
Regulation 2016/679 – such as Paragraph 26(4) of the BDSG – be 
interpreted as meaning that the parties to a collective agreement (in this case, 
the parties to a works agreement) are entitled to a margin of discretion in 
assessing the necessity of data processing within the meaning of Article 5, 
Article 6(1) and Article 9(1) and (2) of Regulation 2016/679 that is subject 
to only limited judicial review? 
3. If the answer to Question 2 is in the affirmative: 
In such a case, to what is the judicial review to be limited? 
4. Is Article 82(1) of Regulation 2016/679 to be interpreted as meaning that a 
person is entitled to compensation for non-material damage when his or her 
personal data have been processed contrary to the requirements of 
Regulation 2016/679, or does the right to compensation for non-material 
damage additionally require that the data subject demonstrate non-material 
damage – of some weight – suffered by him or her? 
5. Does Article 82(1) of Regulation 2016/679 have a specific or general 
preventive character, and must that be taken into account in the assessment 
of the amount of non-material damage to be compensated at the expense of 
the controller or processor on the basis of Article 82(1) of Regulation 
2016/679? 
6. Is the degree of fault on the part of the controller or processor a decisive 
factor in the assessment of the amount of non-material damage to be 
compensated on the basis of Article 82(1) of Regulation 2016/679? In 
particular, can non-existent or minor fault on the part of the controller or 
processor be taken into account in their favour? 
Provisions of European Union law relied on 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
K GMBH 
 
3 
95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), in 
particular Articles 2, 4, 5 and 6, Article 82(1) and Article 88(1) and (2) thereof. 
Provisions of national law relied on 
Bundesdatenschutzgesetz (German Federal Law on data protection) (BDSG) of 
30 June 2017 (Bundesgesetzblatt (Federal Law Gazette, ‘BGBl.’) I p. 2097), 
which was last amended by Article 10 of the Law of 23 June 2021 (BGBl. I 
p. 1858; 2022 I 1045), in particular Paragraph 26 
‘Paragraph 26 Data processing for the purposes of the employment relationship 
(1) Employees’ personal data may be processed for the purposes of an 
employment relationship where this is necessary for the decision on the 
establishment of an employment relationship or, after the establishment of 
the employment relationship, for its implementation or termination or for the 
exercise or discharge of the rights and obligations arising from the 
representation of employees’ interests and laid down by law or a collective 
labour agreement or works or service agreement (collective agreement). … 
… 
(4) The processing of personal data, including special categories of 
personal data of employees, for the purposes of an employment relationship 
is permitted on the basis of collective agreements. In this context, the 
negotiating partners shall comply with Article 88(2) of Regulation (EU) 
2016/679.’ 
Succinct presentation of the facts and procedure 
1 The applicant claims compensation from the defendant, his employer, under 
Article 82(1) of Regulation 2016/679 for the non-material damage which he has 
suffered as a result of an infringement of that regulation. 
2 For staff management purposes, the defendant initially used a traditional data 
management system (personnel information system) in which, in accordance with 
the relevant company agreements, inter alia, the following employee data were 
recorded: salary information, private residential address, date of birth, age, marital 
status, national insurance number, tax identification number. 
3 In 2017, there were plans in the group to which the defendant belonged to switch 
to the cloud-based personnel information system, ‘Workday’, throughout the 
group. In this context, the defendant uploaded, inter alia, the following data of the 
applicant to a website of the parent company in the period from 24 April to 
18 May 2017: surname, first name, work telephone number, work email address, 
salary information (annual and monthly salary, amount of performance-related 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-65/23 
 
4  
remuneration), private residential address, date of birth, age, marital status, 
national insurance number, tax identification number. 
4 A corresponding works agreement confirming acquiescence was concluded a 
posteriori with the works council [(‘the relevant works agreement’)]; it related to 
very specific data: personal identification number, surname, first name, telephone 
number, entry date, group entry date, place of work, company name (K/Dental), 
place of work, company name, work telephone number and work email address. 
The period of validity and subsequent timeframe of the relevant works agreement 
was extended several times. A ‘Framework Works Agreement on the Operation of 
IT Systems’ and a ‘Works Agreement on the Introduction and Use of Workday’ 
then entered into force on 23 January 2019. 
5 The applicant submits that the processing of his data in the context of the testing 
of the new personnel information system was not in accordance with Regulation 
2016/679. In this respect, his complaint ultimately concerns only the processing of 
his data in the period from 25 May 2018 – the first day on which Regulation 
2016/679 was applicable – until the end of the first quarter of 2019. 
The essential arguments of the parties in the main proceedings 
6 The applicant maintains that he is entitled, pursuant to Article 82(1) of Regulation 
2016/679, to non-material compensation of the order of EUR 3 000. 
7 The defendant had not been permitted under Regulation 2016/679 and the relevant 
provisions of the BDSG to process his data in the cloud-based personnel 
information system ‘Workday’ in the period from 25 May 2018 to the end of the 
first quarter of 2019. 
8 During this period, the data processing required in the employment relationship of 
the parties had been carried out using the previous personnel information system, 
which is why it had not been necessary for the employment relationship, from any 
viewpoint, to transfer his data to another system and process it there during the 
same period. Nor was the data processing carried out necessary for testing 
purposes for the subsequent operation of ‘Workday’ as a uniform group-wide 
personnel information system. On the contrary, so-called ‘dummy’ test data would 
have sufficed for the test phase; it was not necessary to use real data and to make 
them accessible in ‘Workday’ within the group. 
9 In any case, if the court – contrary to the position of the applicant – considers real 
data to be necessary or if the relevant works agreement is considered sufficient as 
a legal basis for data processing using real data, the permission for data processing 
contained in the relevant works agreement had been exceeded. In addition to the 
categories of data covered by that works agreement, the defendant had also 
transferred other data, such as his private contact information, contractual and 
remuneration details, his national insurance number, his tax identification number, 
K GMBH 
 
5 
his nationality and his marital status. The defendant had not been entitled to do so, 
either under the relevant works agreement or otherwise. 
10 With regard to the burden of raising and presenting an issue and the burden of 
proof, the applicant argues that this largely falls on the defendant. It is for the 
defendant to present its case and to prove that its actions complied in detail with 
Regulation 2016/679. 
11 The defendant’s infringements of Regulation 2016/679 moreover caused the non-
material damage suffered by the applicant. The unnecessary processing of data in 
‘Workday’ or, in any event, the unlawful transfer of his data and its accessibility 
within the group, including for unauthorised third parties, in itself gives rise to 
non-material damage. There is also a risk of misuse of his data by third parties, 
which places him, as the data subject, in a situation of uncertainty. As an 
employee, he would not be in a position to know whether and, if so, in what way 
and for what purposes, the data transmitted by the defendant within the group 
would be used or have already been used by the defendant, and even by third 
parties. Thus, given the possibilities and purposes of ‘Workday’, it is conceivable 
that his personal data would be used for profiling, i.e. to create and/or use a 
profile. Since he does not have access, as an employee, to the inner workings of 
such data processing within the defendant’s organisation and therefore cannot 
substantiate his case in that respect, the employer, i.e. the defendant, must for that 
reason also largely bear the burden of raising and presenting an issue and the 
burden of proof. Furthermore, the mere possibility of misuse of data should be 
sufficient to establish non-material damage, since, contrary to what is envisaged in 
recital 85 of Regulation 2016/679, the applicant has consequently already lost 
control over his personal data. 
12 The fact that the transfer of data for the purpose of populating ‘Workday’ took 
place even before the date from which Regulation 2016/679 applied, as laid down 
in Article 99(2) of Regulation 2016/679, is irrelevant, as the circumstances 
referred to were ongoing. In that regard, account should also be taken of the fact 
that, contrary to the requirements of Regulation 2016/679 and the BDSG, there 
had been no deletion concept for the data processed in ‘Workday’ (allegedly) for 
testing purposes. 
13 As a result of the breaches of Regulation 2016/679 and the BDSG and the 
associated risks of abuse, his personality rights had been seriously infringed. He 
should receive effective compensation, as envisaged by recital 146 to Regulation 
2016/679. There is in addition an aggravating circumstance in that the defendant 
or its predecessor in law committed the infringements intentionally, deliberately 
circumventing data protection requirements and those relating to industrial 
relations. 
14 The defendant contends that it did not infringe data protection provisions. The 
lawfulness of the data processing follows from Article 6(1) of Regulation 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-65/23 
 
6  
2016/679, Paragraph 26(1) of the BDSG and Paragraph 26(4) of the BDSG, read 
in conjunction with the relevant works agreement. 
15 According to the defendant, the applicant has no right to compensation pursuant to 
Article 82 of Regulation 2016/679. He has failed to provide either a justification 
for liability or sufficient proof of liability. 
16 The applicant, who bears the burden of raising and presenting issues and the 
burden of proof, has not sufficiently demonstrated the existence of non-material 
damage or the causal link in relation to any infringements by the defendant. In so 
far as the applicant has put forward evidence of a specific infringement, the 
defendant maintains that it has at most a secondary burden of assertion. 
17 Any inconvenience felt or any minor breach without serious prejudice would not 
be sufficient to constitute damage. Instead of damage, the applicant merely asserts 
that he is at risk of suffering damage. That is not damage for which compensation 
may be awarded within the meaning of Article 82 of Regulation 2016/679. Rather, 
a prerequisite for this would be a serious infringement of the general right of 
personality which is not compensated in any other way. That has not been 
demonstrated by the applicant. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
1. Preliminary matters 
18 The defendant processes (Article 4(2) of Regulation 2016/679) as controller 
(Article 4(7) of Regulation 2016/679) personal data (Article 4(1) of Regulation 
2016/679) of the applicant in the employment relationship. Such processing falls 
within the material scope of Regulation 2016/679, as defined in Article 2(1) 
thereof. 
19 As regards the processing of the data at issue in the main proceedings in the 
period between 25 May 2018 and the end of the first quarter of 2019, the Chamber 
assumes that the fact that the act of uploading or transferring the personal data at 
issue, taken from the previous personnel information system, took place on a 
website of the parent company of the group before Regulation 2016/679 became 
applicable on 25 May 2018, that is to say during the period from 24 April to 
18 May 2017, does not alter the defendant’s responsibility in that regard, for the 
purposes of Article 4(7) of Regulation 2016/679. The defendant was afterwards 
and continues to be the controller within the meaning of Article 4(7) of Regulation 
2016/679. For this purpose, it is not necessary that the controller alone determines 
the purposes and means of the processing of personal data. In accordance with 
Article 4(7) of Regulation 2016/679, this may also be done jointly with others. In 
the view of the Chamber, the defendant’s responsibility for the purposes of 
Article 4(7) of Regulation 2016/679 would not change even if it were to invoke, in 
the context of the ongoing proceedings, the fact that it did not, or did not 
K GMBH 
 
7 
unconditionally, have the power within the group to help to decide how the data in 
‘Workday’ would be used. From the date of application of Regulation 2016/679, 
the defendant made no attempt to secure the return or deletion of the applicant’s 
data in ‘Workday’ and no such return or deletion has taken place. On the contrary, 
by extending the period of application and subsequent timeframe of the relevant 
works agreement several times, most recently until 31 January 2019, the 
defendant has indicated that it continued to be active as controller within the 
meaning of Article 4(7) of Regulation 2016/679 in order to ensure the provisional 
operation of ‘Workday’, inter alia with the personal data of the applicant that is at 
issue, by concluding further works agreements. 
20 In so far as the Chamber bases these and the following statements on a certain 
interpretation of the provisions of Regulation 2016/679, the Court of Justice is 
asked, should that interpretation be incorrect, to indicate this in addition to 
answering the questions referred. In that regard, case-specific guidance on the 
transfer and processing of data within a group of undertakings is also relevant. 
2. Regarding the first question 
21 By its first question for a preliminary ruling, the Chamber would like to know 
whether a national legal provision that has been adopted pursuant to Article 88(1) 
of Regulation 2016/679 – such as Paragraph 26(4) of the BDSG – and which 
provides that the processing of personal data, including special categories of 
personal data, of employees for the purposes of the employment relationship is 
permissible on the basis of collective agreements subject to compliance with 
Article 88(2) of Regulation 2016/679, is to be interpreted (in conformity with EU 
law) as meaning that the other requirements of Regulation 2016/679 – such as 
Article 5, Article 6(1) and Article 9(1) and (2) of Regulation 2016/679 – must 
always also be complied with. Inextricably linked to this is the question of what is 
meant by ‘more specific rules’ within the meaning of Article 88(1) of Regulation 
2016/679. 
22 An answer from the Court of Justice to those questions is necessary in order to 
resolve the dispute in the main proceedings, so that the Chamber may assess the 
lawfulness of the data processing provided for and carried out under the relevant 
works agreement as a collective agreement. This relates specifically to the data 
sets referred to in the relevant works agreement (see above, para. 4). 
23 In so far as, during the period from 24 April to 18 May 2017, the defendant 
transmitted, in addition to the data sets mentioned in the relevant works 
agreement, further personal data relating to the applicant (salary information, 
private residential address, date of birth, age, marital status, national insurance 
number and tax identification number) to a website of the parent company of the 
group to populate the ‘Workday’ software, the Chamber does assume that this was 
not already covered by the relevant works agreement and should therefore be 
assessed under Paragraph 26(1) of the BDSG rather than under Paragraph 26(4) of 
the BDSG. Arguably such excessive data processing should not have been 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-65/23 
 
8  
necessary within the meaning of Paragraph 26(1) of the BDSG and Article 5 and 
Article 6(1) of Regulation 2016/679 simply because it can be assumed that the 
relevant works agreement (jointly) concluded by the defendant exhaustively listed 
all the data sets it considered necessary for the alleged testing purposes. However, 
in the view of the Chamber, it is not sufficient for the purposes of giving judgment 
in the main proceedings that part of the data processing complained of by the 
applicant must thus already be assessed as being unlawful, even without a 
reference for a preliminary ruling. Rather, it is necessary for the purposes of 
giving judgment in the main proceedings that the Chamber should be able to 
assess the contested data processing as a whole, as this entails or may entail 
consequences with regard to the extent of the infringement of the protection 
provisions and the amount of any compensation. 
24 Paragraph 26(4) of the BDSG, according to which the processing of personal data, 
including special categories of personal data of employees for purposes of the 
employment relationship, is permitted on the basis of collective agreements, 
subject to compliance with Article 88(2) of Regulation 2016/679, could – 
according to its wording – be understood to mean that, apart from the 
requirements in Article 88(2) of Regulation 2016/679, no further requirements of 
Regulation 2016/679 need to be observed. In that case, employment-related data 
processing which would in fact be unlawful because it would not satisfy the 
requirement of necessity laid down in Paragraph 26(1) of the BDSG, Article 5, 
Article 6(1) or Article 9(1) and (2) of Regulation 2016/679, and for which there is 
no consent by the data subject, could be permissible or justified solely on the 
ground that it is governed by a collective agreement – such as a works agreement 
in this case. In a case such as that in the main proceedings, this would mean that 
solely because of the regulation of data processing in a collective agreement – in 
contrast to regulation in a general legal provision such as a law – the necessity of 
the data processing would not need to be examined. 
25 The Chamber assumes that the interpretation of Paragraph 26(4) of the BDSG set 
out in paragraph 24 above would not be compatible with Regulation 2016/679. 
Admittedly, it cannot be denied that the parties to a collective agreement – in this 
case a works agreement – are closer to the facts and it is conceivable that, as a 
rule, they will have achieved an appropriate balance between opposing interests. 
However, Article 88(1) of Regulation 2016/679 provides that Member States may, 
by law or by collective agreements, provide for ‘more specific rules’ to ensure the 
protection of the rights and freedoms in respect of the processing of employees’ 
personal data in the employment context. In the view of the Chamber, it cannot be 
inferred from this that where rules are laid down by a collective agreement – as in 
the present case, by the relevant works agreement – the requirements of necessity 
contained in particular in Article 5, Article 6(1) and Article 9(1) and (2) of 
Regulation 2016/679 are irrelevant. In the view of the Chamber, compliance with 
the regulation cannot be exempted by collective agreement. Rather, it is 
presumably the case that the ‘more specific provisions’ within the meaning of 
Article 88(1) of Regulation 2016/679 – whether provided for by law or by 
K GMBH 
 
9 
collective agreements – will always also require compliance with the other 
requirements of Regulation 2016/679. 
26 In the view of the Chamber, nothing to the contrary follows from the reference in 
Paragraph 26(4) of the BDSG to Article 88(2) of Regulation 2016/679. 
Article 88(2) of Regulation 2016/679, according to which those rules – that is, 
rules within the meaning of Article 88(1) of Regulation 2016/679 – are to include 
suitable and specific measures to safeguard the data subject’s human dignity, 
legitimate interests and fundamental rights, with particular regard to the 
transparency of processing, the transfer of personal data within a group of 
undertakings, or a group of enterprises engaged in a joint economic activity and 
monitoring systems at the workplace, does not, in the Chamber’s view, constitute 
an exemption from the obligation to comply with the other requirements of 
Regulation 2016/679. 
27 As a result, there could therefore be a case for saying that where national rules, 
within the meaning of Article 88(1) of Regulation 2016/679, have been laid down, 
the other requirements of Regulation 2016/679 – such as Articles 5, 6(1) and 9(1) 
and (2) of Regulation 2016/679 – must always also be complied with and that 
provisions in a collective agreement – such as the relevant works agreement – are 
not exempt from this. 
28 That would involve, in the case in the main proceedings, verifying whether the 
processing of the applicant’s data in the provisional operation of ‘Workday’ for 
‘testing’ purposes may be regarded as ‘necessary’ within the meaning of 
Paragraph 26(1) of the BDSG and Article 5 and Article 6(1) of Regulation 
2016/679. In that regard, the Chamber assumes that it cannot be ruled out from the 
outset that, even in the context of the provisional operation of Workday, real data 
may be processed for ‘testing’ purposes, in so far as ‘dummy’ test data are not 
sufficient, which should, however, still be set out in detail by the party responsible 
for raising and presenting issues and providing proof in that regard. For the rest, 
the lawfulness of the processing would be determined in accordance with 
Article 6(1)(b) of Regulation 2016/679. Should the Court of Justice – in addition 
to answering the questions referred for a preliminary ruling – provide case-
specific guidance on the interpretation of Article 6(1)(b) of Regulation 2016/679 – 
including the allocation of the burden of raising and presenting issues and of 
proof – this would be welcome. 
3. Regarding the second question 
29 If the answer to question 1 is in the affirmative, the Chamber would like to know 
by its second question whether a national legal provision adopted pursuant to 
Article 88(1) of Regulation 2016/679 – such as Paragraph 26(4) of the BDSG – 
can be interpreted as meaning that the parties to a works agreement, in which they 
may regulate operational and industrial relations issues as well as formal and 
substantive working conditions, have a margin of discretion in assessing the 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-65/23 
 
10  
necessity of data processing within the meaning of Articles 5, 6(1) and 9(1) and 
(2) of Regulation 2016/679 that is subject to only limited judicial review. 
30 This might not only be supported by the concept of proximity to the facts of the 
parties to collective agreements referred to in paragraph 25 above. The 
consideration – also mentioned in paragraph 25 above – that, as a rule, the 
contractual partners to a works agreement will have achieved an appropriate 
balance between their interests might militate in favour of the contractual partners 
to a works agreement being recognised as having a margin of discretion – 
however this may be framed – in the assessment of the necessity of data 
processing. However, in the view of the Chamber, the recognition of such 
discretion gives rise to considerable reservations. 
31 It is true that, according to the case-law of the Court of Justice, the nature of 
measures adopted by way of a collective agreement differs from the nature of 
those adopted unilaterally by way of legislation or regulation by the Member 
States in that the social partners, when exercising their fundamental right to 
collective bargaining recognised in Article 28 of the Charter of Fundamental 
Rights of the European Union, have taken care to strike a balance between their 
respective interests (judgments of 19 September 2018, Bedi, C-312/17, 
EU:C:2018:734, paragraph 68, and of 8 September 2011, Hennigs and Mai, 
C-297/10 and C-298/10, EU:C:2011:560, paragraph 66 and the case-law cited). In 
the view of the Chamber, however, it is very doubtful whether those findings of 
the Court also apply to a works agreement such as that in the main proceedings, 
given that the parties involved (management and the works council) are prohibited 
from taking industrial action. Even if works agreements could also be regarded as 
deriving from the fundamental right to collective bargaining recognised in 
Article 28 of the Charter of Fundamental Rights of the European Union, that 
would not, in the view of the Chamber, give rise to any discretion on the part of 
commercial partners that could only be subject to limited judicial review. Indeed, 
it follows from the case-law of the Court of Justice that, where the right of 
collective bargaining proclaimed in Article 28 of the Charter of Fundamental 
Rights of the European Union is covered by provisions of EU law, it must, within 
the scope of that law, be exercised in compliance with that law (judgments of 
19 September 2018, Bedi, C-312/17, EU:C:2018:734, paragraph 69, and of 
8 September 2011, Hennigs and Mai, C-297/10 and C-298/10, EU:C:2011:560, 
paragraph 67 and the case-law cited). Consequently, when adopting measures 
falling within the scope of provisions of EU law, the social partners must comply 
with EU law (see, in relation to Directive 2000/78/EC, judgments of the Court of 
Justice of 19 September 2018, Bedi, C-312/17, EU:C:2018:734, paragraph 70; of 
12 December 2013, Hay, C-267/12, EU:C:2013:823, paragraph 27 and the case-
law cited; and of 8 September 2011, Hennigs and Mai, C-297/10 and C-298/10, 
EU:C:2011:560, paragraph 68 and the case-law cited). Furthermore, according to 
the case-law of the Court of Justice, a national court which is called upon, within 
the limits of its jurisdiction, to apply provisions of EU law is under a duty to give 
full effect to those provisions, if necessary by refusing of its own motion to apply 
any conflicting provision of national legislation, and it is not necessary for the 
K GMBH 
 
11 
court to request or await the prior setting aside of such provision by legislative or 
other constitutional means (see judgments of the Court of Justice of 20 March 
2003, Kutz-Bauer, C-187/00, EU:C:2003:168, paragraph 73 and the case-law 
cited, and of 7 February 1991, Nimz, C-184/89, EU:C:1991:50, paragraph 19 and 
the case-law cited). According to the case-law of the Court of Justice, it is equally 
necessary to apply such considerations to the case where the provision at variance 
with EU law is derived from a collective labour agreement. It would be 
incompatible with the very nature of EU law if the court having jurisdiction to 
apply that law were to be precluded at the time of such application from being 
able to take all the necessary steps to set aside the provisions of a collective 
agreement – or, as the case may be, of a works agreement – which might 
constitute an obstacle to the full effectiveness of EU rules (see judgments of the 
Court of Justice of 20 March 2003, Kutz-Bauer, C-187/00, EU:C:2003:168, 
paragraph 74 and the case-law cited, and of 7 February 1991, Nimz, C-184/89, 
EU:C:1991:50, paragraph 20). In the Chamber’s view, there are indications that 
this case-law of the Court of Justice, which has been handed down in relation to 
directives such as Directive 2000/78/EC, is also relevant with regard to the 
requirements of Regulation 2016/679. 
4. Regarding the third question 
32 In the event, however, that the second question is answered in the affirmative and 
the parties to a collective agreement – in this case the parties to a works 
agreement – do have a margin of discretion in assessing the necessity of the data 
processing within the meaning of, for example, Article 5, Article 6(1) or 
Article 9(1) and (2) of Regulation 2016/679 that is subject to only limited judicial 
review, the Chamber would like to know, by its third question, what such judicial 
review should be limited to in such a case. This question concerns any assessment 
criteria which may be indispensable from the point of view of the Court of Justice. 
5. Regarding the fourth question 
33 By its fourth question, the Chamber asks whether Article 82(1) of Regulation 
2016/679 is to be interpreted as meaning that a person is entitled to compensation 
for non-material damage when his or her personal data have been processed 
contrary to the requirements of Regulation 2016/679, or whether the right to 
compensation for non-material damage additionally requires that the data subject 
demonstrate non-material damage – of some weight – suffered by him or her. 
34 In that regard, being aware of the request for a preliminary ruling from the 
Oberster Gerichtshof (Supreme Court, Austria) in Case C-300/21, and referring to 
its own request for a preliminary ruling in Case C-667/21, the Chamber proceeds 
on the assumption that Article 82(1) of Regulation 2016/679 provides for a right 
to compensation only for persons who themselves have suffered an infringement 
of their (subjective) rights as a result of the infringement of one or more 
provisions of Regulation 2016/679 with regard to the processing of ’their’ 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-65/23 
 
12  
personal data (see recital 2 of Regulation 2016/679) and who have thus 
themselves become the victim of one or more infringements of Regulation 
2016/679. Furthermore, the Chamber assumes that the legal right to compensation 
for non-material damage pursuant to Article 82(1) of Regulation 2016/679 does 
not additionally require that the person whose rights have been infringed 
demonstrate (further) non-material damage suffered by him or her beyond such a 
breach of Regulation 2016/679. Therefore, from the point of view of the Chamber, 
that person does not have to demonstrate a ‘consequence of the infringement of at 
least some weight’ (see, in that regard, the third question referred for a 
preliminary ruling by the Oberster Gerichtshof (Supreme Court, Austria) in Case 
C-300/21). In the view of the Chamber, the fact that a person’s (subjective) rights 
have been infringed because of the breach of one or more provisions of 
Regulation 2016/679 with regard to the processing of his or her personal data (see 
recital 2 of Regulation 2016/679) already constitutes non-material damage for 
which compensation can be sought (see this Chamber’s request for a preliminary 
ruling in case C-667/21, paragraph 33). In particular, according to the Chamber, it 
cannot be left to the individual courts of the Member States to determine whether 
there has – under the various national rules – been non-material damage for which 
compensation can be sought. 
35 However, if the Court of Justice takes the view that the fact that a person has 
suffered an infringement of his or her (subjective) rights because of the 
infringement of one or more provisions of Regulation 2016/679 with regard to the 
processing of his or her personal data (see recital 2 of Regulation 2016/679) is 
insufficient, and that instead, the person whose rights have been infringed should 
additionally be required to demonstrate (further) non-material damage – perhaps 
of some weight – that he or she has suffered, then the Chamber needs to know for 
the purposes of giving judgment in the main proceedings which criteria are 
relevant for this. 
36 To the extent that the Court considers that the injured person must show (further) 
non-material damage suffered by him or her, it is necessary for the purpose of 
giving judgment in the main proceedings to know in particular which criteria 
under Article 82(1) of Regulation 2016/679 govern the existence of damage, 
causality and the burden of raising and presenting an issue and of proof. Thus, the 
question could arise in the further proceedings whether just the fact that the 
applicant’s personal data were used for profiling within the meaning of 
Article 4(4) of Regulation 2016/679 contrary to the requirements of that 
regulation would constitute (further) damage of some weight, or whether such 
(further damage) could be assumed to exist only if such a profile were to have a 
negative effect on the applicant, for example by his being unsuccessful in a job 
application procedure ‘because of’ the profile. Related to this is the question of 
who – in view of the actual difficulties of the employees to substantiate (further) 
damage – has the burden of raising and presenting issues and of proof for which 
circumstances, and how, in detail, this burden can be discharged. 
K GMBH 
 
13 
6. Regarding the fifth question 
37 By its fifth question, which corresponds to the fourth question in the Chamber’s 
request for a preliminary ruling in Case C-667/21 (paragraph 35 et seq.), the 
Chamber seeks to ascertain whether Article 82(1) of Regulation 2016/679 also has 
a special or general preventive character in addition to its compensatory function, 
and whether it must take that into account in the assessment of the amount of non-
material damage to be compensated at the expense of the controller (or processor) 
on the basis of Article 82(1) of Regulation 2016/679. 
38 According to recital 146 of Regulation 2016/679, data subjects should receive full 
and effective compensation for the damage they have suffered. In that respect, the 
Chamber proceeds on the assumption that all the circumstances of the individual 
case must be taken into account when the court assesses the compensation for 
non-material damage, and that actual and effective legal protection of the rights 
derived from Regulation 2016/679 is to be ensured. Therefore, it might be of 
decisive importance that – as in other areas of EU law – the amount of 
compensation for non-material damage is commensurate to the seriousness of the 
infringement of Regulation 2016/679 for which liability for such compensation is 
imposed, whereby, presumably, a genuinely dissuasive effect – possibly with a 
special or general preventive character – is to be ensured, but, at the same time, 
the general principle of proportionality would have to be respected (see, in other 
areas of EU law, for example, judgments of the Court of Justice of 15 April 2021, 
Braathens Regional Aviation, C-30/19, EU:C:2021:269, paragraph 38, and of 
25 April 2013, Asociatia ACCEPT, C-81/12, EU:C:2013:275, paragraph 63). 
39 In addition to the principle of effectiveness thus referred to inter alia, the principle 
of equivalence might also have to be taken into account when determining the 
amount of compensation for non-material damage. In that regard, the Chamber 
does proceed on the basis that Article 82 of Regulation 2016/679 makes no 
reference to the law of the Member States of the European Union and must be 
given an autonomous and uniform interpretation throughout the European Union. 
Nevertheless, in view of what may in practice be different amounts of 
compensation in the Member States in comparable cases, aspects of equivalence 
might have to be taken into account when determining the amount of 
compensation for non-material damage (see also in this respect, on the power of 
the Member States to determine appropriate criteria for State liability for damage 
caused to individuals by breaches of EU law, inter alia, judgments of the Court of 
Justice of 5 March 1996, Brasserie du pêcheur and Factortame, C-46/93 and 
C-48/93, EU:C:1996:79, paragraph 67, and of 19 November 1991, Francovich 
and Others, C-6/90 and C-9/90, EU:C:1991:428, paragraphs 42 and 43). 
7. Regarding the sixth question 
40 By its sixth question, which corresponds to the fifth question in the Chamber’s 
request for a preliminary ruling in Case C-667/21 (paragraph 38 et seq.), the 
Chamber seeks to ascertain whether the degree of fault on the part of the 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-65/23 
 
14  
controller (or processor) is a decisive factor in the assessment of the amount of 
non-material damage to be compensated on the basis of Article 82(1) of 
Regulation 2016/679. In that connection, the question arises, in particular, as to 
whether non-existent or minor fault on the part of the controller (or processor) can 
be taken into account in their favour. 
41 That question arises for the Chamber in particular against the background of 
German civil law, in which, in addition to strict liability, there is also fault-based 
liability, whereby fault is referred to, in the national general law of obligations, in 
terms of ‘being responsible’. In this respect, the first sentence of Paragraph 276(1) 
of the Bürgerliches Gesetzbuch (German Civil Code) (BGB) provides that, as a 
general rule, the obligor is liable for intent and negligence, unless provision is 
made for stricter or milder liability. If a similar rule were to apply to Article 82(1) 
of Regulation 2016/679, liability would have to be based on something additional 
to mere infringement of Regulation 2016/679, namely the degree of individual 
culpability due to intent or negligence. However, the Chamber proceeds on the 
assumption that the liability of the controller (or processor) under Article 82(1) of 
Regulation 2016/679 is strict, that is to say, under that provision, the liability of 
the person responsible for the infringement is not at all dependent on the existence 
or proof of fault (see, for other areas of EU law, for example, judgments of 
22 April 1997, Draehmpaehl, C-180/95, EU:C:1997:208, paragraph 17, and of 
8 November 1990, Dekker, C-177/88, EU:C:1990:383, paragraph 22). As stated in 
paragraph 34 above, this Chamber assumes that the infringement of Regulation 
2016/679 as such is sufficient in itself for a right under Article 82(1) of Regulation 
2016/679. 
42 Finally, the Chamber is of the opinion that nothing to the contrary is to be inferred 
from Article 82(3) of Regulation 2016/679 in this respect. It takes the view that 
the provision contained therein, in accordance with which the party concerned is 
to be exempt from liability if it proves it is not responsible for the event giving 
rise to the damage, does not concern fault in the sense of ‘being responsible’. 
Rather, Article 82(3) of Regulation 2016/679 concerns the question of 
‘involvement’ (in the sense of: ‘involved’ or ‘not involved’) – for example in data 
processing contexts which are difficult to understand from the outside and involve 
several potential participants – or the question of authorship in the sense of 
causality. The latter can be assumed, for example, if the event giving rise to 
liability is based on unauthorised access by a third party which was successful 
despite the fact that all the necessary security measures had been taken.